Legal
Privacy policy.
What Courselo collects, why, who helps us run the service, how long we keep it, cookies and storage, and how to use your rights.
Last updated 1 Oct 2026
1.The short version
- We collect what we need to teach you, track your progress, grade your work and run Pro subscriptions. Nothing more.
- We never sell your data, never show adverts of our own, never send marketing emails, and never use your work to train AI.
- A few trusted companies help us run Courselo (sign-in, database, hosting, payments, AI, email). Most are in the United States, under contracts that protect your data.
- You can download everything we hold about you, or delete your account, at any time from your account page.
- Questions, requests or complaints: hello@courselo.org. You can also complain to the Information Commission (ICO).
If you’re under 18, this page is written for you too. If anything is unclear, ask a parent, guardian or teacher, or email us and we’ll explain.
2.Who we are
Courselo is run by TechMasons LTD, a company registered in England and Wales (company number 14843665), whose registered office is 643 Stratford Road, Sparkhill, Birmingham, B11 4DY, United Kingdom. We decide how and why your personal data is used, which makes us the “controller” under UK data protection law.
For anything about your data, email hello@courselo.org. We are a small company and have not appointed a data protection officer; the same address reaches the person responsible for privacy.
3.What we collect
What you give us
- Account details: your email address and name. If you sign in with Google, Google gives us your name, email address and profile photo. You need an email address to have an account; everything else is optional.
- Your exams and goals: the exams you choose, your target score, your exam date, the hours a week you can study and your daily goal.
- Your answers and work: every answer you give in practice, mock exams and reviews, with how long it took; essays and written answers; bookmarks and the notes you add to them; and your conversations with the AI tutor.
- Speaking recordings: when you record a spoken answer, the audio is sent to our AI provider to be turned into text. We keep the text and the grade, not the recording.
- Messages to us: what you write when you email us.
What we work out or record as you study
- Progress: lessons completed, how well you know each topic, review cards, your study plan, daily study time, AI grades and feedback, and predicted scores.
- Account activity: when you created your account and last signed in, and your time zone (read from your browser, so your day starts at the right time).
When you pay
- Subscription and payments: your plan, its status and renewal date, and a record of each payment (amount, any VAT, currency, date, invoice number and the email address used) and of any refund. Card details go straight to Stripe, our payment provider. We never see or store your card number. Stripe also keeps the billing details you give it: your name and billing address (at least the country and postcode, which decide whether and how much VAT applies). You can change them under Manage subscription.
Technical information
- Logs: like every website, our hosting provider and our sign-in provider record technical details of requests (such as IP address, browser type and time) to run and protect the service. We do not store IP addresses in our own database, and we don’t use analytics or tracking tools.
- Emails we send you: a log of which emails we sent, to which address, and whether they arrived, so we can send a missing receipt again.
We don’t ask for sensitive information such as health, religion or ethnicity. If you choose to include something like that in an essay or a tutor message, we use it only to give you the feature you asked for. You can delete a tutor conversation at any time.
4.How we use it, and our legal reasons
The law says we need a lawful reason (“lawful basis”) for each use of your data. These are ours:
Run your account and your courses: lessons, practice, mock exams, AI grading, the tutor, predicted scores, study plans and progress
- Data used
- Account details, exams and goals, answers and work, progress
- Lawful basis
- Contract: it is the service you signed up for. For learners under 18, also our legitimate interest in providing the education service you asked for.
Take payments, manage your subscription, send receipts and renewal reminders, and handle cancellations and refunds
- Data used
- Account details, subscription and payment records
- Lawful basis
- Contract, and our legal obligations under consumer law
Send service emails: welcome, receipts, reminders, notices about your account
- Data used
- Email address, name, subscription details
- Lawful basis
- Contract and legitimate interests (keeping you informed about your own account). We send no marketing.
