Privacy Policy

Effective date: 20 April 2026

1. Who we are

Data controller: Ayda Digital (contact: admin@aydayazdani.com).

We are registered with the UK Information Commissioner's Office where required. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What we collect

The exact data collected depends on which service you use, but it may include:

• Account information — name, email address (via Google sign-in), and for child learners on 11plusenglish.com: a parent-chosen username and 4-digit PIN only (no phone, no email)
• Usage data — progress on modules, quiz answers, writing submissions, login timestamps, IP address, browser type
• Payment information — processed by Stripe; we store only the customer email, subscription/pass duration, and Stripe IDs. We never see or store your card details.
• Communications — messages you send to our support address, support form submissions, and any feedback you share
• Technical logs — server access logs (retained briefly for security and debugging)

3. Why we collect it

• To provide the service you requested (create your account, deliver content, track progress, process payments)
• To keep the service secure (detect abuse, protect against fraud)
• To communicate important service information (welcome email, subscription expiry reminders, critical updates)
• To comply with legal, tax, and accounting obligations
• To improve our services (anonymised usage patterns)

We do not sell your data. We do not share it with marketers.

4. Legal basis for processing

Under UK GDPR, we rely on the following legal bases:

• Contract — processing necessary to deliver the service you've signed up for
• Legitimate interest — security logging, fraud prevention, and service improvement
• Legal obligation — retaining payment and tax records as required by HMRC
• Consent — where explicitly requested (e.g. optional marketing or research participation)

5. Who we share with

We use a small number of trusted processors to operate the services:

• Stripe (payment processing) — stripe.com. Governed by Stripe's Privacy Policy.
• Google (OAuth sign-in and email delivery via Gmail SMTP)
• IONOS and SiteGround (web hosting in the UK and EU)
• Amazon Web Services (iclerk.org processing; data processed in London, eu-west-2)
• OpenAI, Anthropic, DeepSeek, Google (LLM providers) — used for writing feedback on 11plusenglish.com and clinical dictation on iclerk.org. Content is processed without long-term retention by the provider where possible.

We disclose data to law enforcement only if legally compelled (court order, statutory duty).

6. How long we keep it

• Account data — for as long as your account is active, plus up to 12 months after deactivation for account-recovery purposes.
• Payment records — 6 years, as required by HMRC.
• Usage data (progress, submissions) — until you delete the account.
• Server logs — typically 30–90 days.

7. Your rights

Under UK GDPR you have the right to:

• Request a copy of the personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data ("right to erasure")
• Ask us to restrict or object to our processing
• Request your data in a portable format
• Withdraw consent at any time (where we rely on consent)
• Complain to the UK Information Commissioner's Office at ico.org.uk

To exercise any of these rights, email admin@aydayazdani.com. We aim to respond within 30 days.

8. Children's data (11plusenglish.com)

11plusenglish.com is designed for children in the 9–11 age range working under parental supervision. A parent with a verified Google account creates the learner accounts; a learner account requires only a parent-chosen username and a 4-digit PIN — no email or phone number for the child. Progress and writing submissions are visible to the parent only.

Parents can delete a learner account at any time from their parent dashboard, which permanently removes all associated data.

9. Cookies

We use a small number of essential cookies to keep you signed in, maintain session state, and protect against cross-site request forgery. We do not use advertising or cross-site tracking cookies.

Depending on the service, we may use anonymised analytics (e.g. Google Analytics 4) to understand aggregate usage. You can opt out of these via your browser settings.

10. International transfers

Some of our processors (Stripe, Google, OpenAI, Anthropic) are based in the United States. Where personal data is transferred outside the UK, it is protected by Standard Contractual Clauses or the UK International Data Transfer Addendum.

11. Changes to this policy

We may update this policy from time to time. The "Effective date" at the top of the page reflects the most recent version. For significant changes we will notify active account holders by email.

12. How to contact us

For any privacy-related question, data request, or complaint: