Privacy notice

Who looks after your information

Burnadette Marina Ilya Samir Ilies, a sole trader trading as Learn Science With B, is responsible for the personal information used to run this tutoring service.

For privacy questions, requests or complaints, email privacy@learnsciencewithb.co.uk, phone +44 7884 408322, or write to 10 Honeysuckle Road, Witham St Hughs, Lincoln, LN6 9ZG. Burnie handles requests, with authorised administrator Rob as backup. The private privacy-email group delivers messages to both handlers. For ordinary tutoring enquiries, use burnie@learnsciencewithb.co.uk.

This notice covers website visitors, parents/carers, students, tutors and administrators using this service. It does not replace the separate privacy information of Google, Clerk, your bank or other services you choose to use.

A short explanation for students

We keep your name, learning information and work to help you study. Your linked parent or adult billing account, assigned tutor and authorised admins can see the learning information shared with them. Other families cannot see your private homework. Some library resources are shared with all active users.

Student accounts cannot see parent-only conversations or the tutor's private notes. Ask Burnie if you want to see your information, correct a mistake or discuss removal. These are your privacy rights, even when a parent pays.

You can say no to recording or saved AI notes without losing your lesson or paying more. Your parent and you make your own choices. Burnie checks again at the start of the call. Ask Gemini is a separate meeting assistant: Burnie explains and asks separately before using it, and turns it off for the call if anyone refuses. AI answers and summaries can be wrong; tell Burnie if something needs correcting. Never share your password or send unnecessary private information.

What we use and why

Accounts: names, adult contact details, verified sign-in details, managed student usernames, roles, linked family/tutor relationships and account status. Clerk provides authentication, password and session services; the tutoring database does not store your password. A student's internal account email identifier is not a personal recovery inbox.
Teaching: school year, subjects/level, exam board, progress, results, necessary practical adjustments, lesson records, homework, submitted files, marked work and tutor notes. These come from you, your linked family, your tutor and work completed in lessons.
Communication: portal messages, attachments, senders, times, read records and notifications. Enquiries through business email, Facebook or Messenger are also handled outside the portal.
Bookings: appointment times/status and the deliberately checked student/parent/tutor association. Google supplies appointments and the private diary. A family sees its linked appointments, not Burnie's whole private calendar. A home-lesson address is needed to arrange that visit, not for every online family.
Payments and agreements: lesson prices, bills, due dates, manually recorded bank receipts/refunds and accounting references. A new on-site agreement records the exact service/price, parties, accepted terms and privacy-information versions, authority/early-start choices, server time and an unchanged confirmation copy. This is separate from recording consent. The website does not take card payments or move money.
Safety and support: a reviewed age band—Under 13, 13–17 or 18+—parent/carer authority where needed, and an emergency contact. We do not routinely ask for birth dates, ID uploads, medical reports or diagnoses. Please describe necessary practical adjustments instead. If sensitive health/disability information is necessary, we must explain its purpose and establish the appropriate additional legal condition before using it; merely putting it in a message is not blanket consent.
Privacy requests and complaints: necessary correspondence in the private group and handlers' business-held email copies, plus a brief restricted admin register of responsibility, dates, status, outcome and justified holds. The register does not automatically import emails or calculate every legal deadline.
Security and operation: sign-in/session checks, access/audit events, operational errors and information providers receive when connecting your device. We use this to protect accounts and private files, investigate faults and keep the service working.

The adult customer's booking, teaching and payment arrangements use contract or requested pre-contract steps where applicable. A parent's contract is not automatically the legal basis for all of a child's information. We rely on legitimate interests for proportionate teaching administration, family communication, support and service security, considering children's rights and minimising what is collected. Required financial records use applicable legal duties. Optional recording and saved AI notes use specific consent, not acceptance of the tutoring terms. Any necessary special-category or safeguarding processing needs its own appropriate basis/condition; ordinary teaching does not exempt it.

You can object to uses based on legitimate interests. Contact us and explain your circumstances. We consider the objection and stop unless an applicable legal reason allows the use to continue. We do not use the portal to make solely automated decisions with legal or similarly significant effects, or for automated grading. Tutors/admins review teaching, bills and activation; access checks and reminders can operate automatically.

You do not have to provide unnecessary information. Without necessary account, booking, contact or payment details we may be unable to provide the relevant service safely; we will explain what is needed. Optional recording/AI choices are not conditions of tuition.

Who can see your information

Students see their permitted learning records. Linked parents/adult billing accounts see authorised family learning information and their own private parent conversations/bills. Assigned tutors see relevant teaching records and earlier teaching conversations. Former tutors lose portal access when reassigned. Authorised admins can access information for administration, support, safety and security. Private tutor notes are not displayed to families, but are not automatically excluded from a lawful information request.

