Privacy Policy

1. Who We Are

Big Maths is run by Andrell Education Ltd ("we", "us", "our"), a company registered in England and Wales (company number 05331897). Our registered office is Premier House, High Street, Crigglestone, Wakefield, WF4 3EB. We are the data controller for the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO), registration number ZA134895.

Questions about your data: email support@bigmaths.com.

We have one privacy policy for each of our services:

• www.bigmaths.com: https://www.bigmaths.com/privacy-policy/
• the Big Maths Beat That! app and its website for parents, tutors and teachers, bigmaths.website: https://bigmaths.website/privacy
• Big Maths Online, Big Maths at Home, and our other Andrell Education websites: https://www.andrelleducation.com/privacy-notice/

We are committed to protecting the privacy of all users, with particular care for children's data. This policy explains how we collect, use, and protect personal information through the Big Maths website (bigmaths.website) and mobile application.

We are not required to appoint a formal Data Protection Officer under Article 37 UK GDPR. For any question about how we handle personal data, email support@bigmaths.com.

2. Information We Collect

Parent/Guardian Account Information

• Email address
• Password (encrypted)
• Payment information (processed securely by Stripe)

Child Profile Information

• First name (shown in the app)
• School year group
• Curriculum (England, Scotland or Wales)
• Learning progress and scores

Adult Sign-in Source Records

Our server records classified website and non-portal sign-ins so authorised administrators and support staff can help with account access. This record contains only the adult account identifier, the source category and the first and latest recorded times for each category. Website requests are marked by our server; other nonbrowser requests are classified as non-portal. Missing or unmarked browser information is excluded. Request information is used for classification but raw user agents, IP addresses, device fingerprints, child identifiers and a list of every sign-in are not stored in this record. It is deleted when the adult account is permanently deleted. Non-portal sign-ins are not proof of app use, downloads or installations. Recording starts when this feature is activated; earlier sign-ins are not reconstructed, and unclassified events or sessions created before an adult profile exists are not included.

Family Voice Library

Parents may optionally record voice messages to encourage their child during practice. Recordings are made on this website only; the app does not record audio, it only plays the messages you have recorded. These recordings are stored securely and are only accessible by the parent who created them and played to their own child. To play your messages, the app keeps a copy on your child's device. If you delete a message on the website, the app removes its copy from a device after that device next connects and syncs. Removing the child from the device also removes the cached copy. Voice recordings can be deleted at any time through the Family Voice section of the Big Maths web portal. You can delete or re-record messages at any time from the child's Family Voice Library.

Learning Activity from the App

• Your child's answers, scores, time taken and progress in each activity, so we can run the service and show you their progress

The app does not collect device identifiers, location, crash reports or analytics, and it does not track your child across other apps or websites. Our hosting providers keep standard server logs (such as IP address and time of request) for security.

3. How We Use Your Information (Legal Basis)

Under UK GDPR, we must have a lawful basis to process your personal data. The table below explains how we use your information and our legal basis for each purpose:

For children's data, processing is based on parental consent provided when creating a child profile, combined with contract performance for delivering educational services.

4. Children's Privacy

Big Maths is designed for children aged 4-11. We take extra precautions to protect children's data:

• Children cannot create accounts directly - a parent or guardian must create the account
• We collect only the minimum information necessary for the service
• We do not display advertising to children
• We do not sell children's data
• Children's profiles use display names only, not full names
• Parents have full control over their child's data and can delete it at any time

How We Obtain Parental Consent

Under UK GDPR Article 8 and the Children's Code, we must obtain verifiable parental consent before processing children's data. Our consent process works as follows:

1. Adult account creation: Only adults aged 18+ can create a Big Maths account. During signup, you confirm you are at least 18 years old.
2. Email verification: We verify your email address to confirm you have access to the account and can receive important communications.
3. Parental declaration: When adding a child profile, you must confirm that you are the parent or legal guardian of the child and consent to their use of the service.
4. Payment verification: For paid subscriptions, payment is processed through an adult's payment method, providing additional verification of adult involvement.

Granular consent for optional features:

• Family Voice Library: Parents choose whether to record messages and can delete or re-record them at any time from the web portal.
• School/Tutor linking: Sharing your child's progress with a school or tutor requires you to explicitly share a linking code. To stop sharing, email support@bigmaths.com and we will remove their access.

Withdrawing consent: You can withdraw consent for any processing at any time by:

• Removing your child: on your child's page, select Remove followed by their name
• Deleting Family Voice recordings, or emailing support@bigmaths.com to stop sharing with a school or tutor
• Deleting your entire account
• Contacting us at support@bigmaths.com

We comply with the UK Age Appropriate Design Code (Children's Code) and applicable data protection laws regarding children's privacy.

5. Data Sharing & Sub-Processors

We share data only with trusted service providers who help us deliver our service:

We do not sell personal information to third parties. Our providers process personal data on our behalf under data processing terms.

