This platform is used by parents and guardians on behalf of children. We take children's privacy extremely seriously and comply with the UK GDPR, the Data Protection Act 2018, and the ICO's Age Appropriate Design Code (Children's Code).
1. Who we are
Numeriflow Kids Learning Ltd is a company registered in England and Wales. We operate the NumeriFlow platform at numeriflow.uk — a game-based assessment and learning tool for children with dyscalculia and numeracy difficulties.
For the purposes of UK GDPR, Numeriflow Kids Learning Ltd is the data controller for all personal data collected through this service.
Contact: info@numeriflow.uk
2. What data we collect and why
Parent / guardian account data
- Name and email address — to create and manage your account, send confirmation and service emails
- Password — stored securely via Supabase Auth (hashed, never stored in plain text)
- Role (parent, educator) — to tailor the service to your use case
- Payment information — handled entirely by Stripe. We do not store card details. Stripe's privacy policy applies to payment processing.
- Subscription plan — to manage your access level (freemium, monthly, annual)
Child profile data
- Child's name — to personalise the learning experience
- Age and school year group — to calibrate assessment questions to the appropriate UK curriculum level
- Optional notes — any additional context you choose to provide
Assessment and learning data
- Assessment results — skill scores across counting, comparison, patterns, arithmetic, and music/rhythm
- Response times — used to calibrate difficulty and identify areas of difficulty
- Play session activity — game type, score, time, and session count
- Adaptive difficulty level — current learning level per skill area
We collect only the minimum data necessary to provide the service. We do not collect location data, device identifiers beyond what is technically necessary, or any data for advertising or profiling purposes.
3. Lawful basis for processing
We rely on performance of a contract (UK GDPR Article 6(1)(b)) as our primary lawful basis. When a parent creates an account and adds a child profile, they enter into a service agreement with us. Processing the child's assessment and learning data is necessary to fulfil that service.
For optional communications such as marketing emails or beta programme updates, we rely on your explicit consent (UK GDPR Article 6(1)(a)), which you can withdraw at any time.
For children under 13, the parent or guardian provides consent on the child's behalf in accordance with UK GDPR Article 8 and the Children's Code.
4. Children's data — special protections
All children using NumeriFlow are under the supervision of a parent or guardian who has created and manages their account. We do not knowingly collect data directly from children without parental consent.
- Child accounts are created and controlled exclusively by parents or guardians
- Children's assessment data is used only to provide the NumeriFlow learning service — never for advertising, marketing, or sale to third parties
- We do not share individual child data with any external organisation without compelling reason and explicit consent
- Children's data is stored securely in the EU region via Supabase (see Section 6)
- We comply with the ICO's Age Appropriate Design Code (Children's Code) 15 standards
- A Data Protection Impact Assessment (DPIA) has been completed for this service
5. How we use your data
- To provide the NumeriFlow assessment and learning service
- To generate personalised learning profiles and progress reports
- To adapt the difficulty of games to each child's level
- To send account-related emails (confirmation, password reset, receipts)
- To send service updates and beta programme communications (with consent)
- To improve the platform using aggregated, anonymised usage data
- To comply with legal obligations
We do not use your data for advertising, sell it to third parties, use it for automated profiling for any purpose other than adaptive learning, or share it with schools or other organisations without your explicit instruction.
6. Who we share data with
We use a small number of trusted third-party services to operate NumeriFlow:
- Supabase (supabase.com) — database and authentication. Servers located in the EU (West Europe). Supabase acts as a data processor under a Data Processing Agreement with us.
- Stripe (stripe.com) — payment processing. Stripe is an independent data controller for payment data. See Stripe's privacy policy at stripe.com/privacy.
- Netlify (netlify.com) — website hosting. Netlify processes request logs. See Netlify's privacy policy at netlify.com/privacy.
- Formspree (formspree.io) — contact form submissions. Used to receive beta programme enquiries.
- IONOS (ionos.co.uk) — email hosting for info@numeriflow.uk.
No child data is shared with any of these providers beyond what is strictly necessary to operate the service. None of these providers may use child data for their own purposes.
7. Data retention
- Active accounts — data retained while your account is active
- Inactive accounts — accounts with no login for 24 months will receive a deletion warning email. Data deleted 30 days after notification unless the account is reactivated.
- On account deletion — all personal data including child profiles and assessment data deleted within 30 days
- Payment records — retained for 7 years as required by UK financial regulations (held by Stripe)
- Anonymised aggregated data — may be retained indefinitely for service improvement (no individual is identifiable)
8. Your rights under UK GDPR
As a data subject (or as the parent/guardian acting on behalf of your child), you have the following rights:
Right of accessRequest a copy of all personal data we hold about you and your child
Right to rectificationCorrect inaccurate or incomplete data at any time via your dashboard
Right to erasureRequest deletion of your account and all associated data
Right to restrictionAsk us to pause processing while a dispute is resolved
Right to portabilityReceive your data in a machine-readable format
Right to objectObject to processing based on legitimate interests
Right to withdraw consentWithdraw marketing consent at any time via unsubscribe link
Right to complainLodge a complaint with the ICO at ico.org.uk
To exercise any of these rights, email info@numeriflow.uk. We will respond within 30 days. Account deletion can also be requested directly from your dashboard settings.
9. Cookies and tracking
NumeriFlow uses the following technologies on your device:
- Strictly necessary — session authentication tokens stored in your browser's localStorage to keep you logged in. These are essential for the service and cannot be disabled.
- Google Fonts — we load fonts from Google's CDN. This involves a connection to Google's servers. Google may log your IP address. We are reviewing options to self-host these fonts.
- No analytics cookies — we do not use Google Analytics, Facebook Pixel, or any third-party tracking tools.
- No advertising cookies — we do not serve targeted advertising.
10. Security
We implement the following security measures:
- All data transmitted over HTTPS (TLS encryption)
- Passwords hashed using bcrypt via Supabase Auth — never stored in plain text
- Row Level Security on all database tables — users can only access their own data
- No child data accessible without authenticated parent session
- Payment data handled entirely by Stripe's PCI-DSS compliant systems
In the event of a data breach affecting your personal data, we will notify you and the ICO within 72 hours as required by UK GDPR Article 33.
11. International transfers
Your data is primarily stored in the EU (West Europe region via Supabase). Some service providers (Stripe, Netlify) may process data in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place including Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA).
12. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email and by displaying a notice on the platform. The date of the most recent update is shown at the top of this page.
13. Contact us
For any privacy-related questions, data subject requests, or concerns:
Numeriflow Kids Learning Ltd
Email: info@numeriflow.uk
Website: numeriflow.uk
London, United Kingdom
To file a complaint with the UK data protection regulator:
Information Commissioner's Office (ICO)
ico.org.uk/make-a-complaint · 0303 123 1113