Last updated: April 2025
This notice explains what personal data Peak Prep collects, why, and how it is protected. It applies to parents, guardians, and the child profiles they create. Please read it before registering an account.
1. Who we are
Peak Prep is an educational platform helping families prepare children for transfer tests in Northern Ireland. The service is operated by the Peak Prep team based in Northern Ireland, United Kingdom.
For privacy questions, contact us at seagrevisionapp@gmail.com.
2. What data we collect
Parent / guardian accounts
- Name and email address (used for login, account recovery, and progress emails)
- Password (stored as a secure hash by Firebase Authentication — we never see your password)
- Profile avatar or photo (optional, stored in your account document)
- Notification and contact preferences
- Subscription plan and billing status (managed via Stripe — we do not store card details)
Child profiles
- Display name, year group, and study interests (chosen by you)
- Curriculum target (SEAG, AQE, or England 11+)
- Profile avatar or photo (parent-approved)
- A child passcode (stored as a cryptographic hash — we cannot read the original passcode)
- Rewards, points, and study buddy preferences
Learning data
- Practice test results, topic scores, and answer records
- Challenge progress and completion status
- Topic strengths and weaknesses over time
- Free-text written answers submitted during tests
Technical data
- Firebase Authentication session data (browser-managed)
- Timestamps on records (for ordering and retention)
3. Why we collect it and our legal basis
We process data under the UK GDPR on the following bases:
- Contract — to provide the service you have signed up for (accounts, tests, progress reports)
- Legitimate interests — to improve the platform using aggregated, anonymised performance data; to prevent misuse
- Legal obligation — to comply with applicable laws including safeguarding obligations
- Consent — for optional features such as marketing emails, where we ask separately
4. Children's data
Child profiles are created and managed by a parent or guardian. Children use a short login code and do not create their own accounts. Children do not see billing information, account settings, or personal details from the parent account.
We do not knowingly collect personal data directly from children without parental consent. If you believe a child has registered without parental consent, please contact us and we will remove the data promptly.
Written test answers entered by children may be reviewed by AI tools (see section 6) to generate personalised feedback. No identifying information is sent in these requests.
5. How long we keep data
- Active account data is retained while the account exists and a subscription or trial is active.
- If an account is deleted, we aim to remove personal data within 30 days, except where retention is required by law.
- Anonymised, aggregated learning statistics may be retained indefinitely to improve the platform.
- Backups may retain data for up to 90 days after deletion.
6. Third parties we use
- Google Firebase — authentication, database, and hosting. Data is stored in Google Cloud (europe-west2 region where configured). Firebase privacy
- Stripe — payment processing. Card details are handled entirely by Stripe. We only store your plan status. Stripe privacy
- SendGrid (Twilio) — transactional and progress emails. SendGrid privacy
- OpenAI — AI-generated feedback on written test answers. Prompts do not include names or identifying information. We use OpenAI's API with data handling subject to their enterprise terms. OpenAI privacy
We do not sell personal data to any third party.
7. Your rights
Under UK GDPR you have the right to:
- Access — request a copy of the data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — request deletion of your account and associated data
- Restriction — ask us to limit how we process your data in certain circumstances
- Data portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — where processing is based on consent, withdraw it at any time
To exercise any right, email seagrevisionapp@gmail.com. We will respond within one month.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
8. Security
Passwords are hashed by Firebase Authentication and never stored in plaintext. Child passcodes are hashed server-side using PBKDF2 before storage. Data in transit is encrypted using TLS. Access to the database is controlled by Firestore security rules that restrict each user to their own data.
9. Changes to this notice
We may update this notice as the platform develops. We will post the updated version here and, for material changes, notify account holders by email.
10. Contact
For any privacy-related question, contact seagrevisionapp@gmail.com.