Legal
Privacy notice
What we hold about you and your child, why we hold it, and what you can ask us to do about it.
Last updated 28 August 2026
Who is responsible for your data
Knowledge Forge is the data controller for the tuition service and the Knowledge Forge platform. We are based in Haslemere, Surrey, United Kingdom.
You can reach us about anything on this page at sakuralearning1@gmail.com or 07391798226.
Where a school engages us to assess its own pupils, that school is the controller and we act on its written instructions as its processor. In that case the school's own privacy notice applies to the pupil data it gives us.
The short version for parents
We collect what we need to teach your child, mark their work, and produce the reports you have paid for. Nothing more.
- We never sell personal data and we do not run advertising or tracking on this site.
- A child's first name, year group and answers are used to mark work and write reports. We do not need their address, school photographs or medical records.
- AI is used to mark free-text answers and draft report wording. A report is only produced from work your child has actually submitted — we never estimate a score.
- Reports are advisory. They support your decision about schools and preparation; they do not predict or guarantee an admission outcome.
- You can download everything we hold about your family, or ask us to correct or delete it, from your dashboard under Data & privacy.
What we collect and why
Our full record of processing lists every activity, the data it uses, the lawful basis and how long it is kept. In summary, we hold:
- Parent enquiries and consultation requests — Responding to a parent who asks about tuition, arranging a free consultation, and keeping a record of what was agreed. Lawful basis: legitimate interests. Kept 24 months from the last contact, then deleted..
- Parent and tutor accounts — Providing a secure sign-in so a parent can reach their own children's information. Lawful basis: contract. Kept for as long as the account is active, then 12 months after the last sign-in..
- Child records and learning profiles — Holding one permanent record per child so assessments, targets and reports belong to the right pupil over time. Lawful basis: contract. Kept while the family is a customer, then 24 months after the last activity so a returning family keeps their history. deleted sooner on request..
- Assessments, exam papers and pupil answers — Marking a pupil's work and producing an evidence-based report the parent has paid for. Lawful basis: contract. Kept 24 months after the assessment, unless the family asks for earlier deletion..
- AI-assisted reports and recommendations — Turning marked evidence into a written report and next steps for the parent, always reviewed by a human before it is relied on. Lawful basis: contract. Kept 24 months, so a family can revisit a report they paid for. deleted on request..
- Purchases, entitlements and credits — Taking payment, unlocking what the family has bought, and keeping an auditable record of credit use. Lawful basis: contract. Kept 7 years for financial records (uk tax law). marketing use ends when the family asks..
- Classes, pupil logins and invitations — Letting a tutor group pupils into a class and giving each pupil a single, secure login to the pupil Learning Academy app. Lawful basis: contract. Kept invitations expire and are deleted after 30 days. logins last while the pupil is taught..
- Service monitoring and internal agents — Spotting broken journeys, incidents and revenue problems so the service keeps working. Not used to profile families. Lawful basis: legitimate interests. Kept 12 months, then deleted..
Children's data
Most of the pupils we work with are aged 7 to 14, so the ICO's Age Appropriate Design Code applies to everything we build.
- A parent or guardian creates the account and buys the product. A child never sets up an account on this site by themselves.
- Pupil logins for the Learning Academy are issued by the parent or tutor, use a username rather than a child's email address, and can be reset or revoked at any time.
- High-privacy settings are the default: a child's records are visible only to their own parent, their assigned tutor and the site administrator.
- We do not profile children for marketing, we do not use nudge techniques to extend screen time, and we do not run behavioural advertising.
- A child's own view of the platform shows practice, targets and progress — not commercial upsell messaging.
Automated analysis and AI
AI models help us mark open answers, draft report wording and suggest what to practise next. A qualified human educator remains responsible for the educational judgement and can override anything the model produces.
There is no automated decision with a legal or similarly significant effect: no admission, no selection and no pricing decision is made by a model.
You can ask for human review of any AI-assisted analysis in your reports. Use the Data & privacy page in your dashboard or email us.
How long we keep it
Each processing activity has its own retention period, listed in the section above. In broad terms: enquiry records are kept while we are in contact and for a short period afterwards; pupil learning records and reports are kept while the family is active and for a defined period after that so progress remains comparable; payment and tax records are kept for the period UK tax law requires.
Retention periods are recorded and monitored internally. Deletion outside those periods is done on request.
Your rights
Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. You can also withdraw consent where consent is the basis we rely on. A parent may exercise these rights on behalf of their child.
We respond within one month. There is no charge for a normal request.
The quickest route is the Data & privacy page in your parent dashboard, which lets you download your data immediately and log a formal request. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.
How your data is protected
Access to records is enforced in the database itself, so a parent can only ever read their own family's rows, a tutor only their own classes, and the administrator's actions on privacy records are written to an append-only audit log.
Payment card details never reach our servers — they go directly to Stripe.
If a breach ever puts personal data at risk we record it, assess the risk to the people affected, and notify the ICO within 72 hours where the law requires it.
Changes to this notice
We update this notice when the platform changes. The date at the top always reflects the current version. Material changes affecting how children's data is used will be flagged to parents in the dashboard.
There is a shorter version written for pupils on the privacy for pupils page.