Privacy Policy.

Differentiation Academy Limited (trading as DIFF Academy and DIFF) is the data controller for the personal data described in this policy. We are registered in England and Wales, company number 16578456.

Registered office: 94–96 Coppermill Road, Wraysbury, Staines-upon-Thames, England, TW19 5NS.

For any privacy question, request or complaint, email rohan@diffacademy.com. We have not appointed a Data Protection Officer; requests go to the same address.

DIFF AI is used by a parent or guardian, who creates the account and adds their child. Children do not create their own accounts and cannot sign up independently. A child may use a supervised practice mode that the parent starts from their own signed-in account.

Because the parent provides the child's information, the parent is responsible for telling their child, in a way the child can understand, that DIFF AI holds their learning data.

Parent account: name, email address, and a password stored in hashed form by our authentication provider. We never see your password.

Child profile: first name (or a nickname if you prefer), school year, and the exam route or schools you are working towards.

Learning data: practice attempts, answers, question outcomes, timings, session records, tutor scores, tutor feedback, weekly plans and progress summaries.

Files you upload: photographs or scans of your child's work, held in private storage that is not publicly accessible.

Enrolment context: your goals for your child and how much time per week you can commit. We do not ask for health, disability, SEND or access-arrangement information, and we ask you not to type it into free-text boxes.

Technical data: sign-in session information and standard server logs generated when you use the site.

We do not ask for special category data — including health, disability, SEND, ethnicity, religion or biometric information — and we do not operate a separate explicit-consent mechanism for it. Fields that previously asked about difficulties or access arrangements have been removed.

Please do not include this information in free-text fields, uploaded files or ordinary email. If information of this nature has already been provided, contact rohan@diffacademy.com so we can discuss its secure removal.

To provide the service — creating your account, running practice, producing plans, feedback and progress reporting. Legal basis: performance of a contract with you, and our legitimate interest in operating the beta.

To keep the service safe and working — security, abuse prevention, debugging and support. Legal basis: legitimate interests.

To communicate with you — service messages about your account. Legal basis: performance of a contract.

To comply with the law — where we are legally required to retain or disclose information. Legal basis: legal obligation.

DIFF AI uses a third-party AI model, accessed through our hosting platform's AI gateway, to draft wording for a human mentor. Every AI request is made from our server; the model is never called directly from your browser.

AI requests contain structured, non-sensitive academic data only: subject, curriculum topic, task and submission status, counts of work set and completed, tutor scores, and the machine-generated recommendation codes produced by our own rules engine.

AI requests deliberately exclude tutor feedback text, task instructions, submission notes, your goals, any support or accessibility text, your child's name, your name, school names, uploaded files and images.

Drafted text is always reviewed and can be edited or discarded by a human before anyone sees it. We do not make automated decisions that produce legal or similarly significant effects, and the model does not grade, rank or classify your child. The practice and progress logic is deterministic rules, not AI.

Supabase — authentication, database and private file storage.

Lovable — application hosting and the AI gateway used for the drafting described above, which in turn passes the request to an AI model provider.

We do not use third-party advertising or analytics services, and we do not sell or share personal data for advertising or profiling.

Our providers operate internationally, so some processing may take place outside the UK. We are currently documenting the exact processing locations, the transfer safeguards in place with each provider, and each provider's retention terms. We will publish those specifics here before DIFF AI leaves beta. Until we have confirmed them we are not going to state them, because we will not publish claims about your data that we cannot yet evidence. If this matters to your decision to use DIFF AI, email us and we will tell you what we have confirmed so far.

While your account is open we keep your account, child profile, learning records and uploads so the service can show progress over time.

We do not currently run automatic deletion or automatic expiry. Data is removed when you ask us to remove it, as described below. We are honest about this rather than promising a retention schedule we do not yet enforce.

Deletion is a manual request process during the beta. Email rohan@diffacademy.com from your account email address and tell us whether you want a single child's data removed or the whole account.

We will confirm your request and complete it within 30 days. There is no in-product delete button yet, and we will not pretend otherwise.

You can ask for a copy of the personal data we hold, ask us to correct it, ask us to delete it, ask us to restrict or object to how we use it, and ask for it in a portable format. Use the contact address above; we respond within one month.

You can complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with how we have handled your data. We would appreciate the chance to put it right first.

We use only what the service needs to work. Your sign-in session is stored by our authentication provider in your browser, and supervised child practice mode uses a short-lived, server-set session cookie that is cleared when the child exits.

We do not use advertising, tracking or analytics cookies, so there is no consent banner to click.

If we change this policy we will update the effective date and version at the top of this page, and tell account holders by email where the change is significant.