1. Who we are
blessingsedtech.com is run by Blessings Edtech LLC, Shams Free Zone, Sharjah Media City, United Arab Emirates (licence 2647775.01). In this policy, "we" and "us" mean that company. We decide what happens to the information described here.
To ask anything about your information, email info@blessingsedtech.com.
2. Who our accounts are for
Our courses are for students preparing for IGCSE, GCSE, AS and A Level exams, who are usually 14 to 18.
An account belongs to the person who creates it. A parent or guardian can create one for their child and keep it, while the child signs in with it. A student aged 13 or over can create their own.
A child under 13 must not create an account. A parent or guardian can create one and hold it for them. If we learn that a child under 13 created an account themselves, we will close it straight away and email the account's address asking a parent or guardian to take it over. If a parent does within 30 days, the account and its progress are theirs; if not, we delete it.
If you are under 18 and created your own account, please make sure a parent or guardian knows. Paying for a subscription needs an adult's card (our terms say more).
We do not ask for a date of birth.
3. What we keep
When an account is created:
- An email address and a password. We never see the password itself: our sign-in provider keeps only a scrambled form of it that cannot be turned back.
- A name. We use it to greet you, and the AI tutor uses the first name.
- When the account was created, and when you agreed to our terms and this policy.
When you study:
- Each practice question you answer: which question, the answer you chose, whether it was right, the marks, and when.
- Each practice session: when it started and ended, and which topic it covered.
- Which chapters you can open.
- Which chapters you read to the end, and when you first did. Not how long you spent or how often you came back.
This history is how the site shows your progress and what to work on next. It is also a detailed picture of what a student finds hard, and we protect it with that in mind.
When you pay:
- Your card details go straight to Stripe, our payment provider, on Stripe's own page. We never see them or keep them.
- We keep a record of your subscription: the plan, whether it is active, when the current period starts and ends, and whether a payment failed.
- If we give access by hand, for example after a bank transfer or as a free place, we record that we did, for how long, why, and which member of staff did it.
When you look at prices: the company that hosts our site tells us which country your connection seems to come from. We use it only to decide whether to show prices in pounds or dirhams first. You can switch, and we do not keep it.
When staff change an account: if staff switch a course off on an account, we record when, who, and a reason from a short list, for example that the family asked or a payment failed.
What we do not collect: your home address, phone number, date of birth, school, photos, or where you are beyond the country above. There are no advertising or analytics trackers on this site.
4. Why we use it
| What we do | Why | The legal reason we rely on |
|---|---|---|
| Run your account and sign you in | So the service works | It is needed to provide the service you signed up for |
| Keep practice history and show progress | It is what the service is | It is needed to provide the service |
| Take payment and keep subscription records | To provide what you paid for, and because the law requires financial records | It is needed to provide the service; legal duty |
| Record access given by hand, and courses switched off | To keep an honest record of who changed an account and why | Our legitimate interest in running the service fairly |
| Send sign-up and password-reset emails | To run the account | It is needed to provide the service |
| Check that a sign-in comes from a person, not a program | To keep accounts and our emails safe | Our legitimate interest in security |
| The AI tutor | It is part of the subscription | It is needed to provide the service |
| Staff reading an AI conversation for a safety concern or a quality check | To protect students and make sure the tutor explains things properly | Our legitimate interest in keeping students safe and the service sound |
We do not sell your information, use it for advertising, or use it to train AI models. We do not send marketing emails.
5. Free chapters without an account
You can read the first chapter of every course without an account. We do not record who reads it.
6. The AI tutor
About the AI companion
Your child's conversations with the AI are saved to their account.
There is no separate parent view. To read them, sign in to your child's account with their login. We have not built a parent portal on purpose: you can already see everything this way, and a second route in would mean another door to the most sensitive thing we hold.
Your child is told all of this the first time they open the AI, including that you can read their conversations. We would rather they heard it from us than found out later.
We can read them too. We do not go through them routinely, but we may look if there is a safety concern, or to check the AI is explaining things properly.
What the tutor can see. Only the student's own information: their first name, their practice answers by question and topic with what the mark scheme wanted for each, which chapters they can open and have read to the end, and the chapter they are asking about. It never sees a question they have not answered yet, their surname, their email address, a parent's details, any payment information, or anyone else's data.
Who answers. The tutor is Claude, made by Anthropic. What a student types, and the information above, is sent to Anthropic to write each answer. Anthropic keeps and processes this data in the United States. It deletes it within 30 days, unless its safety systems flag a conversation, when it may keep it for up to two years. Our agreement with Anthropic does not let it train its models on this data.
Staff reading a conversation. Each time a member of staff opens a student's conversations, we record who, which student, when and why. We do not record what they read.
How long conversations are kept. While the subscription runs, and for 90 days after it ends. Then they are deleted. A student cannot delete single messages; deleting the account deletes all of them.
What the tutor does not do. It does not monitor students for signs of distress, and it does not keep any judgement about how a student is feeling. It is a study assistant, not a counsellor. If a student is ever in danger, they should tell an adult they trust or call the emergency services.
