Privacy notice.

The short version

MindArc is a maths revision app for 14 to 16 year olds who find focus and confidence hard. When a school uses MindArc, the school stays in charge of pupils’ information: MindArc only ever sees a code, never a name. We keep the minimum needed to teach and to check whether the app helps; we delete it when it is no longer needed; we never sell it, never use it for advertising, and never use it to train artificial intelligence. There is no artificial intelligence in the app. Anyone can ask us what we hold, ask us to correct or delete it, or complain to the Information Commissioner. Contact: support@mindarc.co.uk. The rest of this page says the same thing in full.

Family availability updates

If you sign up for family availability updates, MindArc receives your email address and your agreement to receive launch news. The email is used only for those updates. Submissions are processed through Netlify. You can withdraw your agreement by emailing support@mindarc.co.uk.

1. Who we are

Mind Arc Ltd, trading as MindArc, a company registered in England and Wales, company number 16342569, registered office 28 North Villas, Cotford St. Luke, Taunton, England, TA4 1DQ. “MindArc” and “we” in this notice mean Mind Arc Ltd. We are registered with the Information Commissioner’s Office (ICO) under reference ZB976708.

Data protection contact: Paige Hurd, Director, at support@mindarc.co.uk (please put “Data protection” in the subject line). We have not appointed a statutory Data Protection Officer; we assessed the requirement and recorded the reasons in our data protection impact assessment.

2. Who this notice is for

This notice covers four situations. Find yours:

Sections 6 to 9 (rights, complaints, security, changes) apply to everyone.

3. The website and enquiries

What we collect. If you send the “request trial information” form, we receive your name, your school’s name, your school email address and anything you write in the message box. Our website host records standard server logs, which include the network address of your device.

Why, and on what basis. To answer your enquiry and, if you ask us to, to arrange a trial. Lawful basis: our legitimate interest in responding to people who contact us (UK GDPR Article 6(1)(f)). We balance that interest against your rights and only use your details for the purpose you contacted us about. You do not have to give us these details, but we cannot reply without an address to reply to.

Who receives it. The website is hosted by Netlify, which also receives and stores form submissions (Netlify Forms) and forwards them to MindArc’s business email, hosted by Google Workspace. Netlify is a United States company and processes this data in the United States under its data processing addendum, which is incorporated into its terms, relying on the UK Extension to the EU-US Data Privacy Framework and standard contractual clauses. This website uses system fonts and serves its images and scripts locally. It does not load Google Fonts or other third-party page resources.

How long. Enquiries are kept for 12 months after our last contact with you about them, or for the length of the relationship and 6 years after it ends if a trial or contract follows. Server logs are kept for the period set by the host; Netlify does not publish a fixed period. Form submissions held in Netlify are deleted when the enquiry is closed.

Cookies. The marketing website sets no cookies and uses no analytics, advertising or tracking. A locally served script supports the navigation and the illustrative maths example. It does not store personal information on your device.

4. MindArc used through a school (the pilot)

This section describes the school pilot starting in January 2027. It is written to match the consent form given to parents and carers and the notice given to pupils.

4.1 Who is in charge of what. For your child’s learning information, the school is the controller and MindArc is the school’s processor: we run the app on the school’s instructions under a written agreement that meets Article 28 of the UK GDPR. The school holds the only record that links your child’s name to their MindArc code (for example “Student 7”). MindArc never receives your child’s name, date of birth, address, photograph or contact details.

For the pilot’s research (checking whether the app helps), MindArc is the controller, because we decide how that study is done. Section 4.4 covers it.

4.2 What MindArc holds about a pupil. In the app: the code the school assigned; a password (stored as a hash, which cannot be turned back into the password); answers to account-recovery questions, which are set so that they cannot identify the pupil; and learning information, meaning which lessons are started and finished, which answers are right or wrong and how many tries are taken, which extra practice the app offers, how confident the pupil says they feel about each topic, points earned, and when the app is used. Application logs on our server may record the code and the network address of the device used. Nothing else.

4.3 What the app does with it, and why. To choose the next lesson and any extra practice, to show the pupil their own progress, and to give the school aggregate progress information. Lesson selection is rule-based on the pupil’s own answers; it involves no artificial intelligence and no decision with legal or similarly significant effects on the pupil. Results are never shown to other pupils. The app’s optional parent-email feature is switched off for all pilot accounts: MindArc holds no parent contact details and sends no emails to parents in the pilot.

Lawful basis. For the app itself, the school’s lawful basis applies and is stated in the school’s own privacy notice. MindArc processes on the school’s instructions.

