Privacy policy

1. Plain summary

This policy explains how Shuttle Learning Limited handles personal information across our marketing website (shuttlelearning.com) and our educational web app for learning OCR GCSE Computer Science (J277) in Python. We are a UK company and you can reach us at support@shuttlelearning.com. In short: we collect as little as we can, we never sell your data, and where your school sets up your account we act on the school's instructions.

Plain English: This page tells you what we collect, why, and what your rights are.

2. Who we are and how to contact us

Shuttle Learning Limited, 167–169 Great Portland Street, London, England, W1W 5PF. Email: support@shuttlelearning.com.

We are not legally required to appoint a Data Protection Officer under UK GDPR Article 37 (mandatory only for public authorities, large-scale regular and systematic monitoring, or large-scale processing of special category data). Our internal data protection contact is support@shuttlelearning.com.

Plain English: We are a London-based company; email us with any privacy question.

3. What this policy covers

The marketing website at shuttlelearning.com (built on Framer). The canonical URL for this policy is https://www.shuttlelearning.com/legal-pages/privacy-policy. It also covers the educational web app, served at our learn subdomain.

Plain English: This covers both our website and our learning app.

4. Our role: controller or processor

Whether we are the "controller" (we decide why and how data is used) or a "processor" (we act on someone else's instructions) depends on how you use our services.

Marketing website visitors, contact form, mailing list: Shuttle Learning is the controller.

Educational app users who sign in with a school Microsoft account: the school is the controller and Shuttle Learning is the processor under an Article 28 Data Processing Agreement. We only process student and teacher data on the school's documented instructions. Account creation is restricted to school domains we have enabled in advance.

For a narrow set of processing needed to keep the service secure and working — rate-limit counters and diagnostic server logs — Shuttle Learning acts as controller and relies on its own legitimate interests. For all other app data the school is the controller and we are the processor.

Plain English: On the app your school is in charge of your data and we act for them; on the website, and for basic security logging, we are in charge.

5. What we collect, why, and our lawful basis

Where the school is controller for app data, the school sets the lawful basis (typically public task or legitimate interests for core teaching and assessment) and we process on its behalf. The bases below are indicative.

We do not collect home address, phone number, payment details, biometrics, or location beyond approximate country.

Plain English: We collect your school email, your answers, and your scores and feedback. Your code is used to mark you and then deleted straight away.

6. Children's data and the ICO Children's Code

Our app users are aged 14 to 16, so they are children in data protection law. The ICO's Children's Code contains 15 standards for online services likely to be accessed by children. The code does not apply to schools processing pupil information for education, but it may apply to providers of edtech used in schools, so we aim to meet its standards.

In practice: high-privacy settings by default; age-appropriate, plain language (Standard 4); the best interests of the child (Standard 1); a Data Protection Impact Assessment (Standard 2); data minimisation; no profiling for marketing; no behavioural advertising; no nudge techniques; and no geolocation beyond approximate country. There is no analytics, advertising or tracking of any kind inside the educational app. We do not use identifiable children's data for our own commercial purposes such as product development or research. We do keep anonymous question statistics, explained in §6a.

Plain English: Because our users are under 18, we apply extra protections and never advertise to you or profile you.

6a. Anonymous question statistics

To improve our teaching materials we need to know which questions pupils find hard. We do this without keeping anything that identifies a pupil.

After a piece of work has been marked, a separate step classifies the result. It receives only the score, the feedback and the marking notes — never the pupil's code — and returns a single label from a fixed list of fourteen (for example "syntax error" or "off by one"). It cannot return free text. Multiple-choice questions are classified without any AI involvement, and we never record which option a pupil chose.

We then store one record containing only: which lesson, which question, whether it was code or a quiz, that label, whether the pupil scored none, some or all of the marks, and the date (date only, never a time). It contains no name, no account identifier, no class, no code and no feedback.

