Privacy Policy

Last updated: 2 August 2026

No Waffle Tutor ("we", "us", "our") is operated by Mohammad Ahmed Sheikh, a sole trader based in the United Kingdom. This Privacy Policy explains how we collect, use, and protect your personal data when you use No Waffle Tutor (the "Service").

We are the "data controller" for the personal data described below under UK GDPR and, where applicable, EU GDPR.

1. A Note for Students Under 18

Most of our users are under 18. We take extra care with data belonging to children:

• We collect only the data needed to provide the Service.
• We do not use children's data for third-party advertising, and we do not sell personal data.
• If you are 13 or under, a parent or guardian should create and manage your account, and consent to this Privacy Policy on your behalf.
• Parents and guardians can contact us at any time (see Section 9) to review, correct, or delete their child's data.

2. What Data We Collect

Account information: name (if provided), email address, and authentication details, managed via our authentication provider, Clerk.

Study activity: lessons viewed, flashcards reviewed, test and assessment answers, streaks, XP, and progress data — used to power your revision experience (spaced repetition, mastery tracking, Focus Areas, etc.).

Content you submit: written answers, and photos you upload of handwritten answers (for AI transcription and marking).

Payment information: if you subscribe to Premium, payment is processed by Stripe. We do not store your full card details ourselves — Stripe handles this securely on our behalf.

Technical data: IP address, browser type, device information, and usage logs, collected automatically for security and performance purposes.

Communications: if you contact us for support, we keep a record of that correspondence.

3. How We Use Your Data

We use your data to:

• Provide and personalise the Service (lessons, flashcards, review scheduling, progress tracking).
• Mark your assessment answers and power the "Ask the Tutor" AI assistant.
• Process subscription payments and manage your account.
• Send you service-related emails (e.g. welcome emails, streak reminders, receipts) — you can control non-essential notifications in Settings.
• Maintain the security and reliability of the Service.
• Comply with legal obligations.

We do not use your personal data to serve third-party advertising, and we do not sell your data to anyone.

4. AI Processing

When you use "Ask the Tutor," submit written answers for marking, or upload photos of handwritten work, this content is sent to our AI provider, Anthropic (maker of the Claude AI models), for processing. This allows us to generate explanations, mark answers, and transcribe handwriting.

• We configure these AI requests to only use the minimum content necessary to answer your question or mark your work.
• Anthropic processes this data under its own data processing terms; it is not used to train Anthropic's models when accessed via their API in the way we use it.
• Please avoid including sensitive personal information (such as health details or information about other named individuals) in messages to the AI tutor or in written answers, beyond what's naturally required for a biology answer.

5. Who We Share Your Data With

We share data only with trusted service providers who help us run the Service, each acting under appropriate data processing agreements:

These providers may store or process data outside the UK/EEA (for example, in the United States). Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses, or the provider's own certified compliance frameworks, to ensure your data remains protected to UK/EU standards.

We do not share your personal data with any other third party for their own marketing purposes.

6. How Long We Keep Your Data

We retain your account and study data for as long as your account is active, so you can track your progress over time. If you close your account, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain certain records (e.g. payment records) for legal or accounting purposes.

7. Your Rights

Under UK GDPR (and EU GDPR, if applicable to you), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to be forgotten"), subject to certain legal exceptions.
• Restrict or object to certain processing.
• Data portability — receive your data in a portable format.
• Withdraw consent at any time, where we rely on consent as our legal basis.

To exercise any of these rights, contact us using the details in Section 9. Parents/guardians of users under 18 can exercise these rights on their child's behalf.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.

8. Cookies and Similar Technologies

We use essential cookies and similar technologies required for authentication (via Clerk) and to remember your preferences (such as dark mode). We do not currently use third-party advertising or tracking cookies.

9. Contact Us

If you have questions about this Privacy Policy, or want to exercise any of your data rights, please contact:

Email: nowaffletutor@gmail.com
Trading name: No Waffle Tutor
Operated by: Mohammad Ahmed Sheikh (sole trader), United Kingdom

Parents and guardians of users under 18 are welcome to contact us directly with any questions or requests regarding their child's data.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. We will notify you of material changes via email or an in-app notice before they take effect.

This document is a template and does not constitute legal advice. Given the service is aimed primarily at users under 18 and processes payments internationally, we recommend having this policy reviewed by a solicitor familiar with UK GDPR and the ICO's Children's Code before publishing.