1. Data Controller
EB-maths ('t dorp 13C, Heesch 5384MA, Netherlands, KvK: 74366580) is the data controller.
2. Data We Collect & Legal Basis
- Child/Student Data: Name/username, password hash, role, curriculum, answers, quiz scores, study time, chat with Coach Breezy, and similar learning records. Basis: contractual necessity.
- Parent Data: Shared email, Parent Hub PIN, Stripe IDs, subscription status. Basis: contractual necessity and legal obligation for finance.
- Guest Data: Email for launch passes, anonymous visit stats. Basis: consent for analytics.
- Affiliate Data: Name, email, payout info, hashed IP. Basis: contractual necessity.
3. Children's Privacy
We comply with the UK Children's Code. We never sell children's data. There are no targeted ads within the learning environment. Text inputs provided by the child to Coach Breezy are sent to our AI processor (OpenAI) to generate educational hints. This is necessary to provide the AI tutor feature.
4. Processors and Third-Party Services
We use the following processors:
- Stripe: payments.
- Resend: emails.
- MongoDB Atlas: database.
- Vercel: hosting.
- OpenAI: AI tutor and summaries.
- Discord: internal alerts.
For marketing (on external pages only, subject to consent): Google Ads, Google Analytics, and Meta Pixel.
5. International Data Transfers
Some processors (for example Vercel, Stripe, OpenAI, Google, and Meta) transfer data outside the European Economic Area (EEA), primarily to the USA. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or reliance on Adequacy Decisions (for example the EU-US Data Privacy Framework).
6. Cookies
We use essential cookies (Auth.js session, consent, local storage for progress) which cannot be disabled. Analytics and marketing cookies (for example eb_vid, _ga, and affiliate_ref) are only placed if you grant explicit consent. You can change that choice via .
7. Data Retention and Your Rights
Learning data is deleted or anonymized within 30 days of account deletion. Financial data is kept for 7 years as required by law. Under the GDPR and UK GDPR, parents can exercise rights on behalf of their children, including access, rectification, erasure, and withdrawal of consent. Complaints can be filed with the Autoriteit Persoonsgegevens (NL) or the ICO (UK).
Questions? FAQ or email info@eb-maths.com.