These records are combined into per-question totals and the underlying records are then deleted, so nothing remains that could be matched back to an individual submission. The totals protect small groups: a question attempted fewer than 10 times shows nothing at all, and any single error type occurring fewer than 5 times is hidden. Only Shuttle Learning sees these totals — pupils and teachers do not.

Plain English: We keep anonymous counts — like "40% of people got question 4 wrong on a loop error" — to fix our lessons. Nothing in them points to you.

7. AI-marked submissions (Gemini)

When you submit work for marking, it is sent to a Google Cloud Function hosted in Belgium (europe-west1), which calls Google's Gemini API (model gemini-2.5-flash-lite) on the paid tier. Submissions are capped at 8,000 characters before being sent.

Two calls are made to Google for each submission:

• Marking. Receives your submitted source code or quiz answer, plus the lesson and question identifiers needed to mark it. Returns a score and feedback.

• Classification. Receives only the score, feedback and marking notes produced by the first call — never your code — and returns one label from a fixed list, used for the anonymous statistics in §6a.

What is never sent: your name and email are not part of either prompt. Your Python runs in your own browser via Skulpt and is not sent anywhere just to run.

What happens to your code: when marking succeeds, your code is deleted from our records at the moment your score and feedback are saved. If marking fails, your code is kept for up to 24 hours so the failure can be investigated, then deleted automatically. Teachers see your mark and feedback, not your stored code, because it no longer exists.

Training: Google's Gemini API Additional Terms state that for paid services Google does not use your prompts or responses to improve its products, and processes them under its Data Processing Addendum for products where Google is a data processor.

Retention by Google / ZDR: Zero Data Retention (ZDR) is not enabled for our Gemini configuration. Google's standard abuse-monitoring logging therefore applies: for paid services Google logs prompts and responses for a limited period (currently up to 55 days) solely to detect violations of its Prohibited Use Policy, does not use them to train its models, and then deletes them. Because ZDR is not enabled, both calls above may be logged by Google for that period and, as set out in §11, may transit outside the UK and EU including the US. We keep this under review and will move to ZDR if it becomes available for our configuration.

Human oversight: the AI's score is formative feedback, not a grade of record. It is validated by our server before being shown, and your teacher — not the AI — is responsible for assessing you.

Plain English: Your code goes to Google's Gemini AI to be marked and is then deleted. Google does not train on it. The AI's marks help you learn; your teacher assesses you.

8. Automated decision-making (Article 22)

Article 22 gives extra protection where a decision is made solely by automated means and has a legal or similarly significant effect. (The Data (Use and Access) Act 2025 reshaped this area into Articles 22A–22D from 5 February 2026 and ICO guidance is being updated. We treat Gemini marking as decision support rather than solely automated decision-making: scores are formative feedback that feed back into learning, are never a grade of record, and a teacher retains responsibility for assessing the student. Because our users are children, the ICO is clear that even a small decision may be significant, so we apply this cautiously and keep it under review.

Plain English: The AI helps mark your work but does not make final decisions about you on its own.

9. Cookies, analytics and local storage

Marketing website: uses a cookie banner (allow/deny); Google Analytics with IP anonymisation runs only if you accept; Google reCAPTCHA protects the contact form.

Educational app: no analytics, no tracking, no advertising and no analytics cookies of any kind. The app uses only essential storage: a Firebase Auth token cached in IndexedDB to keep you signed in, and a single localStorage key (shuttle.activeClassId).

For accuracy about the past: Google Analytics previously loaded on lesson pages and recorded page views, IP address and which lesson was open. It never received marks, answers or pupil work. It has been removed entirely.

Plain English: The website uses analytics if you agree. The app uses none at all — only what is needed to sign you in.

10. Sub-processors

Google is our only sub-processor for the educational app. The app uses no Google Analytics, Meta pixels, advertising SDKs, third-party CRMs, payment processors or any analytics provider.

