Loading
Last updated 1 October 2026
IlluminatED (including the IlluminatEDSocial forum) is run by IlluminatED. We are the controller of your personal data. That means we decide how it's used and we're responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
To ask anything about your data, use our contact form and choose "Privacy or my data".
We don't ask for your real name, school, date of birth, address, phone number or photo. We don't use your location. We don't collect health information or other sensitive details, so please don't post them on the forum.
Some things are saved only in your browser, not sent to us. Our cookies page lists them, and you can clear them on the Your data page.
UK GDPR says we need a lawful reason (a "lawful basis") for each way we use your data. Ours are:
| What we do | Lawful basis |
|---|---|
| Run your account, save your quiz progress, show your dashboard and suggest what to revise next | Contract: it's the service you signed up for |
| Run the forum and match you with a tutor when you ask | Contract |
| Keep people safe: moderation, dealing with reports, blocking contact details, stopping spam and misuse, and keeping the site secure | Legitimate interests: keeping a site for young people safe. We've checked this doesn't override your rights |
| Answer your questions with Ask Tiggy, count your daily messages and run Premium subscriptions | Contract |
| Record Ask Tiggy safeguarding flags so moderators can check if someone may need help | Legitimate interests and safeguarding (see below) |
| Reply to messages you send us | Legitimate interests |
| Paid tutoring for learners under 18 | Consent from a parent or guardian, as well as contract. A parent or guardian can withdraw consent at any time |
| Keeping payment records | Legal obligation: tax law says we must keep them |
If a report or message tells us someone may be at risk, we may use or share that information to protect them. The Data Protection Act 2018 allows this for safeguarding children and people at risk. See our safeguarding page.
We don't make any decisions about you by computer alone that have legal or similarly serious effects. Ask Tiggy's safeguarding check only shows you where to get help and lets a moderator know; a person decides whether anything else needs to happen.
IlluminatED is built for learners aged about 13 to 19, so we follow the ICO's Children's Code(opens in a new tab) (the Age Appropriate Design Code). In practice:
We use a few trusted companies (called "processors") to run the site. They only use your data to provide their service to us, under a contract that requires them to keep it safe.
| Company | What for | Where |
|---|---|---|
| Supabase | Our database and sign-in system, including sign-in emails | Data stored in London (UK) |
| Vercel | Hosting the website | Global network. Any transfer outside the UK is protected by safeguards approved under UK law |
| Stripe (only if card payments are switched on) | Taking payments for tutoring and Premium subscriptions, and the page where you manage your subscription. We never see your card number | UK, EU and US, with approved safeguards |
| Hugging Face (only when Ask Tiggy is switched on) | Sending your Ask Tiggy messages to an AI model provider it works with, to generate Tiggy's replies. Along with the conversation we send your stage, year group, age range and subjects, so answers fit your course, but never your email, username or account ID. We don't store the messages ourselves | US and EU, with approved safeguards |
| Resend (only if we switch on email notifications) | Sending emails, such as sign-in links and tutoring updates | With approved safeguards |
Tutors see what you write in a tutor request and your messages with them, but not your email address. Moderators can see reports, hidden posts and tutoring messages when they need to keep people safe.
Some pages look things up from free public services: the Ofqual Register (qualifications), DfE Explore Education Statistics, Open Library (books), GOV.UK (official guidance), Skills England (apprenticeships) and Gutendex (free set texts from Project Gutenberg). We send them only the words you search for, through our own server, so they don't receive your IP address or anything that identifies you. When Ask Tiggy looks up official guidance on GOV.UK, our server sends a fixed topic name (such as "student finance"), never your message. If our server can't reach them, your browser may ask them directly, and they'll see your IP address as with any website.
Topic summaries on the reading page come straight from Wikipedia in your browser, so the Wikimedia Foundation sees your IP address and what you searched for, under its own privacy policy(opens in a new tab).
We'll only share personal data with anyone else if the law requires it, or to protect someone from serious harm (for example with the police or children's services).
| Data | How long |
|---|---|
| Your account, learner details and quiz progress | Until you delete your account |
| Forum posts and blocks | Until you delete them, a moderator removes them, or you delete your account |
| Deleted accounts | Erased straight away. Copies in our backups roll off within 30 days |
| Reports of posts | 12 months |
| Messages sent through the contact form | 12 months after we've dealt with them. Safeguarding concerns may be kept longer if we need them to protect someone |
| Tutoring requests, messages and guardian emails | Until you delete your account. If you paid, the payment records are kept for 6 years, because tax law requires it |
| Ask Tiggy messages | Not stored by us. Your browser tab keeps the current conversation until you close it or start a new chat |
| Ask Tiggy daily message counts | About a week, and deleted with your account |
| Ask Tiggy safeguarding flags | 12 months, then deleted automatically. If your account is deleted, the flag is no longer linked to you |
| Premium subscription status | Until you delete your account. Stripe keeps payment records for 6 years, because tax law requires it |
| Technical logs | Kept by our providers for a short time, usually days |
Under UK data protection law you have the right to:
To use any of these rights, use our contact form, choosing "Privacy or my data". We'll reply within one month. Young people can make these requests themselves. A parent or guardian can also ask on behalf of their child. We may ask for something to check it's really you.
If you're unhappy with how we've handled your data, please tell us first and we'll try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:
If we change how we use your data, we'll update this page and the date at the top. For big changes, we'll tell you on the site or by email before they take effect.