Privacy notice

NaVi Vocab is a vocabulary service for children preparing for the 11+. [Owner: the legal name and postal address of the person or company responsible] is the data controller for the personal data in this notice: we decide how it is used and we are responsible for keeping it safe. For questions, requests or complaints, email support@navivocab.com.

About you (parent or tutor)

• Your email address, to sign you in and to contact you about your account.
• If you sign in with Google, the basic profile Google shares with us (your name, email address and profile picture link). We use only your email address.
• Whether you're a parent or a tutor, and which children you're linked to.

About your child

• Their first name or a nickname, school year and username, and a goal if you type one.
• Their time zone, taken from your browser, so their day starts at midnight where you live.
• Their password. You set it. We never see or store it as typed: only a scrambled version is kept, by our sign-in provider.
• Their learning record: the words and lists they practise, every answer they give (including the sentences they write), the time they spend, the stage of each word, and their coins, streak and Dot's outfit.

What we don't collect: your child's surname, date of birth, photo, email address, school, location or contacts.

• To sign you in and keep accounts secure, including limiting repeated sign-in attempts.
• To teach your child: choosing questions, bringing words back when they're due, and checking their sentences.
• To show you, and a tutor you approve, your child's progress and why each word is marked as it is.
• To send you the emails you need: sign-in links and, once it's available, one weekly summary of your child's practice, which you can stop at any time.
• To reply to your feedback and messages.
• To improve NaVi Vocab: we look at answers across all children, by account number and never by name, to see whether children still remember words after 7, 15 and 30 days, and to fix questions that don't work.

We don't sell data, show adverts, build marketing profiles, share data with schools, or use your child's data to train AI models.

Our legal reasons (UK GDPR): to provide the service you signed up for (contract). For your child, to provide the service you, as their parent, ask us to provide. To keep it safe and make it better (legitimate interests).

• Each word's meaning, examples and questions are prepared once by AI and checked by AI before any child sees them.
• When your child writes a sentence or explains a word in their own words, we send only that answer and the word to our AI provider to check it. We never send their name, username or account details.
• If our check finds something unkind or unsafe in an answer, or personal details such as an address or phone number, we don't keep it.
• When you add a word, we send the word alone, to check it's a real word and prepare its content.
• When you import a list from a photo, a file or pasted text, we send it to our AI provider to find the words. You check them before anything is saved. We keep the list you confirm, not the photo or file.
• AI never decides your child's progress. Only your child's answers move a word from one stage to the next.

A tutor can see your child's progress only after you approve the link. They see your child's lists, practice and progress, including the sentences your child writes in practice, and nothing else about your family. To end a link, choose Remove beside the tutor in Family.

If you send us feedback, we receive your message, your email address and the page you sent it from. If you answer our question about the planned price, we keep your answer and any reason you give. We use these only to improve NaVi Vocab and to set its price. Children never see either.

These companies process data for us, only on our instructions:

• Supabase: our database and sign-in. Ireland (EU).
• Vercel: hosts the website. Dublin, Ireland (EU).
• Anthropic: the AI that prepares word content and checks your child's answers. It receives words and your child's written answers; we never send it names or account details. United States. [Owner, from the DPIA (D5): the transfer safeguard and Anthropic's retention terms]
• Resend: sends our emails, so it receives your email address. [Owner: its region and transfer safeguard]
• Amazon Web Services: makes the spoken audio for each word. London. It receives words only, no personal data.
• Google: only if you choose to sign in with Google.

We share data with no one else unless the law requires it.

We use only the cookies that keep you signed in. There are no advertising cookies, no tracking cookies and no analytics. Your browser also stores a few small settings for NaVi Vocab on your device, such as which sections you have open.

We keep your family's data while your account is open, so your child's progress can build up over time. If you ask us to delete it, we delete the account and everything linked to it within 30 days, and remove it from our backups within a further 30 days.

You can ask us to see the data we hold about you or your child, to correct it, to delete it, to send it to you in a common format, or to stop or limit how we use it. Email support@navivocab.com and we'll reply within one month. Your account and data explains how.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.

Children can't sign up on their own: a parent creates their profile. We follow the UK Age Appropriate Design Code. Settings are private by default, nothing nudges your child to share, there is no location tracking and no profiling for adverts.

Data is encrypted when it travels and when it's stored. Only the people who run NaVi Vocab can reach it, and only when they need to. Children's passwords are never stored as typed.

If we change this notice in a way that matters, we'll email you before the change applies. The date at the top shows when it last changed.