Privacy Policy

1. Introduction

Zippylang is operated by Drakon Systems Ltd ("we", "us", or "our"). We are committed to protecting the privacy of children, teachers, and schools who use our language learning platform.

This Privacy Policy explains how we collect, use, and protect personal information when you use Zippylang.

2. Information We Collect

For Schools and Teachers:

• School name and contact information
• Teacher names and email addresses
• Billing information for subscription management

For Students:

• First name and surname (used to tell pupils apart within a school)
• No email address — pupils are never asked for one and cannot receive email from us
• Learning progress and scores
• Interactions with the AI tutor (for educational purposes only)

3. How We Use Information

We use collected information to:

• Provide personalised language learning experiences
• Track student progress and generate reports for teachers
• Improve our AI tutor and learning content
• Communicate with schools about their subscription
• Ensure platform security and prevent misuse

4. Data Protection for Children

We take special care to protect children's privacy in accordance with the UK Data Protection Act 2018 and GDPR:

• We collect minimal personal information from students
• Student accounts are created when a pupil joins a class using a join code issued by their teacher, and can be managed or deleted by school staff
• We do not collect student email addresses or contact information
• The AI tutor is constrained by built-in safety instructions; conversations are not retained by us and are never used for marketing (see our Safeguarding page for detail)
• We do not show advertisements to students

5. Data Sharing

We do not sell personal information. We may share data with:

• Cloud service providers (for hosting and data storage)
• AI service providers (Anthropic) for powering our tutor
• Payment processors for subscription management

All third-party providers are contractually bound to protect personal data.

6. Legal Basis for Processing

Under UK GDPR, we process personal data based on:

• Contract: To provide our service to schools and teachers who subscribe
• Legitimate Interest: To improve our platform and ensure security
• Consent: For optional cookies and communications
• Legal Obligation: To comply with applicable laws

7. Data Retention

We retain school and teacher data for the duration of the subscription plus 12 months. Student learning data is retained while the school maintains an active subscription. Schools may request deletion of all data at any time.

8. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Object to processing of your data
• Data portability — on request we will provide a school's data as a machine-readable JSON export covering its users, classes and progress. There is no self-service export button today; email us and we will produce it.

9. Cookies

We use cookies to keep teachers signed in, and one signed, HTTP-only cookie (zippy_student_session) to keep a pupil in their own class while they are working. We also store a small amount of information on the device to remember a pupil's name and language choice. All of these are essential: Zippylang sets no optional cookies, so the notice you see on your first visit is an acknowledgement rather than a choice. You can clear your browser's data for this site at any time, which removes them and makes the notice appear again.

Our Cookie Policy sets out exactly what is stored and why.

Types of Cookies We Use:

• Staff sign-in cookies: set by our authentication provider so a signed-in teacher or administrator stays signed in between pages. Removed on sign-out.
• Pupil session cookie: zippy_student_session, signed by our servers and marked HTTP-only so page scripts cannot read it. It identifies only which pupil, class and school a session belongs to, and it is what stops one pupil's work being recorded against another's account.
• Analytics and advertising cookies: none. We do not use Google Analytics or any comparable service, and we do not run advertising. There is therefore nothing optional in the cookie panel to switch off; if that ever changes we will ask first.

Third-Party Services:

• Supabase: Authentication and database services (essential)
• Google Cloud: Text-to-speech for pronunciation (functional)
• Anthropic: AI tutor functionality (functional)

Important: We do not use cookies for advertising or tracking children. We never sell cookie data or use it for marketing purposes.

10. Contact Us

For any privacy-related questions or requests, please contact: