Privacy Policy

• Data controller: Faith Gabriel Onoberhie, trading as MathGPL
• Contact for privacy requests: support@mathgpl.com
• Payment processing and order handling: Paddle.com Market Limited, our reseller and Merchant of Record

Account and identity data you give us when you register or are registered by a school, teacher or parent:

• First and last name, and the display name you choose
• Email address and account credentials (passwords are stored only as a secure hash)
• Country and time zone
• Account-type details: school name and type, subjects taught, number of children, or a student's date of birth

Data created while you use the platform:

• Lesson notes, questions, diagrams, classes, courses, assignments, attempts and results
• Live session and class membership records, and the connections between schools, teachers, parents and students
• Usage and metering records: which features were used, when, the volume of AI generation, and the credits consumed
• Support messages you send us
• Technical data needed to run and secure the service: IP address, device and browser information, and error logs

We do not collect or store your card number, card expiry date or security code. Payment details are collected and processed by Paddle.

• To create and administer your account and provide the platform you asked for — legal basis: performance of a contract with you.
• To process orders, subscriptions, credit purchases, invoices and tax — legal basis: performance of a contract, and compliance with legal obligations. Order handling is carried out by Paddle as Merchant of Record.
• To show schools, teachers and parents the progress of the students they are responsible for — legal basis: performance of a contract with the account that holds that responsibility, and our legitimate interest in providing a teaching platform that works as expected.
• To meter usage, allocate credits and prevent abuse of paid AI features — legal basis: performance of a contract and our legitimate interests.
• To keep the service secure, investigate incidents and prevent fraud — legal basis: our legitimate interests and legal obligations.
• To send account, security and transactional emails such as verification and password resets — legal basis: performance of a contract.
• To send optional product updates or newsletters — legal basis: your consent, which you can withdraw at any time.

A student's date of birth is used internally only, to recommend age-appropriate content and adapt the learning experience. It is never shown on a public profile, a leaderboard or a shared challenge page.

We do not sell personal data. We share it only with the following categories of recipient:

• Merchant of Record and payment processor: Paddle.com Market Limited, which handles checkout, payment processing, subscription billing, invoicing, sales-tax compliance, payment support and refunds for our orders. Paddle receives the order and billing information needed for those purposes.
• Service providers and subprocessors that host and operate the platform: cloud hosting, database and storage providers, email delivery, and the AI model providers that generate lesson content when you request it.
• Schools, teachers and parents you are connected to, limited to the students and classes within their own workspace.
• Professional advisers such as legal and accounting advisers, where necessary.
• Public authorities, where we are required to disclose information by law.

Because Paddle is the Merchant of Record for our orders, Paddle is an independent controller of the payment data it collects and applies its own privacy notice to it. Payment and billing queries can be raised with Paddle at paddle.net.

Access follows the ownership model of the platform: a school can see the teachers and students in its own workspace, a teacher can see the students in their own classes, and a parent can see their own children. Workspaces belonging to different owners are kept separate. Publicly shared challenge pages show only what that challenge needs, such as a display name and a score.

Our hosting, payment and AI providers may process data outside your country. Where personal data is transferred out of the UK or the EEA, we rely on an adequacy decision or on Standard Contractual Clauses with the recipient, together with the technical measures described below.

• Data is encrypted in transit using HTTPS/TLS and encrypted at rest by our hosting and database providers.
• Passwords are never stored in readable form; they are stored as salted hashes.
• Access to data is enforced per row in the database, so an account can only reach the records its role and workspace allow.
• Administrative access is limited to the accounts that need it, and privileged operations run only on the server.
• We keep audit and error logs to detect and investigate unusual activity.

No system can be guaranteed to be completely secure, but we apply appropriate technical and organisational measures and review them as the platform develops.

• Account and platform content: while your account is active, and for a short period afterwards to allow recovery of an account closed in error.
• Order, billing and tax records: for as long as tax and accounting law requires, typically six years.
• Usage and metering records: retained to support billing and credit history, then aggregated or deleted.
• Support messages: retained while needed to resolve your request and for a reasonable period afterwards.

When data is no longer needed for these purposes it is deleted or irreversibly anonymised.

Subject to the law that applies to you, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. Where we rely on consent you can withdraw it at any time. You can also complain to your data protection supervisory authority.

Email support@mathgpl.com from the address on your account and we will respond within one month. Where a student's account is administered by a school or parent, we may need to route the request through that account holder.

We use essential cookies and browser storage to keep you signed in, hold your session, and remember the page you were heading to before signing in. We do not use advertising cookies and we do not track you across other websites. Paddle may set cookies necessary to operate its checkout. You can clear this storage in your browser at any time, though doing so will sign you out.

We may update this notice as the platform develops. The effective date above always reflects the current version, and material changes will be communicated to the email address on your account.