Keep Courselo secure, prevent abuse and enforce fair-use limits on the free plan
- Data used
- Account activity, usage counts, logs
- Lawful basis
- Legitimate interests: protecting you, other learners and the service
Keep accounting and tax records
- Data used
- Payment records
- Lawful basis
- Legal obligation (company and tax law)
Answer your messages, requests and complaints, and deal with legal claims
- Data used
- What you tell us, and the records concerned
- Lawful basis
- Legal obligation (for data protection requests and complaints) and legitimate interests
Delete accounts that have not been used for a long time
- Data used
- Account activity, email address
- Lawful basis
- Legal obligation not to keep data longer than needed, and legitimate interests
| What we do | Data used | Lawful basis |
|---|---|---|
| Run your account and your courses: lessons, practice, mock exams, AI grading, the tutor, predicted scores, study plans and progress | Account details, exams and goals, answers and work, progress | Contract: it is the service you signed up for. For learners under 18, also our legitimate interest in providing the education service you asked for. |
| Take payments, manage your subscription, send receipts and renewal reminders, and handle cancellations and refunds | Account details, subscription and payment records | Contract, and our legal obligations under consumer law |
| Send service emails: welcome, receipts, reminders, notices about your account | Email address, name, subscription details | Contract and legitimate interests (keeping you informed about your own account). We send no marketing. |
| Keep Courselo secure, prevent abuse and enforce fair-use limits on the free plan | Account activity, usage counts, logs | Legitimate interests: protecting you, other learners and the service |
| Keep accounting and tax records | Payment records | Legal obligation (company and tax law) |
| Answer your messages, requests and complaints, and deal with legal claims | What you tell us, and the records concerned | Legal obligation (for data protection requests and complaints) and legitimate interests |
| Delete accounts that have not been used for a long time | Account activity, email address | Legal obligation not to keep data longer than needed, and legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights and expectations, with extra care for learners under 18. You can object to any use based on legitimate interests (see Your rights).
5.AI, grades and predictions
AI grading of essays and speaking, the tutor, explanations of answers, and the voices in listening recordings are produced with OpenAI, based in the United States. When you use one of these features, we send OpenAI only what it needs: your answer or message, the question, recent messages in the same tutor conversation, and a short summary of your study (such as your target score and weakest topics). We never send your name or email address.
- OpenAI does not use what we send to train its models.
- OpenAI may keep what we send for up to 30 days to detect abuse, then deletes it. Speaking recordings sent for transcription are not kept by OpenAI after the text is returned, and we don’t keep the recording either.
- The voices you hear in listening recordings are generated by AI. They are not real people.
Profiling. To teach you well, Courselo builds a picture of what you know: a rating for each topic from your answers, a schedule for reviewing what you got wrong, a study plan, and a predicted score with its likely range. This is the core of the service, so it can’t be switched off, but it is used only to decide what to show you next. It is never used for advertising, never shared with schools, exam boards or anyone else, and never makes a decision with legal or similarly significant effects on you. AI grades and predictions are estimates. If you think a grade is wrong, email hello@courselo.org and a person will look at it.
7.Data stored outside the UK
Several of the companies above store or process data in the United States. UK law allows this only with safeguards, and we use these:
- Google, Neon (Databricks), Stripe and Vercel: certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), which the UK government has approved. Neon, Stripe and Vercel also include the UK International Data Transfer Addendum in their contracts.
- OpenAI and SiteGround: the UK International Data Transfer Agreement or Addendum (standard contract terms approved under UK law), built into their data processing agreements.
Email hello@courselo.org for a copy of the relevant safeguards.
8.How long we keep it
Your account and study data
- How long
- While your account is open. Deleted at once when you delete your account, and removed from database backups within 30 days.
Accounts that are not used
- How long
- If you don’t sign in for 3 years, we email you, and delete the account 30 days later unless you sign in. Never while you have a Pro subscription.
Speaking recordings
- How long
- Not kept: only the text and the grade are stored.
What OpenAI receives
- How long
- Up to 30 days at OpenAI, for abuse monitoring, then deleted.
Payment and refund records
- How long
- Six years after the end of the financial year the payment falls in (our year ends on 31 May), as tax law requires. Kept even if you delete your account; then deleted.
The log of emails we sent you
- How long
- 12 months.
Copies of account emails in our courselo.org mailbox
- How long
- Up to 12 months.
Emails you send us, and complaints
- How long
- As long as we need them to help you, and no longer than 2 years after we last hear from you.
Your sign-in record at Google Firebase
- How long
- Deleted when you delete your account. Firebase keeps sign-in logs (with IP addresses) for a few weeks.
Your customer record at Stripe
- How long
- We delete it when you delete your account; Stripe keeps payment records it must keep by law.