At18+, a student can ask Burnie to transfer their existing learning profile to their own separately registered parent/adult billing account. The learning login stays separate and unchanged. The original payer keeps their own bills and previous private parent-only conversations, not ongoing access to the transferred learner's work. This is an admin-managed request, not an automatic birthday change.

After an admin records a student's confirmed tuition end, permitted past learning becomes read-only for 12 calendar months. Learning access ends at midnight UK time on the displayed expiry date. New work/messages and continuing library/meeting access stop for that student. Siblings' access and the payer's own bills are separate. These portal controls do not delete information, cancel Google events or automatically revoke external Google sharing.

Online lesson recording and AI

Google Meet can record lesson voice, video and presented content for student revision and Burnie's review of her teaching. Built-in Gemini can process lesson speech/content to make saved transcripts, notes and summaries. Saved AI output may contain mistakes and needs tutor review.

Recording and saved AI notes have separate optional choices. Under our service rule, saved AI notes require recording permission too; recording does not require saved AI notes. Each linked parent and student controls only their own choices. Both current recording choices are needed for a green recording eye; both current AI choices are also needed for the AI tag. Missing, withdrawn or out-of-date choices mean that feature is not permitted. An eye is saved permission, not evidence capture is running.

Burnie checks understanding and appropriate authority rather than treating an age band or tick alone as proof of valid consent. She asks at call start, honours refusal and manually controls Meet. The website cannot start or stop capture. Refusal does not change the lesson or price. Google can also show its own participant prompts; those do not replace our explanation or your right to refuse.

Ask Gemini is separate. It can use live conversation and search information. Prompts/responses can appear in conversation history; it is not simply a search box. Profile recording/saved-note choices do not authorise it. Burnie separately explains and checks participants agree, and turns it off for that call if anyone refuses or withdraws.

Recordings and saved meeting outputs are held in the business Google Workspace Drive. Intended viewers are Burnie and the relevant student/parent, with account-specific sharing. Burnie must check each new output and any reused meeting's recipients; folder names or attendance do not prove access is correct. Recording downloads are restricted where available, but this cannot prevent screen recording or guarantee that every kind of note has the same restriction.

The business rule is viewing followed by review/removal of business-held recordings, saved transcripts and notes 12 months after tuition ends, unless an earlier applicable request requires action or limited information must lawfully be kept. Google removal/sharing review is manual, not an automated website timer. You may withdraw future recording or saved-note permission from your profile, or contact Burnie without a login. Tell her promptly if capture is running. Use relying on withdrawn consent must stop; existing business-held copies need removal review. Withdrawal does not make earlier lawful use unlawful. Unticking does not automatically delete Google files or copies already held by recipients; any separate lawful retention reason must be explained.

Providers and international processing

Cloudflare supplies website hosting, D1 portal records, private R2 files and recovery copies. Clerk supplies identity/sign-in and invitations, including Google sign-in. Google supplies Workspace email, appointment booking, Calendar, Meet, Drive and built-in Gemini. The portal's business-email connection sends approved messages; it does not read the business inbox. Privacy-group delivery also creates authorised business-held copies for Burnie and Rob, not access to unrelated mail. Meta operates external Facebook/Messenger contact; banks handle transfers outside the portal.

These services can have different roles: some process information for us under data-processing terms; some also act for their own account/security or service purposes under their privacy information. They and their subprocessors can process outside the UK, including in the United States. We do not promise UK-only storage.

Google, Clerk and Cloudflare publish data-processing terms and international-transfer safeguards, including the applicable UK contractual provisions and/or eligible UK–US Data Privacy Framework arrangements. The applicable entity, service, transfer and safeguards must be checked rather than assuming every transfer is covered by a provider's badge. Contact privacy@learnsciencewithb.co.uk for details or a copy of the safeguards relevant to your information. Provider references: Google processing terms, Clerk processing terms, Cloudflare processing terms.

No advertising pixel, promotional email sign-up or automated AI marking is part of the identified portal implementation. New uses need their own information and, where required, permission; agreeing to tuition or closing a notice does not grant advertising consent.

How long information is kept

Our ordinary business review/removal periods are:

Unsuccessful enquiries: 3 months after last contact.
Student profiles, learning work/messages and ordinary lesson/tutor notes: 12 months after tuition ends.
Business-held recordings, saved transcripts and Gemini notes/summaries: 12 months after tuition ends.
Signed agreement and confirmation evidence: 6 years after tuition ends, separately from ordinary learning/video information.
Closed privacy requests/complaints:review12 months after closure, minimise/remove unnecessary register, group and business-mail copies; keep only justified dispute, investigation or legal evidence longer, with a reason and further review.