7. Who else handles your information
These companies help us run the service. Each works on our instructions under a data processing agreement, except where we say otherwise.
| Company | What for | What it handles | Where |
|---|---|---|---|
| Supabase | Our database and sign-in | Everything in section 3 | Frankfurt, Germany |
| Vercel | Hosting the website | Each request to the site, including your IP address, briefly in its logs | Our code runs in Frankfurt; Vercel is a US company |
| Stripe | Payments | The payer's email, card details and payment history | United States and elsewhere |
| Bunny.net | Playing lesson videos | Your IP address, to send you the video. No account details | Stored in Frankfurt; sent from servers around the world |
| Cloudflare | Checking a sign-in comes from a person | Your IP address and browser details while you sign in, sign up or reset a password | Around the world |
| Anthropic | The AI tutor | See section 6 | United States |
| Mailgun | Sending account emails | Your email address and the emails we send you | European Union |
Two of these also act for themselves. Stripe uses payment information to prevent fraud and meet anti-money-laundering law. Cloudflare uses sign-in signals to get better at spotting automated traffic. For those purposes they decide how the information is used, and their own privacy policies apply.
We will update this list before we add anyone new.
8. Where your information goes
Our database is in Frankfurt. Some of the companies above are in the United States or use it. When your information leaves the UK or the European Economic Area, it is protected by the European Commission's standard contractual clauses and the UK's addendum to them, and, for companies certified to it, the EU-US Data Privacy Framework and its UK extension. These are the protections the UK and EU recognise for information sent abroad.
9. Cookies and storage on your device
We use only what the site needs to work. There are no advertising or analytics cookies, so we do not ask you to accept any.
| Name | What it does | How long |
|---|---|---|
sb-…-auth-token | Keeps you signed in | Up to 400 days, or until you close the browser if you untick "Keep me signed in" |
sb-…-code-verifier | Set when you sign up or ask for a password reset, as part of signing in safely | Until the link is used |
bl-session-only | Remembers that you unticked "Keep me signed in" | Until you close the browser |
app-theme | Remembers light or dark mode | One year |
| Storage in your browser | Remembers display and study settings on this device: text size, sound in practice, the study timer, and similar | Until you clear it |
| Cloudflare Turnstile, on sign-in pages | Checks you are a person | Set by Cloudflare |
| Bunny's video player | Remembers where you stopped in a video | Up to 7 days |
Stripe, on the checkout page: __stripe_mid, __stripe_sid | Helps Stripe stop fraudulent payments | One year, and 30 minutes |
10. How long we keep things
| What | How long |
|---|---|
| Your account, practice history and subscription records | While the account is used. If an account is not used and has had no subscription for two years, we email a warning, and delete it 30 days later if it is still unused. Signing in cancels the warning |
| Records of access given by hand, and courses switched off | While the account exists |
| AI conversations | While the subscription runs, then 90 days |
| Records of staff reading AI conversations | While the account exists. They say who read, when and why, never what |
| Payment records at Stripe | As long as Stripe must keep them for tax, fraud and legal reasons |
| A record that an account was deleted | Kept, with nothing in it that says whose account it was |
| Backups | Seven days, then overwritten |
| Server logs | About seven days at our database provider, and about one day at our host |
11. Deleting your account
You can delete your account yourself from your account settings, by typing its email address to confirm. You can also ask us to, at the address in section 1.
If a card subscription is still running, cancel it first, and delete the account once the paid time has run out. This makes sure a card is never charged for an account that no longer exists.
What is deleted: the sign-in, the profile, practice history, subscription records, records of access given by hand, AI conversations and the records of staff reading them, and the customer record at Stripe.
What stays: a record that an account was deleted, when, and whether by the family, by staff or for not being used, with nothing that says whose it was; the payment records Stripe must keep by law; and backups and logs until they are overwritten (section 10).
12. Your rights
You can ask us to:
- give you a copy of the information we hold about you, or about your child if you hold their account;
- correct anything that is wrong;
- delete it (section 11);
- give it to you in a form you can take elsewhere;
- stop using it for something, where the law allows.
Write to info@blessingsedtech.com. We will reply within one month. To protect the account, we may ask you to write from the account's own email address, or to confirm you hold it.
You can also complain to a regulator: in the UK, the Information Commissioner's Office (ico.org.uk); in the UAE, the UAE Data Office; in the European Union, the data protection authority where you live. We would be grateful for the chance to put things right first.
13. Children
Most of our students are children, and we have built the site around that. We collect as little as we can. We do not show adverts, we do not build profiles of students for anyone else, and other users cannot contact a student through the site.
14. Keeping it safe
Information is encrypted while it travels and where it is stored. Each student can reach only their own data, and that is enforced by the database itself, not only by the website. Staff accounts need a second sign-in step from an authenticator app. Lesson videos and notes are reached through links that expire after a short time.
15. Changes to this policy
If we change this policy in a way that matters, we will email account holders before the change applies. The date at the top says when it last changed.
Privacy policyTerms of serviceGuidance for parents