Privacy Policy

Interleaved (“we”, “us”, “our”) operates the revision service at interleaved.co.uk: a study tool for UK GCSE and A-Level students that logs lessons and homework, organises practice against the exam specification, and marks answers with AI.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the operator of Interleaved is the data controller for the personal data described in this policy. You can reach us about anything in this policy at [email protected].

This policy explains what we collect, why we collect it, who sees it, how long we keep it and the rights you have. It applies to your use of the Interleaved website and app. Our Terms of Service govern use of the service itself.

We collect the minimum needed to run a revision service. That is:

• Account and sign-in. Your name, email address, how you sign in (email link or a connected account such as Google), and the authentication data needed to keep your session secure. Authentication is run by Clerk on our behalf (see “Who we share information with”).
• Profile and study setup. Your school year group (we ask for a year group, not your date of birth), exam year, the subjects, exam boards and tiers you choose, target grades and exam dates.
• Learning content you add. Lesson and homework entries you type, details such as due dates, teacher comments and marks your teacher returned, and files you upload: for example photos of the board, your notes, homework sheets and handwritten answers, together with the text our transcription features extract from those images.
• Answers and marking. Typed and photographed answers you submit for marking, the resulting mark breakdowns, feedback and confidence scores, and the challenges you raise against a mark.
• Ask conversations. The messages you send to Ask, the built-in study tutor.
• Study activity. Practice sessions, flashcard reviews, quiz and mock results, self-recorded past paper scores, and the mastery estimates the service computes from all of this.
• Usage and billing records. Per-feature AI usage records (marks and tokens used, estimated cost, and usage-limit boosts) and your subscription state. Payments are handled by Stripe through Clerk Billing: we see your plan and transaction references, never your full card details.
• Email preferences. Whether the weekly recap email is enabled and, if you add one, the parent or guardian email address it is copied to.
• Support and requests. Messages you send us, including subject requests and support queries.
• Technical data. IP address, device and browser information processed by our sign-in provider to secure your account, and cookieless, aggregate page analytics (Vercel Analytics). We do not run advertising trackers.

Interleaved is an AI-powered product, so this deserves its own section. To provide its core features we send the relevant content to third-party AI inference providers: hosted language and vision models reached through an OpenAI-compatible API endpoint or an AI gateway. In practice that means:

• typed answers, together with the question and its mark scheme, are sent for marking and per-point feedback;
• photos of handwritten work are sent so a vision model can transcribe them into text before marking;
• the text of lesson and homework entries is sent to suggest specification topics and short summaries;
• your Ask messages, plus the names of the subjects you study, are sent so the tutor can answer at the right level;
• the text of challenges you raise is sent to re-examine a mark;
• mastery and recent-performance data is sent when we generate written insights.

Our prompts are designed not to include your name, email address or account identifiers: the provider sees the content needed for the task, not who you are. Anything you choose to write inside an answer, an upload or a chat message is sent as part of that content, so avoid putting personal information there that you do not want processed.

Marking, transcription and tutor replies are automated: no person reviews your answers unless we explicitly say so (for example, if you ask us to look at a mark). AI providers act as our sub-processors and handle content under their own terms; we take their data handling and retention practices into account when we select and configure them, and we do not send them data they do not need.

Under UK GDPR we need a lawful basis for each use of personal data. Ours are:

• Performing our contract with you (Article 6(1)(b)): running your account, the lesson and homework log, practice sessions, AI marking, Ask, flashcards, mocks, insights, billing and the weekly recap email when it is enabled.
• Our legitimate interests (Article 6(1)(f)): keeping the service and your account secure, preventing abuse and enforcing usage limits, understanding aggregate feature usage so we can improve the service and keep it sustainable, and responding to your enquiries. We balance these interests against your rights; you can ask us for that assessment or object (see “Your rights”).
• Consent (Article 6(1)(a)): optional extras such as copying a parent or guardian on the weekly recap. You can withdraw consent at any time by removing the address in Settings.
• Legal obligations (Article 6(1)(c)): keeping tax and accounting records for payments, and responding to lawful requests such as safeguarding concerns.

We do not use your data to advertise to you, build marketing profiles, or make decisions about anything other than the study features described above.