Technical logs at our host
- How long
- A short period set by the host, for security.
| Data | How long |
|---|---|
| Your account and study data | While your account is open. Deleted at once when you delete your account, and removed from database backups within 30 days. |
| Accounts that are not used | If you don’t sign in for 3 years, we email you, and delete the account 30 days later unless you sign in. Never while you have a Pro subscription. |
| Speaking recordings | Not kept: only the text and the grade are stored. |
| What OpenAI receives | Up to 30 days at OpenAI, for abuse monitoring, then deleted. |
| Payment and refund records | Six years after the end of the financial year the payment falls in (our year ends on 31 May), as tax law requires. Kept even if you delete your account; then deleted. |
| The log of emails we sent you | 12 months. |
| Copies of account emails in our courselo.org mailbox | Up to 12 months. |
| Emails you send us, and complaints | As long as we need them to help you, and no longer than 2 years after we last hear from you. |
| Your sign-in record at Google Firebase | Deleted when you delete your account. Firebase keeps sign-in logs (with IP addresses) for a few weeks. |
| Your customer record at Stripe | We delete it when you delete your account; Stripe keeps payment records it must keep by law. |
| Technical logs at our host | A short period set by the host, for security. |
9.Your rights
Under UK data protection law you have the right to:
- See your data and take a copy (access and portability): Download your data on your account page gives you everything we hold about you in one file. You can also ask us by email.
- Correct it: change your name on your account page, or ask us to correct anything else.
- Delete it: Delete account removes your account and study history straight away. We keep only the payment and refund records the law makes us keep. If you can’t sign in, email us and we’ll delete it for you.
- Object to how we use your data where we rely on legitimate interests.
- Ask us to restrict (pause) using your data, for example while we check whether it’s accurate, or if you need it kept for a legal claim.
- Ask a person to review an AI grade or anything else decided automatically.
To use any right, email hello@courselo.org from the address on your account (or tell us how to reach you). It’s free. We may ask you to confirm who you are. We reply within one month, or tell you within that month if a complex request needs up to two more. A parent or guardian can ask on behalf of a younger learner; we talk to the learner too when they are old enough to understand.
10.Complaints
If you’re unhappy with how we’ve handled your data, please tell us first, so we can put it right. Email hello@courselo.org with “Data protection complaint” in the subject. We acknowledge every complaint within 7 days (the law allows us 30), look into it without delay, keep you updated, and tell you the outcome, normally within one month.
You can also complain to the UK regulator, the Information Commission (ICO), at any time: ico.org.uk/make-a-complaint. If you live in the European Union, you can complain to the data protection authority where you live.
11.Younger learners
Many learners preparing for school exams are under 18, so Courselo is designed for them by default, following the ICO’s Age Appropriate Design Code (Children’s code), for every learner:
- You must be 13 or older to have an account. If you’re under 18, you need a parent or guardian’s permission, and they must agree to any purchase.
- Courses for exams taken before 13 (such as the 11+) are for a parent, guardian or teacher to use with the child, from the adult’s own account. Please don’t put a younger child’s name or personal details into Courselo.
- Nothing you do on Courselo is public. There are no profiles, messages between learners, adverts of our own, or marketing emails.
- We don’t track your location, and we don’t share your data with anyone for their own use, except as described above.
- Your progress is used only to choose what you study next, never to keep you on the site for longer than you want.
- You can download or delete everything yourself, at any time.
If we learn that an account belongs to someone under 13, we delete it. Parents and guardians who think their child has an account without permission can email hello@courselo.org.
13.Videos from YouTube
Courselo uses YouTube API Services to find videos about each exam and topic. Our server sends YouTube only the exam and topic names to search for, never anything about you, and we don’t record which videos you watch.
When a page shows videos, their pictures load from YouTube, so YouTube (a Google service) receives your IP address. YouTube’s player loads only if you have allowed YouTube videos (in the privacy notice or Privacy choices) and then press play; if you haven’t, pressing play asks first, and you can watch on YouTube’s own site instead. The player loads in its privacy-enhanced mode, and YouTube may store data on your device and show its own adverts, which we don’t choose or control. YouTube’s use of that data is covered by the Google Privacy Policy.
14.Keeping it safe
- Everything travels encrypted (HTTPS). Passwords are handled by Google Firebase and card details by Stripe: neither ever reaches us.
- Your session cookie is secure and can’t be read by scripts on the page.
- At Courselo, only the person who runs it can see account data, through an admin area protected by a one-time code sent by email.
- If a data breach ever put your rights at risk, we would tell you and the ICO as the law requires.
15.Changes to this policy
If we change this policy in a way that matters to you, we’ll email you before the change takes effect. The date at the top shows when it last changed. See also our terms and our refunds and cancellation policy (full refunds within 14 days of your first payment or of a yearly renewal).