Privacy Policy

Who is responsible

Tom's Lessons is a service provided by CrowdCows B.V., incorporated in the Netherlands (registration number 76761886), correspondence address 17a Electric Lane, Brixton Village, London SW9 8LA. For questions about your data or to exercise your rights: hello@tomslessons.co.uk. CrowdCows B.V. is the data controller under the UK GDPR and the Data Protection Act 2018.

What data we collect

As little as possible. Specifically:

• Parent account: your email address and a password (we keep the password only in an unreadable form; we cannot read it back ourselves).
• Child profile: the condition, a rough learning level and, optionally, a nickname. No real name, address, date of birth or phone number.
• Lessons: the adapted lessons that are made, and whether you approved or reported them.
• Consent: a record that, and when, you gave or withdrew consent.
• Payment: if you take out a subscription, payment is handled by our payment provider, Stripe. We do not see full card or account details.
• Technical: only what is needed to keep you logged in and to run the service securely. No tracking or advertising cookies.

Photos are not kept

A photo of a worksheet is processed only in working memory to make the lesson, and is destroyed immediately afterwards. We do not store the photo anywhere: not in a database, not in a file, not in a log. Only the finished lesson is kept.

Health data (the condition) and lawful basis

A child's condition is special category personal data (Article 9 UK GDPR). We process it only on the basis of your explicit consent (Article 9(2)(a)), which you can withdraw at any time from your account. The condition is stored with extra protection and kept separate from ordinary data.

• Account and providing the service: performance of the contract (Article 6(1)(b)).
• The condition: your explicit consent (Article 9(2)(a)).
• Payment and records: legal obligation (Article 6(1)(c)).

Children

We have designed this service with children in mind and in line with the ICO's Age Appropriate Design Code (the Children's Code). The best interests of the child come first: the environment is calm and low-stimulus, there is no advertising, no tracking, no profiling, and no unnecessary data collection.

The account is managed by a parent or guardian with parental responsibility (aged 18 or over). A child has no account of their own and does not log in. The parent or guardian gives the consent for processing the condition.

What we use it for

Only to adapt schoolwork to your child's condition and learning level, to manage your account and payment, and to keep the service secure and reliable. We do not use your data for profiling or advertising.

Where your data is held and who we work with

All personal data (database, login and AI processing) is held in the European Union. Transfers of UK personal data to the EU/EEA are permitted because the UK recognises the EU/EEA as providing adequate protection. We work with carefully chosen suppliers, and we have data processing agreements with our processors. We name them here for transparency; if we change a supplier, we will update this policy:

• Supabase — database and login (EU, Ireland).
• Amazon Web Services (Bedrock) — the AI that makes the lessons (EU, Frankfurt).
• Vercel — hosting of the website (EU, Frankfurt).
• Resend — sending emails to the parent, such as login and reminder emails (EU, Ireland). Receives no data about your child.

For payments we work with Stripe. As a payment provider Stripe is itself responsible for the payment data it processes (a controller in its own right); see Stripe's privacy policy. Stripe receives no data about your child.

Our AI supplier is not permitted to use your data to train models. Where a supplier belongs to a group outside the UK, appropriate safeguards are in place (the UK Extension to the EU-US Data Privacy Framework, and/or the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses).

How long we keep it

We keep your data for as long as you have an account. If you delete your account, we delete your data (child profiles, lessons and consents) from our active systems immediately. Copies that remain in our encrypted backups are overwritten within 7 days, after which they are gone. To avoid keeping data longer than needed, we also automatically delete an account with no active subscription that has not been logged into for six months, after first warning you by email. Payment and invoice data are kept for as long as the law requires (for tax records, usually six years in the UK).

Security

Access is strictly separated per account: you only see your own data. Connections are encrypted (HTTPS) and the condition has extra protection. We take appropriate technical and organisational measures.

Your rights

• Access to the data we hold about you.
• Rectification of inaccurate data.
• Erasure: you can delete your account and all child profiles and lessons yourself.
• Restriction of, or objection to, processing.
• Portability of your data.
• Withdraw consent, at any time.
• Complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk. We would appreciate the chance to help first, but you can go to the ICO at any time.

Data breaches

If, despite our measures, there is a personal data breach, we will report it to the ICO within 72 hours where required, and, if there is a high risk to you, we will tell you too.

Cookies

We use only essential cookies (for logging in), which do not require consent under the Privacy and Electronic Communications Regulations. No third-party tracking cookies, no advertising networks.

Changes

We may change this statement; for important changes we will let you know. Last updated: 1 August 2026.