6. International Data Transfers

Some of your data may be transferred to and processed in countries outside the UK. We ensure appropriate safeguards are in place:

• Supabase - Our database provider stores data in the EU (Stockholm region). Any transfer of UK data by Supabase Inc. to the US relies on the UK Extension to the EU-US Data Privacy Framework.
• Stripe - Payment processing may involve transfers to the US. These rely on the UK Extension to the EU-US Data Privacy Framework.
• Mailchimp Transactional (Mandrill) - Our account and service emails are sent from the US. These transfers rely on the UK Extension to the EU-US Data Privacy Framework.

Where data is transferred outside the UK, we rely on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum, so that your data receives equivalent protection.

7. School and Tutor Access

If you choose to link your child's account to a school or tutor using a linking code:

• They will see your child's display name and learning progress
• They will NOT have access to parent email, payment details, or voice recordings
• You can ask us to remove their access at any time by emailing support@bigmaths.com
• The school/tutor cannot transfer or share this access

8. Data Security

We protect your data using:

• SSL/TLS encryption for all data transmission
• Encrypted password storage (bcrypt hashing)
• Row-level security policies on our database
• UK and EU data storage

In the event of a data breach involving personal information, we will notify the appropriate authority within 72 hours and affected users as required by law.

9. Data Retention

We use a two-state model to balance your rights with educational continuity:

Cancelling Your Subscription

When you cancel your subscription, your children's learning is kept, so a child can pick up exactly where they left off if you come back, rather than starting from scratch. A child's maths learning represents months or years of progress, and this approach prioritises the child's educational interests, as required by the ICO's Children's Code. You can ask for it to be permanently deleted at any time (see below).

Removing a Child

When you remove a child's profile through the parent web portal, the child is hidden straight away. You can restore them from your dashboard within 29 days. After that, the child and their learning, including any Family Voice recordings made for them, are permanently deleted. This cannot be undone.

Permanent Deletion (GDPR Erasure)

If you want data permanently and irreversibly deleted, you can request erasure in Account → Privacy & Data Rights. Here's what happens:

1. Day 0: You submit your request. Data is immediately hidden.
2. Days 1-28: Cooling-off period. You can cancel the request anytime.
3. Day 21: We send a reminder email (7 days remaining to cancel).
4. Day 29: Data is permanently deleted. This cannot be undone.

What gets deleted: Progress Tree, learning achievements, challenge history, voice messages, and all other personal data. An anonymised audit record is kept to prove we complied with your request.

Deleting Your Whole Account

You can delete your whole account, with all your children's data, in the app (Account Settings → Delete My Account) or on the website (Account → Delete your account). Both work the same way: a 28-day cooling-off period begins and your subscription will not renew, so there are no further charges. You can cancel by logging back in on the website and cancelling the request within those 28 days. On day 29 your account and your children's data are permanently deleted.

Other Retention Periods

• Payment records: 7 years (legal requirement)
• Support correspondence: 2 years after resolution

10. Your Rights

Under UK data protection law you have the right to: ask for a copy of your personal data; have it corrected; have it deleted; ask us to restrict how we use it; object to how we use it; receive it in a format you can take elsewhere; and withdraw your consent at any time where we rely on consent. To use any of these rights, contact us (see "Who we are"). We will reply within one month. If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO) at https://ico.org.uk or on 0303 123 1113.

How to Exercise Your Rights

You can exercise most rights directly through your account:

• Download your data: Account → Privacy & Data Rights → Download My Data → Download
• Request permanent deletion: Account → Privacy & Data Rights → Request Permanent Deletion → Request Erasure next to your child
• Delete your whole account: in the app or on the website, with a 28-day cooling-off; see section 9
• Delete voice recordings: Dashboard → your child's card → Family Voice Library → the bin button (Delete recording) → Confirm
• Stop sharing with a school or tutor: email support@bigmaths.com and we will remove their access

Your data export includes: your account information, all child profiles, learning progress, challenge history, and voice messages. The export is a data file (JSON), which a computer can read.

You can also contact us at support@bigmaths.com for any data rights request. We will reply within one month.

For full details on how to delete your account or a child's data, see our Account Deletion page.

11. Cookies and Similar Technologies

Our website uses cookies to provide and improve our service. A cookie is a small text file stored on your device.

Cookies We Use

We do NOT use:

• Advertising or marketing cookies
• Third-party tracking cookies
• Analytics cookies

You can control cookies through your browser settings. However, disabling essential cookies will prevent you from logging into your account.

12. Automated Decision-Making

Big Maths uses algorithms to personalise learning content for children. This includes:

• Selecting practice questions based on learning progress
• Adjusting difficulty levels automatically
• Identifying areas that need more practice

Important: These automated processes:

• Do NOT produce legal or similarly significant effects
• Are designed to enhance learning, not assess or label children
• Do not affect access to the service or subscription terms
• Can be corrected: you can ask us at support@bigmaths.com to correct or reset your child's learning data

If you have concerns about how automated systems affect your child's experience, please contact us at support@bigmaths.com.

13. Changes to This Policy

We may update this policy from time to time. The date at the top shows when it last changed. We will tell you about significant changes by email.