Cookie & Data Policy

1. What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences and provide a better experience. Some cookies are essential for a website to function — without them, you would be logged out every time you change page.

We also use local storage — a similar technology built into your browser — to store your usage data (such as your question count and XP progress) without sending it to a server every time.

2. Cookies and Storage We Use

We use only essential and functional cookies. We do not use advertising cookies, tracking pixels, or third-party analytics tools that profile you across the internet.

Name	Type	Purpose	Expires
sb-access-token	Essential	Keeps you logged in to your Miss Ramah account (set by Supabase authentication)	1 hour (auto-refreshed)
sb-refresh-token	Essential	Renews your login session automatically so you stay signed in	7 days
mr_cookie_consent	Functional	Remembers whether you have accepted or declined our cookie notice	1 year
cookie_consent	Functional	Records your cookie consent choice on ramahpathways.co.uk	1 year
mr_usage (local storage)	Functional	Tracks your daily free question count — resets at midnight each day	Session / daily
mr_g (local storage)	Functional	Stores your XP, level, streaks and subject badges on your device	Until cleared
rp5 (local storage)	Functional	Tracks your 5 preview question count on ramahpathways.co.uk	Daily
__stripe_*	Payment	Set by Stripe to process payments securely. Stripe is PCI-DSS compliant. We never see your card details.	Session

3. Personal Data We Collect and Store

When you create an account or use Miss Ramah AI, we store the following personal data in our secure database (hosted by Supabase on EU servers):

Data	Why we collect it	How long we keep it
Email address	To create and manage your account, and to link your subscription payment to your account	Until you delete your account
Name (if provided)	To personalise your experience within the platform	Until you delete your account
Chat history	To let you review past conversations and for Miss Ramah to maintain context within a session	12 months rolling, or until account deletion
Subject and year group preferences	To tailor Miss Ramah's responses to your exam board and level	Until you delete your account
Subscription plan	To determine your access level (free or paid)	Until you delete your account
Total questions asked	To track usage for free plan limits and display your progress	Until you delete your account
Stripe customer ID	To manage your subscription and link payments to your account. Your card details are held by Stripe, not us.	Until you cancel and delete your account
Tutor session reports (if applicable)	Written by your tutor after live sessions and shared with you and your parent/guardian via the portal	2 years or until account deletion

4. Our Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal grounds:

• Contract — processing your email and payment details is necessary to provide the service you have signed up for
• Legitimate interest — storing chat history and progress data to improve your tutoring experience
• Consent — where you have explicitly agreed via the cookie banner

5. How We Store and Protect Your Data

• All data is stored on Supabase — hosted on AWS in the EU (Frankfurt, eu-central-1)
• All connections are encrypted via HTTPS/TLS
• Authentication uses industry-standard JWT tokens — your password is never stored in plain text
• Payment data is handled exclusively by Stripe, which is PCI-DSS Level 1 certified — we never see or store your card number
• Row-level security policies in our database ensure users can only access their own data

6. Who We Share Your Data With

We do not sell, rent or share your personal data with any third party for commercial purposes. The only parties who may access your data are:

• Supabase — our database and authentication provider (data processor)
• Stripe — our payment processor (handles payments only)
• Cloudflare — our AI proxy (processes your questions to generate responses — no data is retained by Cloudflare after the request)
• Anthropic — the AI model provider (questions are sent to generate responses — subject to Anthropic's data retention policies)
• Your tutor (if you have booked a live session) — they will see your name, year group and subject in order to prepare for and run your session

7. Your Rights

Under UK GDPR you have the following rights:

• Right of access — you can request a copy of all data we hold about you
• Right to rectification — you can ask us to correct inaccurate data
• Right to erasure — you can ask us to delete all your data ("right to be forgotten")
• Right to portability — you can request your data in a machine-readable format
• Right to restrict processing — you can ask us to stop using your data while we resolve a dispute
• Right to object — you can object to processing based on legitimate interest
• Right to withdraw consent — you can withdraw cookie consent at any time by clearing your browser's local storage

To exercise any of these rights, email us at info@ramahpathways.co.uk. We will respond within 30 days.

8. How to Manage or Delete Cookies

You can control cookies through your browser settings. To delete our local storage data:

• Chrome: Settings → Privacy and security → Clear browsing data → Cookies and site data
• Firefox: Settings → Privacy & Security → Clear Data → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Edge: Settings → Privacy, search, and services → Clear browsing data

Note that deleting cookies will log you out of your account and reset your question count and XP progress on your device.

9. Complaints

If you have concerns about how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

10. Changes to This Policy

We may update this policy from time to time. When we make significant changes we will update the "Last updated" date at the top of this page. Continued use of the platform after changes constitutes acceptance of the updated policy.