Privacy Policy

Simon Sharp, trading as Wild Schooling ("we," "our," or "us") operates The Reading Fluency Assessment Tool (the "Service"). This Privacy Policy explains how we collect, use, disclose and protect your personal information.

1. Information We Collect

1.1 Information You Provide Directly

1.2 Information Collected Automatically

2. How We Use Your Information

2.1 Legal Basis for Processing (GDPR)

We process your personal data based on:

• Contract: To provide the Service you subscribed to
• Consent: For marketing communications and optional features
• Legitimate Interest: For service improvement, security and fraud prevention
• Legal Obligation: To comply with applicable laws

2.2 Purposes of Processing

We use your information to:

• Provide the Service: Create accounts, track progress, generate reports
• Process payments: Handle subscriptions and billing
• Improve the Service: Analyse usage patterns and user feedback
• Communicate with you: Service updates, support responses, educational tips
• Ensure security: Prevent fraud, protect against malicious activity
• Comply with legal obligations: Respond to legal requests, enforce Terms

3. Your Rights and Choices

3.1 GDPR Rights (UK/EU Users)

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure ("Right to be Forgotten"): Request deletion of your data
• Restriction: Limit how we process your data
• Portability: Receive your data in portable format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Revoke consent at any time

3.2 Exercising Your Rights

To exercise any of these rights:

• Email: support@readingfluency.co.uk
• Include: Your name, email and specific request
• Response time: Within 30 days
• Verification: We may request identity verification

4. Data Security

We implement appropriate technical and organisational measures:

• Encryption: Data encrypted in transit (TLS/SSL) and at rest
• Access controls: Limited employee access on need-to-know basis
• Authentication: Secure password requirements, hashed storage
• Regular security audits: Monitoring for vulnerabilities
• Secure hosting: Enterprise-grade infrastructure (Supabase, Vercel)

4.1 Data Breach Response

In the unlikely event of a data breach:

• We will notify the ICO within 72 hours
• We will notify affected users without undue delay
• We will provide clear information about the breach and steps to protect yourself
• We will take immediate action to contain and remediate the breach

5. Children's Privacy

5.1 Age Restrictions

• Users under 13: Require parental consent
• Teacher/parent controls: Adults manage student accounts
• Limited data collection: We collect minimal data from students

5.2 Student Data Protection

• We comply with UK Data Protection Act 2018 and GDPR
• Student data is used only for educational purposes
• Parents/teachers can request student data deletion
• We do not show advertising to children
• We do not sell or share student data for marketing

6. Data Retention

6.1 Retention Periods

7. International Data Transfers

7.1 Data Storage Location

• All data is stored on EU-based servers (through Supabase)
• We do not transfer data outside the EU/EEA
• If this changes, we will update this policy and seek consent where required

7.2 Third-Party Services

Some third-party services we use may be based outside the EU/EEA:

• Stripe (Payment Processing): USA - covered by EU-US Data Privacy Framework
• Vercel (Hosting): USA - ISO 27001 certified, GDPR compliant

8. Communications and Marketing

8.1 Types of Communications

We may send you the following types of communications:

8.2 Consent and Opt-Out

8.3 Email Frequency

9. Automated Decision Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects. Any data analysis is used only for:

• Generating educational reports
• Tracking student progress
• Improving our Service

10. Contact Information

10.1 Data Controller

10.2 Response Times

• General inquiries: 5 working days
• GDPR rights requests: 30 days
• Data breach notifications: 72 hours

10.3 Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with: