Privacy Notice | GuideMyGrades

1 Who we are

GuideMyGrades Ltd, trading as GuideMyGrades ("we", "us", "our"), provides live online tuition to students in the UK and internationally. GuideMyGrades Ltd is the data controller for the personal data described in this notice, meaning the company decides what data is collected and how it is used.

2 What information we collect

When you enquire or register interest

Your submission is emailed to our team and stored in our private, administrator-only enquiry records (including a private Google Sheet) so we can track and respond to it.

• Parent or guardian name
• Student’s first name and surname
• Parent email address and telephone number
• Student email address, where you provide one so the student can join sessions
• The programme, subject, level and exam board you’re interested in
• Optionally: current and target grades, and anything you tell us in the message field

When you book online

Our checkout asks for the details we need to confirm the booking and send your lesson links:

• Parent or guardian first and last name, email address and mobile number
• Student’s first name, surname, email address and year group. We email the student their lesson times and Google Meet links so they can join each lesson directly
• The programmes you book, the amounts charged and your booking reference
• Whether you ticked the optional box to receive occasional updates from us
• A record that you accepted our Terms (including the version number), consented to the recording arrangements and asked for teaching to begin within the 14-day cancellation period, with the date and time

These details are passed to Stripe to create your payment and are stored with it. We receive them in a booking notification email, which may also be copied to your child’s teacher, and our website keeps a short technical record of each booking (the booking reference, programmes and whether the confirmation email was sent) so that it is processed exactly once. Your card details are entered on Stripe’s own page and never reach us.

If your child enrols

• Attendance records for the sessions they join
• Work they complete in lessons and module assessments, including their answers, marks and feedback
• Lesson recording files containing the tutor and shared teaching content only. Student cameras, microphones and lesson chat are excluded from the published recording
• The Google account email addresses we share recordings and resources with, which are those you give us for that purpose
• Payment and subscription references from Stripe and the fact a payment was received (we do not see or store your card details)
• Correspondence between us, emails and WhatsApp messages about lessons

Information you choose to give us

If you tell us about a special educational need, a health condition, or anything else that affects how we should teach your child, we treat that as special category data and handle it with additional care. We only use it to make reasonable adjustments to teaching, we only share it with the tutor teaching your child, and we delete it when your child stops attending. You are never required to tell us.

Technical information

With your consent, our website uses Google Analytics to understand which pages are useful, which free booklets are downloaded and whether an enquiry was completed. Our hosting provider may also log standard technical information such as IP address and browser type for security and performance purposes. See section 10.

3 Why we use it, and our lawful basis

Under UK GDPR we must have a lawful basis for using your data. Ours are set out below.

4 Children’s data

Most of our students are under 18, so we take particular care here.

• We contract with the parent or guardian, not the student. Enquiries, payment and account decisions all go through an adult.
• We collect the minimum. We ask for a student’s first name and surname, so we can tell apart students who share a first name, and a student email address so we can send them their lesson links. In lessons, students use their first name only as their display name.
• We do not use children’s data for advertising or behavioural profiling.
• Assessment marks do not make high-stakes decisions. They are formative feedback and are not used on their own to decide whether a student may enrol, continue lessons or receive an externally awarded qualification grade.
• Student cameras and microphones stay off throughout every lesson. Students take part in writing through the monitored chat. No child’s face or voice is recorded.
• Every live lesson is recorded for enrolled students. The recording contains the tutor and shared teaching content only and excludes the lesson chat. It is shared view-only through Google Drive for catch-up and revision, not public viewing, and is deleted after 31 August 2027.
• A parent or guardian actively consents before payment. We keep a record of that acknowledgement, separate from optional marketing consent.
• A parent can ask to see anything we hold about their child, and can ask us to delete it, at any time.

We have regard to the ICO’s Age Appropriate Design Code in how we handle children’s data.

5 Who we share it with

We do not sell your data, and we do not share it for anyone else’s marketing. We share it only with the service providers we use to run lessons, and only as far as needed:

We may also disclose information where we are legally required to, or where we need to in order to protect a child. If we have a genuine safeguarding concern, we may share information with children’s social care, the police, or a child’s school, and we may do so without your consent where seeking it would place a child at greater risk. This is set out in our Safeguarding Policy.

6 Where your data is held

Our tutors are based in the United Kingdom and the United Arab Emirates, so data may be accessed from both. Some of our providers store or process data outside the UK. Google, which we use for lessons, recordings and email, is US-based. Stripe, which processes payments, may process payment data in the UK, the EEA and the United States. Hostinger, which hosts this website, is established in the European Economic Area; it and its approved subprocessors may process data in the UK, the EEA and other jurisdictions, depending on the infrastructure used to deliver the service.

Where data leaves the UK, we rely on the safeguards those providers have in place, including UK adequacy regulations where they apply, the UK International Data Transfer Addendum and, where applicable, the UK Extension to the EU–US Data Privacy Framework, so your data continues to receive an equivalent level of protection.

7 How long we keep it

When a retention period ends, we delete the data or anonymise it so it can no longer identify anyone.

8 How we keep it secure

• Student data is held in Google accounts protected by strong passwords and two-factor authentication.
• Access is limited to the tutor teaching that student and the founders who administer the service.
• Lesson links are emailed to the student’s own email address, with a copy in the parent or guardian’s booking confirmation. They are never published publicly.
• Recordings and resources in Google Drive are shared view-only, with downloading switched off, with the named families enrolled in that class. They are never shared by public link.
• Before publication, staff check that the recording contains no student camera image, student voice or lesson chat. Any recording that accidentally contains one of these is withheld and handled as a safeguarding and data-protection incident.
• We do not store payment card details at any point.
• Devices used to access student data are password-protected and encrypted.

If a data breach occurs that is likely to risk your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours and tell you directly where the risk to you is high.

9 Your rights

Under UK GDPR you have the right to:

• Be informed, which is what this notice is for.
• Access a copy of the personal data we hold about you or your child.
• Rectification, have inaccurate data corrected.
• Erasure, ask us to delete data, where we have no overriding reason to keep it (financial and safeguarding records are the main exceptions).
• Restrict processing, ask us to pause using it while a concern is resolved.
• Data portability, receive your data in a portable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time, where consent is our basis.

To exercise any of these, email info@guidemygrades.com. We will respond within one month. There is no charge. We may ask you to confirm your identity first, so we don’t disclose a child’s information to the wrong person.

10 Cookies and website analytics

With your consent, our website uses Google Analytics to see which pages parents and students find useful and whether the enquiry journey is completed, so we can improve the site. You are asked before this starts, and you can change your mind at any time using “Manage cookie preferences” below.

Our website has an online checkout. The programmes you add to your basket are kept in your browser’s local storage for up to 14 days so you can come back to them; this holds programme choices only, not names or contact details. The details you type at checkout are kept in your browser’s session storage and are cleared when you close the tab. These are strictly necessary for the checkout to work, so no consent is requested for them. Card payment happens on Stripe’s own secure page and we never see or store your full card details.

Our host may collect standard server logs (IP address, browser type, pages requested) for security and performance. These are not used to identify you.

Google Analytics. No cookie is set and no analytics data is collected about you unless you accept. If you accept, Google Analytics sets a cookie to record which pages you visit, which free booklets you download, how you arrived at the site, and general information such as approximate location, device and browser type. It does not receive your name, email address or telephone number from this website. This continues only until you withdraw that consent; see Google’s own privacy policy for how Google itself handles this data.

Embedded videos. Our subject pages can show videos hosted by TikTok, Instagram or YouTube. Nothing is requested from any of these platforms when the page opens: the player is only created if you press play. If you do press play, your browser connects to whichever platform hosts that video, TikTok, Instagram or YouTube, to load it, and that platform may set its own cookies and receive your IP address at that point, under their terms rather than ours. For YouTube we use its privacy-enhanced mode, which avoids setting cookies until you interact with the player. If you would rather not connect to any of these platforms, simply do not press play.

If we introduce advertising technology or any other non-essential browser storage in future, we will update this notice and request consent where required before using it.

Manage cookie preferences

11 Marketing

We will only send you marketing about our programmes if you have asked us to, or if you are already a customer and it concerns a similar service. Every message includes a way to opt out, and you can also just reply asking us to stop. We do not pass your details to any other organisation for marketing.

12 Changes to this notice

We review this notice at least annually, and whenever we change how we handle data. The version number and date at the top always reflect the current version. If we make a significant change, we’ll tell enrolled families directly rather than relying on you to check this page.

13 How to complain

If you’re unhappy with how we’ve handled your data, please tell us first, email info@guidemygrades.com and we’ll try to put it right.

You also have the right to complain to the UK’s data protection regulator at any point: