Privacy Policy

Who we are

Growing Roots Academy is run by Growing Roots ltd. We are the data controller for the personal data described here, which means we decide how and why it is used.

What we collect and why

• Parent account details (name, email, login credentials) — to create and run your account. Legal basis: contract.
• Children's details (first name, year group, interests, learning goals) — to enrol them, build learning plans and deliver lessons. Legal basis: contract, with your consent as parent.
• Learning records (enrolments, lesson progress, plans) — to track progress and help teachers. Legal basis: contract and legitimate interests.
• Forum posts and messages — to run class discussions and support. Legal basis: contract and legitimate interests.
• Technical data (IP address, device and browser information, usage logs) — for security, fraud prevention and improving the service. Legal basis: legitimate interests.

Interests and goals you enter may be processed by an AI service to create your child's weekly plan. We only send what is needed to generate the plan.

Who we share it with

• Service providers that host and run our platform, including hosting, database, and AI providers, under contracts that protect your data.
• Paddle, our Merchant of Record, for selling our classes, managing subscriptions, processing payments, tax compliance and invoicing.
• Professional advisers such as lawyers and accountants, where needed.
• Authorities where we are required to by law.

International transfers

Some of our providers may process data outside the UK or EEA. Where they do, we rely on adequacy decisions or standard contractual clauses to keep your data protected.

How long we keep it

We keep account and learning data while your account is open, and for up to 12 months afterwards in case you return. After that it is deleted or anonymised, unless we must keep it longer by law (for example, financial records).

Your rights

Under UK GDPR you have the right to access, correct, erase, restrict or move your data, to object to processing, and to withdraw consent at any time. You can also complain to the Information Commissioner's Office (ico.org.uk). We will respond to requests within one month.

Security

We use appropriate technical and organisational measures, including encryption in transit and access controls, so that only you and authorised staff can see your family's data.

Cookies

We only use essential cookies and similar storage to keep you signed in and the site working. We do not use advertising cookies.