4.4 The research strand (MindArc as controller). With a parent or carer’s written consent, given on the school’s consent form, MindArc uses each consenting pupil’s coded learning information, plus a small set of coded details supplied by the school (site, year group, sex, and, with separate explicit consent, a simple SEND or ADHD flag, an EHCP flag and a disadvantage flag), to study whether the app helps. Lawful basis: consent (Article 6(1)(a)); for the SEND or ADHD flag, which is special category data, explicit consent (Article 9(2)(a)). The coded details come from the school, not from the pupil; the learning information comes from the pupil’s use of the app. Findings are reported only as group figures, never below a group of 10 pupils, and never about an individual. Taking part in the research is voluntary: a pupil can use the app whether or not consent for the research is given. Consent can be withdrawn at any time by telling the school (section 6). Withdrawing has no effect on the pupil’s schooling or on their use of the app.

4.5 Who receives pupil information. The school (its own pupils’ aggregate progress). Our technical supplier, who maintains the app and works from India by remote access to our UK server (section 4.7). A written agreement with the supplier is signed before any pupil is enrolled. Amazon Web Services, which hosts the app in its London region. If a parent ticks the optional box, an independent evaluator (to be named on this page before the first consent form is issued) receives coded research data under a written agreement. No one else. MindArc does not sell pupil data, share it for advertising, use it to train any artificial intelligence or machine-learning system, or use it for any purpose other than those stated here.

4.6 How long.

“Deleted” means the records cease to exist. MindArc does not meet a deletion request by removing the name and keeping the rest.

4.7 Where the information is, and who can reach it from abroad. All pupil information is stored in the United Kingdom (Amazon Web Services, London region). Our technical supplier is based in India and can reach the UK server by remote access in order to maintain the app; nothing is stored in India. That access is a restricted transfer under UK law and is made under a written agreement with the supplier, incorporating the ICO’s International Data Transfer Agreement and supported by a transfer risk assessment, which is signed before any pupil is enrolled. The agreement names the individuals who may have access, the machines they may use, and the rules they must follow, including that no pupil data or code containing it is entered into any artificial-intelligence tool.

4.8 Pupils’ own rights. A pupil may ask, in their own right, to see their information or to have it deleted; MindArc treats a request from a pupil as one to act on through the school, because only the school can confirm which code is theirs. The young people’s version of this notice tells them how.

5. MindArc accounts not created through a school

MindArc does not currently offer accounts to the public. The only accounts that exist outside the school pilot are MindArc’s own administrative and test accounts. If MindArc later offers accounts directly to learners or parents, this section will be completed before the first such account is created, and this notice re-issued: it will state what is collected (including a parent’s email address if progress emails are chosen), the lawful basis, the email delivery service used and where it processes data, and the retention periods. Until then, no parent email address is held for any learner.

6. Your rights

Under the UK GDPR you can ask to see the personal information we hold about you or your child (subject access), to have it corrected, to have it deleted, to restrict how we use it, to object to processing based on legitimate interests, and, for information processed by automated means on the basis of consent, to receive it in a portable form. Where we rely on consent, you can withdraw it at any time; this does not affect what was done before you withdrew.

How to ask. For a pupil using MindArc through a school: tell the school. The school confirms which code is the pupil’s and instructs us. A note or an email to the school is enough; no reason is needed. If a request about a pupil reaches MindArc directly, we acknowledge it and pass it to the school the same working day, because we cannot identify the pupil ourselves. For anything else: email support@mindarc.co.uk.

How quickly. Without undue delay and within one month. For deletion of a pupil’s information our target is five working days from the school’s instruction, and we check that the deletion has actually happened rather than relying on the software’s own report. A residual copy can remain in the daily backup for up to 30 days; it is never restored.

We do not refuse pilot deletion requests on research grounds. The research file loses that pupil’s records too. Only group figures already produced are kept.

7. Complaints

If you are unhappy with how we have handled your information, contact us first at support@mindarc.co.uk and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. For a pupil using MindArc through a school, the school’s data protection lead can also help.

8. Security

Pupil information is held on a server in the UK, reached only over encrypted connections, with access by named people using key-based authentication. Passwords are stored as hashes. The database is backed up daily to UK storage. Our written agreement with our supplier, signed before any pupil is enrolled, requires it to report any security incident to us within 12 hours, and we tell affected schools within 24 hours of becoming aware of a personal data breach. Where our own review has found weaknesses, we fix them before any pupil is enrolled rather than describe a standard we have not met.

9. Cookies and information stored on your device

The MindArc app sets one cookie, named token, which keeps you signed in for your session. It is strictly necessary for the app to work, is sent only over secure connections, and is removed when you sign out. The app also stores two small items in your browser’s local storage: the identifier of the lesson timer you are currently using, and, for review purposes, the questions you got wrong in the current session, so the app can offer them again. These are used only on your device and are not analytics. The app uses no analytics, advertising or third-party tracking. The public website’s position is at section 3.

10. Changes to this notice

We update this notice when what we do changes. The version and date at the top tell you when. Schools in a pilot are told in writing before any change that affects pupils takes effect.

Product notice: version 0.1.1, 6 October 2026 (pilot start date and supplier agreement wording corrected). Version 0.1, 3 September 2026. Website technology description updated 5 October 2026.