Plain English: Google runs the app's infrastructure and AI marking; Framer only hosts our marketing site.

11. International transfers

We keep app data in the EU: Firestore is pinned to the eur3 multi-region (read-write replicas in Belgium and the Netherlands, witness in Finland) and Cloud Functions to europe-west1 (Belgium). Region pinning guarantees where data is stored at rest, but it does not guarantee that every Gemini API call is processed only in the UK or EU: Google's documentation notes that standard and global endpoints do not guarantee data residency or in-region ML processing, so a call may transit other countries including the US. Where personal data leaves the UK we rely on Google's Cloud Data Processing Addendum, which incorporates Standard Contractual Clauses with the UK Addendum (or the standalone UK International Data Transfer Agreement), supported by a transfer risk assessment. We also keep under review whether the UK Extension to the EU–US Data Privacy Framework provides an additional basis for the US leg.

Plain English: We keep data in Europe and use approved legal safeguards when data leaves the UK.

12. How long we keep information

Plain English: We delete things on a schedule. Your code goes straight after marking; your scores go a year after the school year ends.

13. Keeping information safe

We use: Microsoft school sign-in only for pupils and teachers, restricted to school domains we have enabled in advance, with the pupil-or-teacher role set by our server at account creation and not choosable by the person signing in; Firestore Security Rules that deny client writes to attempts and grading data, with all such writes performed server-side via the Admin SDK; encryption in transit and at rest; our Gemini API key held in Google Secret Manager and never shipped in the client bundle; multi-factor authentication on developer and admin accounts; per-user rate limits (30 submissions per minute, 200 per day); a cap of 8,000 characters per submission; and regular review. This aligns with the NCSC Cloud Security Principles and the Cyber Essentials baseline that KCSIE 2025 and the DfE Generative AI product safety expectations encourage schools to check.

We considered Firebase App Check (reCAPTCHA attestation) and have chosen not to enable it. Earlier versions of this policy referred to it; that reference was inaccurate and has been removed.

A separate email-and-password sign-in route exists for Shuttle Learning staff and demonstration accounts only. It is not used by pupils. The Google sign-in provider is disabled.

Plain English: Only your school account can get in, only our servers can write your marks, and your work is encrypted.

14. Your rights

You have rights to access (Art 15), correct (Art 16), erase (Art 17), restrict (Art 18), data portability (Art 20), object (Art 21), and rights regarding solely automated decisions (Art 22). To exercise them email support@shuttlelearning.com. We respond within one month, extendable by up to two further months for complex or numerous requests under Article 12, and we may pause the clock if we reasonably need information to verify your identity or locate your record. Where your school is the controller, please send requests to your school first; we will cooperate and act on the school's instructions.

What erasure covers. When a school asks us to erase a pupil, we delete their submitted work, their lesson summaries, their class memberships, their user profile, their "report a problem" messages and their sign-in account. We keep one thing: a deletion receipt recording the account identifier, what was deleted and when. We keep it because we must be able to demonstrate that the erasure request was carried out, which is our accountability obligation under Article 5(2). It contains no pupil work.

Plain English: You can see, fix or delete your data. Ask your school first where they run your account.

15. Data breach response

We keep a breach log, investigate promptly, and contain incidents. Where we act as processor, we notify the school (the controller) without undue delay and within 24 hours of becoming aware, so it can meet its own 72-hour deadline to the ICO. Where we are controller, we notify the ICO without undue delay and, where feasible, within 72 hours where the breach is likely to risk people's rights and freedoms, and we tell affected individuals without undue delay where the risk is high.

Plain English: If something goes wrong we act fast and tell the school or the regulator as required.

16. Complaints and the ICO

You can complain to us first at support@shuttlelearning.com. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Plain English: If you are unhappy, contact us, and you can also go to the ICO.

17. Changes to this policy

We version this policy and date each update. Where schools are controllers we notify them of material changes.

Plain English: We will tell you and your school when we change this page.