Privacy Policy

1. Who We Are

Ramah Pathways Learning is an online tutoring service operating through ramahpathways.co.uk and askmissramah.co.uk. We provide AI-powered tutoring and live tutoring sessions for UK secondary school students (Years 7–13).

We are the Data Controller for the personal data we process.

Contact: support@ramahpathways.co.uk

2. What Data We Collect

We may collect the following personal data:

• Contact information — your name and email address when you submit a booking or enquiry form
• Student information — the student's first name and year group when provided
• Payment information — processed securely by Stripe. We never see or store your card details
• Chat history — questions asked to Miss Ramah AI tutor during a session
• Usage data — number of questions asked, subjects selected (stored locally in your browser)
• Technical data — IP address, browser type and device type collected automatically by our hosting provider

3. How We Use Your Data

We use your data to:

• Provide the AI tutoring service (Miss Ramah)
• Process payments for subscriptions and tutoring sessions
• Book and confirm tutoring sessions via Calendly
• Send booking confirmations and session reminders by email
• Improve our service and curriculum content
• Respond to your enquiries
• Comply with legal obligations

4. Legal Basis for Processing

• Contract — to deliver the tutoring service you have paid for
• Legitimate interests — to improve our service and prevent misuse
• Legal obligation — to comply with UK law including GDPR
• Consent — where you have given us explicit permission

5. Children's Data

Our service is used by children aged 11–18. We take the protection of children's data very seriously.

• We only collect a child's first name and year group when necessary for the tutoring service
• We do not collect more data from children than is necessary
• Parents and guardians can request deletion of their child's data at any time
• We do not use children's data for marketing purposes
• Chat conversations with Miss Ramah are used only to provide the tutoring response and are not stored long-term without consent

6. Third Parties We Share Data With

We use the following trusted third-party services. Each acts as a Data Processor on our behalf:

• Stripe (stripe.com) — payment processing. PCI-DSS compliant. Stripe Privacy Policy
• Anthropic (anthropic.com) — AI responses via Claude. Anthropic Privacy Policy
• ElevenLabs (elevenlabs.io) — text-to-speech voice generation
• D-ID (d-id.com) — AI avatar video generation
• Supabase (supabase.com) — curriculum database hosting
• Cloudflare (cloudflare.com) — website security and DNS
• IONOS (ionos.co.uk) — website hosting
• Calendly (calendly.com) — session booking
• EmailJS — feedback report delivery

We do not sell your personal data to any third party.

7. Data Retention

• Contact form submissions — retained for 2 years then deleted
• Payment records — retained for 7 years as required by UK tax law
• Chat history — session data stored in browser only, not on our servers unless you have an account
• Usage data — stored in browser localStorage, automatically reset daily

8. Cookies

We use the following cookies:

• Essential cookies — required for the website to function (session management)
• Usage tracking — stored in your browser's localStorage to track free question usage (not a cookie, no personal data)
• Third-party cookies — Stripe and Cloudflare may set cookies for security and payment processing

We do not use advertising or tracking cookies. You can clear cookies at any time through your browser settings.

9. Your Rights Under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a portable format
• Object — object to our processing of your data
• Withdraw consent — at any time where processing is based on consent

To exercise any of these rights, email us at support@ramahpathways.co.uk. We will respond within 30 days.

10. Data Security

We protect your data through:

• HTTPS encryption on all pages
• Cloudflare security and DDoS protection
• Stripe's PCI-DSS compliant payment processing
• Supabase row-level security on our database
• We never store card details on our systems

11. Data Breaches

In the event of a personal data breach that poses a risk to individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours and inform affected individuals without undue delay.

12. International Transfers

Some of our third-party processors (including Anthropic, Supabase and Stripe) may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place including Standard Contractual Clauses or adequacy decisions.

13. The ICO

You have the right to complain to the Information Commissioner's Office (ICO) if you are unhappy with how we have handled your data.

ICO website: ico.org.uk  ·  Helpline: 0303 123 1113

14. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or by posting a notice on our website. The date at the top of this page shows when it was last updated.