Privacy Policy

1. Who We Are

RevisionCity (“we”, “us”, “our”) is an IGCSE revision platform operated by Revision City Ltd, incorporated in England and Wales. We provide study notes, flashcards, quizzes, practice questions, AI-generated tests, AI tutoring, personalised revision plans, and mock exam simulations to IGCSE students.

This policy explains what personal data we collect when you use RevisionCity, why we collect it, how long we keep it, and what rights you have. We are the data controller for the purposes of the UK GDPR and the EU GDPR.

2. Data We Collect

2.1 Account Data

When you create an account via Clerk (our authentication provider), we receive:

• Your name and email address
• A unique user identifier assigned by Clerk
• Profile image (if you sign in via Google or Apple)
• Date and time of account creation and last sign-in

We do not store passwords ourselves. Clerk handles authentication securely on our behalf.

2.2 Study Progress & Activity Data

As you use the platform, we record:

• Which subjects, topics, and subtopics you have studied
• Quiz scores and best scores per subtopic
• Flashcards reviewed and practice questions completed
• Notes and recall prompts accessed
• AI-generated tests created and results
• Mock exam attempts, answers submitted, timing data per question, and grade predictions
• Personalised revision plans (subject, target grade, weekly schedule)
• Activity timestamps

This data is stored in our database (Supabase) and is used solely to power your personalised experience — showing your progress, predicting grades, and adjusting revision plans.

2.3 Payment Data

Subscription payments are processed by Stripe. We never see or store your full card number, CVV, or bank account details. What we do store is:

• Your Stripe customer ID
• Subscription tier (Free, Pro, or Premium) and status (active, cancelled, etc.)
• Billing cycle (monthly or annual) and renewal dates

Stripe stores your full payment information under their own privacy policy and PCI-DSS compliance programme.

2.4 Technical & Usage Data

• Browser type and version
• Operating system
• Approximate location (country/region level, derived from IP address)
• Pages visited and features used
• Performance and error logs (used for debugging)

3. How We Use Your Data

4. Third-Party Processors

We share data with the following third-party processors, each bound by Data Processing Agreements (DPAs) with us. We have chosen providers that offer appropriate GDPR safeguards.

5. AI Features & Anthropic

RevisionCity uses Anthropic's Claude AI for the following features:

• AI Test Generator — generates custom quiz questions for a topic you choose
• AI Tutor — answers your study questions in a Socratic, educational style
• Mock Exam Grader — evaluates your written answers against mark schemes
• Revision Plan Generator — creates a personalised weekly study schedule

We do not send your name, email, or payment information to Anthropic. Study queries are sent with only the context needed to generate an educational response (subject, topic, and your input text).

If you do not wish to have your study content processed by Anthropic, do not use the AI Tutor, AI Test Generator, Mock Exam Grader, or Revision Plan features. All other features of RevisionCity work without AI and do not involve Anthropic.

6. Cookies

We use the following cookies and local storage:

The Clerk session cookies are strictly necessary for authentication and cannot be disabled while remaining signed in. You can block all cookies via your browser settings, but this will prevent you from signing in.

7. Data Retention

8. International Transfers

Your study and account data is stored in the EU (Supabase on AWS eu-west). Some of our processors (Clerk, Anthropic, Vercel, Stripe) operate in the USA. Where data is transferred to the USA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of protection.

For UK users, international transfers are made in accordance with the UK International Data Transfer Agreement (IDTA) or addendum to the EU SCCs, as applicable.

9. Children's Data

We minimise the personal data we collect from all users, including minors. We do not display advertising, build behavioural profiles for third parties, or use children's data for any purpose other than providing the educational service.

Study progress data (quiz scores, topics studied) is stored to power the core revision tracking features. This data is not shared with any third party except as described in Sections 4 and 5, and is never used for marketing or advertising purposes.

If you believe a child under 13 has created an account without parental consent, please contact us at privacy@revisioncity.com and we will promptly delete the account and all associated data.

10. Your Rights Under GDPR

If you are in the UK or EU, you have the following rights regarding your personal data:

We will respond to all data rights requests within 30 days. To exercise any of these rights, email privacy@revisioncity.com.

11. How to Request Data Deletion

To delete your account and all associated data:

1. From the app: Sign in → click your profile avatar (top right) → “Manage Account” → “Delete Account”. This immediately queues your account for deletion.
2. By email: Send a request to privacy@revisioncity.com with the subject line “Data Deletion Request” from your registered email address. We will process the request within 30 days.

Note: Stripe billing records are retained for 7 years from the transaction date regardless of account deletion, as required by UK HMRC regulations. All other data (study progress, activity logs, revision plans, exam attempts) is permanently deleted.

12. Security

We implement technical and organisational measures to protect your personal data:

• All data is encrypted in transit using TLS 1.2+
• Database data is encrypted at rest (Supabase/PostgreSQL)
• Row Level Security (RLS) is enforced on all database tables — each user can only access their own data
• API keys and service credentials are stored as environment variables, never in source code
• Authentication is delegated to Clerk, which provides bot protection, brute-force prevention, and secure session management
• Payment card data is handled exclusively by Stripe and never touches our servers

If you discover a security vulnerability in RevisionCity, please report it responsibly to security@revisioncity.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes (for example, adding a new third-party processor or changing data retention periods), we will:

• Update the “Last updated” date at the top of this page
• Send a notification email to all registered users
• Where required by law, seek fresh consent

Continued use of RevisionCity after a policy change constitutes acceptance of the updated terms, to the extent permitted by law.

14. Contact Us

For any questions about this Privacy Policy, data rights requests, or concerns about how we handle your personal data:

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data in accordance with UK data protection law.