1. Who we are
CSZone.co.uk is a Computer Science revision platform for GCSE, iGCSE and A-Level students in the UK and internationally. We are based in the United Kingdom.
For questions about this policy or your personal data, contact us at: hello@cszone.co.uk
2. What data we collect
We collect the following personal data when you use CSZone:
- Account data: your email address, name, and password (stored securely via Supabase Auth)
- Profile data: your exam board, role (student, teacher), school association, and progress through lessons
- Usage data: pages visited, lessons completed, mock paper attempts and scores
- Payment data: subscription status. Card details are handled entirely by Stripe — we never see or store your card number
- Communication data: any messages you send us via the contact form or by email
- Teacher/school data: if you are a teacher, we store the classes you create, students enrolled, and notes you add
3. How we use your data
We use your data to:
- Provide you with access to lessons, mock papers and revision tools
- Track your progress so you can see what you've completed
- Process your subscription via Stripe
- Allow teachers to manage their classes and view student progress
- Send transactional emails (account confirmation, password reset)
- Improve the platform based on how it is used
- Respond to your enquiries
We do not sell your data to any third party. We do not use your data for advertising.
4. Legal basis for processing (UK GDPR)
- Contract: processing your account and subscription data is necessary to provide the service you signed up for
- Legitimate interests: analysing usage to improve the platform, and communicating with you about your account
- Legal obligation: where we are required to retain records by law
- Consent: analytics cookies (Google Analytics) are only placed after you have explicitly accepted via the cookie consent banner on your first visit. You may withdraw consent at any time by clearing cookies or using the browser opt-out tool listed in Section 6
5. Third-party services
CSZone uses the following third-party services, each of which may process some of your data:
- Supabase — database, authentication and file storage. Data is stored on servers within the EU. Supabase Privacy Policy
- Stripe — payment processing. Card data is handled exclusively by Stripe and never passes through our servers. Stripe Privacy Policy
- Netlify — website hosting. Serves all pages and Netlify Functions. Netlify Privacy Policy
- Google Fonts — font files loaded from Google's CDN on each page visit. Google Privacy Policy
- Google Analytics — anonymised usage analytics to understand how visitors use the site. You can opt out via Google's opt-out tool.
- Anthropic Claude API — used to mark mock paper answers. Your answers are sent to Anthropic for processing but are not stored or used for training. Anthropic Privacy Policy
6. Cookies
We use the following cookies and similar technologies:
- Essential cookies: Supabase authentication tokens that keep you signed in. These are required for the service to work.
- Analytics cookies (consent required): Google Analytics 4 may set cookies to track anonymised usage patterns (pages visited, session duration, device type). These cookies are not placed on your first visit — a cookie consent banner is shown and analytics only loads if you click "Accept". If you click "No thanks", no analytics cookies are set. You can opt out at any time via Google's opt-out tool or by clearing your browser cookies.
- Third-party cookies: Stripe may set cookies when handling payment flows. Google Fonts loads font files from Google's CDN but does not set persistent tracking cookies.
You can control cookies through your browser settings. Disabling essential cookies will prevent you from staying signed in.
7. Data retention
- Account data is retained while your account is active
- If you delete your account, your personal data is deleted within 30 days, except where we are legally required to retain records
- Anonymised usage analytics may be retained indefinitely
- Payment records are retained for 7 years as required by UK financial regulations
8. Your rights (UK GDPR)
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your data ("right to be forgotten")
- Restrict or object to processing
- Data portability — receive your data in a machine-readable format
- Withdraw consent at any time where processing is based on consent
To exercise any of these rights, email us at hello@cszone.co.uk. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
9. Children's data
CSZone is intended for secondary school students aged 14 and above. We do not knowingly collect personal data from children under 13. School licences are set up by teachers, who are responsible for ensuring appropriate parental consent is in place for students under 13 in their class.
10. Security
We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), secure authentication via Supabase, and server-side access controls. No system is completely secure — if you believe your account has been compromised, contact us immediately.
11. Changes to this policy
We may update this policy from time to time. If we make significant changes, we will notify registered users by email. The date at the top of this page shows when it was last updated.
Questions about this policy? Email us at hello@cszone.co.uk and we'll respond within one working day.