This policy explains how Maths Launch collects, uses and protects personal information when schools and staff use the service.
Maths Launch is the trading name used for this service. For the purposes of the UK GDPR and Data Protection Act 2018, the service operator is the controller of personal information used for account administration, billing, support, security and operating the Maths Launch service. Contact the controller at contact@mathslaunch.com.
Schools are responsible for deciding who should have staff accounts and for information their administrators provide about invited users. The service is not designed to hold pupil personal data.
This policy covers prospective customers, main administrators, invited teachers, other authorised school staff, website visitors and people who contact us. Maths Launch accounts are intended for adult school staff. Pupils do not create accounts and are not intended users of the website.
Names, work email addresses, school name, school email domains, role, account status, email-verification and invitation status, authentication identifiers and session information. Passwords are handled by our authentication provider and are not available to Maths Launch in readable form.
Planner pathways, term and week selections, blocked weeks, ordered topic choices, planner sharing and rollover records, starter topics and difficulty choices, starter launches and question variants, and related timestamps. We also keep limited account, security and administrative event records, including invitations, administrator transfers and deleted teacher membership records.
Billing contact details and references supplied by Stripe, together with Stripe customer, checkout, subscription, invoice, refund and dispute identifiers, status, dates and amounts. Card and bank details are entered directly into Stripe and are not stored by Maths Launch.
If you use the Contact page, we collect your name, email address, subject and message. The notification delivered to our support mailbox also includes your IP address and browser user-agent string. Form timing, a hidden anti-spam field and a Cloudflare Turnstile challenge token are used to detect automated abuse.
IP address, browser and device information, request and response details, authentication and session events, timestamps, error information and security logs generated when the service is accessed.
We receive information directly from you, from your school's main administrator, from your use of the service, and from service providers such as Neon, Cloudflare and Stripe.
To set up and authenticate accounts, provide planners and starters, manage school users, process subscriptions, provide support and communicate about the service. The information is necessary to enter into or perform the service contract.
To prevent fraud and abuse, secure accounts and systems, diagnose faults, maintain reliable records, answer enquiries, improve the service and establish or defend legal claims. Our legitimate interests are providing a secure, supportable educational service and protecting users and the business.
To keep appropriate tax, accounting and transaction records, respond to lawful requests and comply with data-protection, consumer, payment and other applicable legal requirements.
We do not use personal information for third-party advertising, sell personal information, or carry out solely automated decisions that produce legal or similarly significant effects. We do not currently send marketing emails. If optional analytics or marketing is introduced, this policy and any consent controls will be updated first.
Some providers may process personal information outside the United Kingdom. Where this is a restricted transfer, we require an applicable UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism. You may contact us for more information about safeguards relevant to your information.
We may preserve information for longer where required by law, a dispute, fraud prevention, a legal hold or a regulator. We delete or anonymise it when the relevant purpose ends. Backup copies may persist until they are securely overwritten in the ordinary backup cycle.
We use proportionate technical and organisational measures including encrypted connections, managed authentication, signed and expiring links, access controls, database row-level security, restricted service credentials, rate limiting and security logging. No internet service can guarantee absolute security. Please contact us promptly if you suspect unauthorised access to an account.
Depending on the circumstances, you may have the right to:
These rights are not absolute and exemptions may apply. To make a request, email contact@mathslaunch.com. We may need to confirm your identity and may consult your school where it controls the relevant account information.
Questions, requests or complaints about personal information may be sent to contact@mathslaunch.com or through our Contact page. The controller's geographic postal address must be added here before live launch.
You also have the right to complain to the Information Commissioner's Office. Visit ico.org.uk/make-a-complaint for current guidance. We would appreciate the opportunity to address your concern first.
We may update this policy when the service, providers or law changes. The current version will be published here. We will give appropriate notice of material changes where required.