We never sell personal data and we do not share it with advertisers. We share it only with the service providers (“processors”) needed to run Interleaved:

• Clerk (Clerk, Inc., US): authentication, session security and the hosted billing screens. Clerk processes your sign-in credentials and session data.
• Stripe (Stripe, Inc., US and global): payment processing through Clerk Billing. Card details are entered into Stripe’s checkout and never reach our servers.
• AI inference providers: the hosted model endpoints and AI gateway described above. They receive only the content needed for the task you triggered (an answer, an image, a chat message), not your account details.
• Hosting and database providers: the servers and PostgreSQL database the service runs on (our production target is a self-managed virtual private server; managed cloud services may be used during deployment transitions).
• Object storage: a private file store for your uploads. Files are served only through an access-checked route tied to your account.
• Resend (Resend, Inc., US): delivers the weekly recap email, including to any parent or guardian address you add as a copy recipient.
• Vercel Analytics: cookieless, aggregate measurement of page performance. It is not tied to your identity.

We may also disclose information where the law requires it (for example a safeguarding concern or a court order), or to a buyer if the service changes hands, in which case your data stays protected by this policy or one at least as strong.

Some of our processors are based in the United States or process data there. Where personal data is transferred outside the UK, we rely on lawful transfer mechanisms: the UK–US Data Bridge where the recipient is certified under it, or the UK International Data Transfer Agreement (IDTA) or the UK addendum to the EU standard contractual clauses, together with any supplementary measures the transfer requires.

• Account, profile and learning content (log entries, homework, attempts, markings, mastery, flashcards, uploads): kept while your account is active. When you delete your account these records are removed from our live database and your uploaded files stop being served; residual copies in storage and backups are removed on a rolling cycle.
• Usage and billing records: subscription and payment records are kept for the period tax and accounting law requires (typically up to six years after the transaction). Aggregate, de-identified usage statistics may be kept longer.
• Recap preferences: removing a parent or guardian address stops them being copied on future emails immediately.
• Server and security logs: kept for a short rolling period to keep the service secure and debug problems, then deleted or anonymised.

Interleaved is built for UK students aged roughly 14 to 18 (GCSE and A-Level years). The minimum age for an account is 13: the age at which a child can consent to an online service under UK GDPR. If you are under 13 you may not use Interleaved; if we learn an account belongs to a child under 13 we will delete it.

If you are under 18, a parent or guardian must agree to you using the service and to these terms on your behalf, and paid plans should be purchased by an adult. Our checkout link can be sent to a parent so they can pay directly.

In line with the ICO’s Children’s Code (the Age Appropriate Design Code), we apply high privacy settings by default, collect the minimum data the features need, show no advertising, build no behavioural profiles for marketing, use no engagement nudges, and keep uploads private to your account.

Parents and guardians: the weekly recap can be copied to your email address if the student adds it in Settings, so you see the same activity numbers they do. You can also contact us at [email protected] to ask about the data we hold on your child, or to ask us to correct or delete it. We may need to verify the request with the account holder first.

You have the following rights over your personal data, free of charge in most cases:

• Access and portability. Settings → Privacy → “Download my data” gives you a machine-readable (JSON) copy of everything we hold for your account. You can also ask us for a copy by email.
• Rectification. Correct your details in Settings, or ask us to fix them.
• Erasure. Settings → Privacy → “Delete account” permanently removes your account and learning data. Some records we must keep by law (for example billing records) survive for their required period.
• Objection and restriction. Object to processing based on legitimate interests, or ask us to restrict processing, by emailing [email protected]. Note that AI processing is core to the service, so objecting to it may mean you cannot use AI features.
• Withdraw consent. Switch off the weekly recap or remove the parent copy address in Settings at any time.
• Complain. Contact us first at [email protected] and we will do our best to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Marks, feedback, mastery scores, transcriptions and tutor replies are produced automatically by AI models without human review. We do not use your data to make decisions that have legal or similarly significant effects on you, and our marks are advisory study aids rather than official assessments.

You can contest a mark directly in the app using the challenge feature (marks are re-examined automatically), and you can ask us to look at any AI output by emailing [email protected].

We use only strictly necessary cookies: our sign-in provider Clerk sets session cookies so you stay logged in and so the service can protect your account, and the app may store small preferences such as your theme. Our analytics (Vercel Analytics) is cookieless.

There are no advertising, social-media or cross-site tracking cookies. If you block the necessary cookies, sign-in will not work.

We protect your data with encryption in transit (TLS) and at rest through our providers, a private file store where uploads are served only through an access-checked route tied to your account, least-privilege access for administrators, and no storage of card details on our systems.

No online service is perfectly secure. If you believe your account or data has been compromised, contact us immediately at [email protected]. If we suffer a personal data breach that risks your rights we will notify you and the ICO as the law requires.

We may update this policy as the service or the law changes. The current version is always at interleaved.co.uk/privacy with its effective date. For material changes we will give you reasonable notice by email or a notice in the app before they take effect.

Questions, requests and complaints about privacy: [email protected]

Everything else: [email protected]