The Revision Wizard ("we," "our," or "us") is committed to protecting your privacy and handling personal data responsibly. This Privacy Policy explains how we collect, use and protect personal data when you use our websites and mobile applications (the "Service").
The Service is based in the UK and designed primarily for UK users, though it is accessible worldwide. We provide gamified learning games for children, managed by an adult account holder, and we process data relating to those users and their interactions with the Service.
2. Who We Are (Data Controller)
This service is operated by Paul Elderton t/a The Revision Wizard, a sole trader in England, United Kingdom. Paul Elderton is the data controller responsible for your personal data under the UK GDPR. Our postal address is Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA.
Admin Users: when you subscribe, we collect your name and email address. Payment details are collected and processed directly by Stripe (or, in the App, by Apple or Google); we do not store full card details.
Child Users: Admin Users create child accounts with a username. Usernames are stored in our Cloudflare database, and authentication is managed by Auth0. We ask Admin Users not to use a child's full real name.
Newsletter subscribers: if you opt in to our newsletter, we collect your email address (processed via Mailchimp).
Free practice pack: if you ask us to send you the free pack, we collect your email address. It is added to our newsletter list (Mailchimp), and the pack itself is emailed to you via Brevo. Spam protection is by Cloudflare Turnstile. You can also download the pack without giving us an email address at all.
Contact form: if you contact us, we collect your name, email address and message (delivered via Brevo, with spam protection by Cloudflare Turnstile).
3.2 Information collected automatically
We use Cloudflare for hosting, security and database services. Technical data such as IP address and device information may be processed for security and operational purposes.
Game-related data — including progress, scores and in-game activity — is stored in our database and associated with the relevant user account.
We use privacy-focused analytics to understand website performance (see section 8).
3.3 Mobile app data
Push notifications: if you enable notifications (for example, daily practice reminders), we process a device push token so we can deliver them. You can turn notifications off at any time in your device settings.
Device information: we may process device type, operating system version and app version for support, security and to improve the App.
Purchases: in-app purchases are processed by Apple or Google; we receive confirmation of your subscription status but not your payment card details.
4. How We Use Your Information
Service provision: to provide the learning games and manage subscriptions and accounts.
Authentication and security: to verify and secure access via Auth0 and to protect the Service.
Payment processing: to take and manage subscription payments.
Communication: to send service-related emails and, where you have opted in, newsletters.
Improvement: to monitor, analyse and improve the Service.
5. Legal Basis for Processing
Contractual necessity: to provide the subscribed Service.
Legitimate interests: for security, fraud prevention and improving the Service, balanced against your rights.
Consent: for marketing emails, newsletters and non-essential cookies.
Legal obligation: to comply with applicable laws.
6. Data Sharing and Third Parties
We do not sell your personal data. We share data with the following processors and partners only as needed to run the Service:
Provider
Purpose
Stripe
Subscription payments (web)
Apple App Store / Google Play
In-app purchases and subscriptions (App)
Auth0 (Okta)
Authentication and account security
Cloudflare
Hosting, security, database, web analytics, and Turnstile spam protection on our contact and free-pack forms
Brevo
Transactional email and email drips
Mailchimp
Newsletter and free-pack sign-up, and delivery (opt-in only)
Legal authorities
Where required by law
7. Shared Leaderboards Between Groups
The Service lets Admin Users connect their Groups using share codes so children can appear on shared leaderboards. Where an Admin User chooses to use this feature, a Child User's username and progress statistics may be visible to the other connected Group(s). No contact details or account credentials are shared.
Admin Users decide whether to create, share, accept, reject or block these connections and can revoke them at any time. If you would like a connection removed, an Admin User can do this in the Service, or you can contact us.
8. Cookies and Analytics
We use a small number of cookies and similar technologies. Essential cookies are needed for the Service to work (for example, keeping you signed in via Auth0). We do not use advertising or tracking cookies, and our website does not use Google Analytics.
Cloudflare Web Analytics tells us how many people visit our website and which pages they read. It sets no cookies, collects aggregated traffic data only, and does not track individuals.
Parent challenge counter. Our 11+ parent challenge page counts, per day, how many times it is opened, started, finished and shared and how many free packs are requested from it, and which link people arrived from (for example our Instagram or YouTube links, or the QR code on a printed bookmark). The page that bookmark's QR code opens counts, in the same way, how many times it is opened and which of its two links is followed. Only those totals are stored. It sets no cookies and records nothing about who you are: no identifier, IP address or device details.
Cloudflare Turnstile protects our contact and free-pack forms from spam by checking that the visitor is a person, not a bot. It is run by Cloudflare, our hosting provider, is not used for advertising, and loads only on the pages that carry those forms.
9. Fonts and External Resources
The fonts on our websites and in the App are served from our own hosting, so displaying them does not send your IP address or any other details to a third party.
10. Data Storage and Security
We apply appropriate technical and organisational measures to protect personal data. Authentication credentials are managed securely by Auth0, and other data is stored in Cloudflare's infrastructure with access controls and protections in place.
11. Data Retention
Account information: retained while your subscription is active and for a limited period afterwards to meet legal, accounting and security obligations.
Game data: retained while the account is active and for a limited period afterwards, then deleted or anonymised.
Newsletter subscriptions: retained until you unsubscribe.
You can request deletion of an account and its associated data at any time (see section 12).
12. Your Rights
As a UK/EU user, you have rights under the UK GDPR and the Data Protection Act 2018, including the right to:
Access — request a copy of your personal data.
Rectification — request correction of inaccurate data.
Erasure — request deletion of your data where applicable.
Restriction / Objection — restrict or object to certain processing.
Portability — request transfer of your data to another service.
Withdraw consent — unsubscribe from marketing at any time.
To exercise any right, email privacy@therevisionwizard.com. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
13. Children's Privacy
The Service is used by children, but child accounts are created and managed by adult Admin Users (parents, guardians or educators), who are responsible for the accounts they set up. We limit the personal data associated with child accounts to what is needed to run the learning games — principally a username and in-game progress — and we do not knowingly collect contact details directly from children.
We design the Service with children's best interests in mind and take account of the ICO's Age Appropriate Design Code (Children's Code). An Admin User can review, correct or delete a child's account and data at any time, or contact us for help.
14. International Data Transfers
Some of our providers (for example Stripe, Auth0/Okta, Cloudflare, Brevo, Mailchimp and Google) may process data outside the UK. Where data is transferred internationally, we rely on appropriate safeguards — such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses — to ensure your data remains protected.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, for significant changes, notify users through the Service or by email.