These are business rules, not universal statutory periods or automatic purge timers. Earlier rights, necessary legal duties and justified holds can change the outcome. Learning access expiry is not deletion. We review other account/staff, permission-evidence, security/audit and safeguarding information according to its continuing purpose, current role, relevant incident/request, legal obligations and any necessary dispute evidence. We minimise what must remain; a payment-record protection is not a reason to keep all learning information indefinitely.

Required self-employed tax records normally need at least 5 years after the relevant31 January submission deadline; late-return/other applicable rules can differ. That is not measured from tuition end. HMRC retention guidance.

Recycled library files normally require 30 days plus reference/backup/integrity checks before admin-confirmed permanent removal. An admin can deliberately override the waiting period through the confirmed manual deletion/empty-bin controls; protected references and backup checks still apply. Removed folders remain separately recoverable. Known abandoned uploads require confirmed quarantine and the approved waiting/check process; unknown/in-progress uploads are held. Learning-export download links expire after 7 days; source records and downloaded copies are separate.

Recovery normally keeps successful points for the latest 3 UK daily dates and 4 completed months where available; pins, failures or holds can retain older points. Teaching recovery preserves current financial/operational records. Backups are restricted recovery copies, not ordinary teaching access. A restore requires separate review of later removal/restriction decisions and external copies; we cannot promise that deleting one screen immediately erases every provider or recipient copy.

Cookies and browser storage

Read Cookies and browser storage and use Browser settings for controls. Sign-in/security storage is separate from optional preferences. Appearance uses separate visitor/account scopes; child/workspace memory is session-only and can be turned off. Closing the compact notice remembers its revision across pages and tabs in this browser until reset or cleared, not permission for tracking. Blocked local storage can limit dismissal to a tab or page.

Google's booking calendar stays unloaded until you choose Show booking calendar. That page explains Google's connection/storage and offers email booking instead. This page-only choice does not accept tuition terms or advertising. Closing it cannot undo information already received or cancel a reservation. Provider storage varies with your sign-in and settings.

Optional public-page statistics

We use optional Cloudflare Web Analytics to understand visits and improve loading speed on the signed-out homepage, Privacy, Terms and Cookies pages. It is off unless you declare you are 18 or over and explicitly allow it in Browser settings; under-18s should leave it off. No birthday or ID is requested for this choice. Booking/cancellation forms, account/learning pages, signed-in visitors and pages with query or fragment context are excluded. We do not use it for advertising, session replay or tracking named students. Do Not Track and Global Privacy Control keep it off.

If allowed, Cloudflare receives the public page address, an eligible referring page, a temporary page-load identifier and browser/device and performance details, such as page timings, browser version and memory measurements where available. It receives your network address to handle the request; Cloudflare says its RUM service discards that address at its nearest data centre rather than storing it in core logs/databases. We do not send names, account identifiers, coursework, messages, billing details or form entries through this feature. Cookie-free does not mean no information is processed.

Our basis for this optional measurement is your consent. The provider beacon does not use browser storage; our identifier-free Allow/Off preference is stored separately for 90 days on this browser. Change it in Browser settings at any time without affecting tutoring or sign-in. Turning Off refreshes already-measured read-only public pages to end their measurement; booking and learning forms are never refreshed. This cannot recall information already sent or a request already in flight.

Cloudflare describes seven days of unsampled beacon data and a dashboard history of up to six months, with later data sampled/aggregated. These provider periods differ from the 90-day browser preference. Its processing may be outside the UK; the provider/transfer section above also applies. Read Cloudflare RUM data information, analytics retention information and Cloudflare's privacy information. Browser blocks and our exclusions make statistics incomplete; they are not a count of every customer or lesson.

Your rights and complaints

Contact us without an active portal account to ask for access, correction, erasure, restriction, objection or portability where applicable. Withdraw consent for the uses based on it at any time. Rights have conditions; any justified limitation must be explained. A child's rights belong to them, not automatically to the payer. Proportionate identity/authority checks may be needed; please do not send passwords or ID documents in your first message.

Access requests normally require a response without undue delay within one calendar month, subject to applicable rules and justified extensions. A learning export is not a complete subject-access response. Privacy complaints must be acknowledged within 30 days, investigated appropriately and the outcome communicated without undue delay. Burnie and Rob handle the relevant clocks manually; a register status is not proof of a response.

You can complain to the Information Commissioner's Office. Material changes to what we do need clear information before the new use begins.