Privacy policy

Your privacy at a glance

We use your information to run your account, save your work, provide learning support and manage access. Your teacher can see work and progress within their school or class permissions. When you ask an AI tutor for help, your question and relevant learning context are sent to the provider used for that feature.

Keep passwords, payment details and private information about yourself or others out of questions, code and notebooks. If anything worries you, ask a trusted adult, your teacher or our support team for help.

1. Who is responsible for your information

AlgoPath Computer Science at csunderstood.co.uk is operated by Code&AI Limited, trading as AlgoPath Coding Academy. Code&AI Limited is registered in England and Wales, company number 14425345.

Registered office: Suite E Ground Floor, Profile West, 950 Great West Road, Brentford, United Kingdom, TW8 9ES.

For support, privacy requests, cancellations or complaints, email services@code-ai.co.uk or write to our registered office, addressed to AlgoPath support.

We are the data controller where we decide why and how information is used, including personal accounts, customer relationships, billing, support and service security. A data controller is the organisation responsible for those decisions.

For school-managed learning, the school or teaching organisation is responsible for its teaching purposes, class membership and use of learner records. Where we handle those records only on its instructions, we act as its data processor under the school service arrangement. We remain responsible for processing whose purposes we determine ourselves. Your school’s privacy information explains its own use of your information.

2. Information we collect

• Account and access: account identifier, name, email where used, verification status, role, invitations, class membership and course entitlements. Some school learner accounts use a login without a personal email address.
• Learning: course and exam-board choices, preferences, answers, attempts, marks, feedback, progress, video history, saved code and notebooks.
• Tutor interactions: questions, code, relevant lesson content and earlier attempts, generated responses and usage records. Voice features can also create tutor audio and animation.
• Teaching and collaboration: work shared in authorised sessions, teacher observations or edits, and session records.
• Payments: purchases, billing contact information, payment and subscription references, renewal choices, status and access dates. Card details are entered in Stripe’s hosted payment flow; we use the resulting records to manage access.
• Support and technical information: messages you send us and request, device, browser, error and security information associated with using the service.

Information comes from you, your parent or school where they arrange access, sign-in and payment providers, and records generated as you use the platform. Account details needed for sign-in and access are necessary to provide account features; without them, we may only be able to offer public pages. Additional information depends on the features you choose.

3. Why we use information and our lawful bases

• Contract: necessary account, purchase and learning information to deliver a service you contract for, or take steps you request before a purchase.
• Legitimate interests: providing the requested learning service where a parent or organisation is the contracting customer, and necessary support, troubleshooting and prevention of misuse. These interests must be balanced against users’ rights, particularly children’s rights.
• Legal obligations: relevant records to meet accounting, tax and other applicable legal requirements.
• Consent: where a feature or optional communication requires consent, we ask separately. You can withdraw it through the relevant control or by contacting us, without affecting earlier lawful use.

For processing carried out only on a school’s instructions, the school determines and explains its lawful basis. Reading this policy or accepting service terms is not consent to every use of personal information.

4. Children, parents and schools

Learners under 18 should involve a parent, guardian or school in arranging access. An adult or authorised organisation must arrange paid purchases. Children have their own privacy rights; paying for access does not automatically give unrestricted access to a learner’s records.

We may check a person’s authority before sharing account information or acting for someone else. If consent is the required basis for an online feature used by a child under 13, appropriate parent or guardian authorisation is required. This is separate from the school’s arrangements for its teaching.

5. Who receives information

Authorised teachers and school administrators can access records allowed by their role and class membership. Personal study and school learning use separate contexts. Authorised platform staff use information when needed for support, access management or investigating problems.

Depending on the feature you use, service providers include:

• Cloudflare: website and API hosting, storage, computing, media delivery and service email.
• Auth0: sign-in, identity verification and sessions.
• Stripe: hosted payments, subscriptions and billing records when purchasing is available.
• OpenAI and DeepSeek: processing questions and relevant learning context for written tutor help or feedback, according to the feature.
• OpenAI speech and Spatius: generating tutor speech and animating generated audio when voice features are used.

If you choose an external notebook service such as Google Colab, information you open or enter there is also handled under that service’s privacy terms. Connected activities may return execution or validation results to AlgoPath.

Information may also be disclosed where necessary to meet a legal requirement, obtain professional advice or protect legal rights. A provider’s own notice may apply to processing for its own purposes, such as payment fraud prevention.

6. AI support and international processing

Tutor requests can include your question, code, lesson context and relevant previous attempts. Feedback and study recommendations use that context to explain mistakes or suggest practice. They are learning guidance, not official examination results, and can be incorrect. Contact us or ask a teacher if you want a result checked.

Our providers operate internationally, so information may be processed outside the UK. The location and applicable protections depend on the provider and feature. UK data-protection rules require an appropriate basis for a restricted transfer, such as recognised adequacy or approved contractual safeguards. Contact us for details of the destinations and safeguards applicable to a feature, or to request a copy of relevant safeguards.

Please do not put sensitive personal information in tutor prompts. This policy does not promise UK-only processing, zero provider retention or a universal exclusion from provider model training.

7. Cookies and browser storage

Cookies support sign-in, sessions and security. Local and session storage support exam-board choices, learning preferences, basket selections, answer drafts and some notebook or activity progress. Session storage normally lasts for the browser tab or session; local storage can remain until cleared by you, the application or your browser. Sign-in cookies expire according to the session settings and may be renewed while you use the service.

You can manage cookies and stored site data in your browser. Blocking them may prevent sign-in or saving work. Clearing browser data can remove unsaved work and preferences but does not delete account records. Sign out on shared devices.

Any storage or tracking that requires consent must be offered with a separate choice; using the site or accepting service terms does not itself provide that consent.

8. How long information is kept

Retention depends on the purpose and type of record:

• Accounts and saved learning: ongoing access, requested study history, the relevant school arrangement and resolving account requests.
• Tutor records and media: delivering replies, supported history, usage accounting and investigating reported problems.
• Support and security records: the duration of the issue, investigation or necessary protection against misuse.
• Payment and contract records: applicable accounting and tax requirements, reconciliation, refunds, disputes and legal claims.

These criteria also apply when considering deletion requests. Particular records may need to be retained after access ends for a legal obligation or unresolved dispute; we will explain any applicable restriction. Cancelling a subscription, leaving a class or clearing browser storage does not automatically delete your account. Contact us to request deletion or ask which criteria apply to your records.

9. Your rights and complaints

Depending on the circumstances, you can request a copy of your information, correction, deletion, restriction of use or a portable copy. You can withdraw consent where processing relies on it.

Your right to object: you can object to processing based on legitimate interests on grounds relating to your situation. You can always object to use of your information for direct marketing.

Email services@code-ai.co.uk or write to the address above. Tell us enough to locate your account and understand your request; do not send passwords or full card details. We may request proportionate identity or authority checks and coordinate with your school for school-managed records.

We respond within the applicable data-protection time limit, normally one month. If the law permits an extension, we will explain why. If we cannot fulfil all of a request, we will explain the reason and your options.

You can complain to us or to the Information Commissioner’s Office (ICO). You do not have to complete our complaints process before contacting the ICO.

10. Changes to this policy

We update this page when the service or our information practices change and show the revision date above. Where a change materially affects use of your information, we will provide an appropriate notice and obtain any consent required. An update does not remove your existing privacy rights.

Terms of service · Contact and support