Skip to content

Privacy Policy

Last updated: 14 September 2026

1. Who We Are

Exam Ladder is a service of Omnify Labs Ltd ("we", "us"), a company registered in England and Wales (company number 17389917), registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Omnify Labs Ltd is the data controller for personal data processed through this service and is registered with the Information Commissioner's Office under registration reference ZC219040. This policy explains what data we collect, how we use it, and your rights under UK GDPR and the Data Protection Act 2018.

Contact our data team: privacy@examladder.co.uk

2. Data We Collect

Account data:

Email address, date of birth, display name (optional), exam board, and tier selection provided when you register. We collect date of birth solely to confirm you are old enough to use Exam Ladder.

Usage and learning data:

Practice session results, topic mastery scores, mock exam grades, time-on-task, streak data, and XP. This data powers your personalised revision recommendations.

Technical data:

IP address (used for rate limiting and fraud prevention), browser type, and device type (collected via standard web server logs). We do not use third-party advertising or tracking cookies; first-party product analytics are recorded only if you choose "Accept all" in the cookie banner (see Cookies below).

Payment data:

Subscription status and billing history. Raw card details are processed exclusively by Stripe Inc. and are never stored on our servers.

3. Lawful Basis for Processing

We process your data under the following lawful bases (UK GDPR Article 6):

  • Contract — account management, subscription billing, and delivering the core revision service.
  • Legitimate interests — fraud prevention, platform security, and aggregated analytics to improve the service.
  • Consent — marketing emails (you can withdraw consent at any time via the unsubscribe link).
  • Legal obligation — retaining billing records as required by HMRC.

Exam Ladder is intended for users aged 13 and over. UK GDPR Article 8 sets the age of consent for online services at 13; we ask for date of birth at sign-up and do not knowingly create accounts for under-13s.

4. How We Use Your Data

  • To provide personalised spaced-repetition practice and predicted grade tracking.
  • To send transactional emails (account confirmation, password reset, trial-ending reminders).
  • To send marketing emails about new features or offers (consent-based; opt out any time).
  • To detect abuse, fraud, and ensure platform security.
  • To comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data to train third-party AI models.

5. Third-Party Processors

We share data only with processors who contractually agree to handle it securely and only for stated purposes:

  • Supabase Inc. — database and authentication (hosted in London, UK — AWS eu-west-2).
  • Stripe Inc. — payment processing (PCI DSS Level 1 compliant).
  • OpenAI Inc. — AI study coach and question generation (data is not used to train OpenAI models per our API agreement).
  • Resend Inc. — transactional email delivery.
  • Klaviyo, Inc. — the optional parents’ newsletter only (consent-based, double opt-in; stores the subscribed email address). Not used for any student account data.
  • Sentry Inc. — error monitoring (no personal data in error payloads; PII scrubbing enabled).
  • Google LLC — AI marking of handwritten and uploaded work (Gemini). Where you upload a photo or PDF of your working, that file is sent to Google to be marked.
  • Upstash Inc. — rate limiting and caching (stores IP addresses).
  • Railway Inc. — application hosting (EU region).

Everyone in that list is a processor — they act only on our instructions and for the purposes stated. There is one other category of recipient who is not a processor and does not appear above: a parent or carer whom a student has approved. What they can see, and how a student controls it, is section 9.

6. Data Retention

We keep your account and learning data (answers, topic progress, mock results and grade history) for as long as your account is active. Some data is deleted earlier on a rolling basis, whether or not you are still using Exam Ladder:

  • Usage analytics events — 14 months after they were recorded.
  • AI coach conversations — 12 months after the last message in the conversation.
  • Saved working canvases — 12 months after you last drew on them.
  • Sign-in and security logs — 12 months.

These windows are enforced by an automatic nightly job. Photographs of handwritten working that you submit for marking are sent to the marking provider for that one request and are not stored by us. Billing records are retained for 7 years as required by UK tax law. Anonymised, aggregated analytics may be retained indefinitely.

7. Your Rights Under UK GDPR

You have the following rights, exercisable by emailing privacy@examladder.co.uk:

  • Access — request a copy of all personal data we hold about you (also available via Settings > Export Data).
  • Rectification — ask us to correct inaccurate data.
  • Erasure — request deletion of your data ("right to be forgotten").
  • Restriction — ask us to pause processing of your data while a complaint is resolved.
  • Portability — receive your data in a machine-readable format (JSON export).
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — for any consent-based processing (e.g. marketing emails) at any time.

We will respond to all requests within 30 days. If you are unsatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, by telephone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

8. Children's Privacy

We take the privacy of users under 18 seriously and design the service in line with the UK Children's Code. Exam Ladder is intended for students aged 13 and over; we ask for date of birth at sign-up and do not knowingly create accounts for under-13s. To deliver the revision service we carry out educational personalisation — adaptive question difficulty, per-topic mastery and predicted-grade tracking, spaced-repetition scheduling, and an AI Study Coach that retains brief notes about a student's learning so it can help more effectively over time. This personalisation (profiling) is used only to deliver and improve the learning service — never for advertising or ad targeting, and we never sell children's data or share it with advertisers. A student or parent can request deletion of this data, including the AI Study Coach notes, at any time by contacting privacy@examladder.co.uk.

9. When a Parent or Carer Can See Your Data

Exam Ladder has a parent portal. An adult can ask to be linked to a student's account, and nothing is shared unless the student approves the request. Asking requires the student's own six-character link code, which only they can give out, and we email the student when a request is made so the decision is not left to them happening to notice it.

Once a student has approved, the linked adult can see:

  • The student's email address and display name.
  • Exam board, tier, target grade and exam date.
  • The predicted grade, and topic-by-topic strengths and weaknesses.
  • How many questions were answered and how accurately, for the past week and the past 30 days, plus streak, XP and level.
  • A day-by-day activity chart and the times of day the student worked, over the past 28 days.
  • Tasks the adult has set and whether they are done.
  • A written summary generated on request, and a weekly email covering the same figures.

A linked adult cannot read AI Study Coach conversations, anything written to the coach, individual answers or saved working. They can set tasks, leave a short message that appears on the student's dashboard, send praise, set study hours and a weekly question target, and switch off features (the AI coach, AI explanations, AI marking, mock exams, past papers, the working canvas, the leaderboard, friends and social, and formula drill).

The student stays in control. They can decline a request, and they can remove a linked adult at any time from Settings or the Parent access page — no reason needed, and it takes effect straight away. An adult whose request was declined cannot send it again; only the student can restore access. Tasks, messages and reports an adult has created are part of the student's own data: they appear in the data export and are deleted when the account is deleted.

Where a school licence is in place, the same principles apply to staff accounts. The schools product is not currently switched on.

10. Keeping Students Safe

The AI Study Coach is not a counselling service and it is not confidential. If a student writes something suggesting they may be at risk — distress, self-harm, feeling unsafe, or being harmed by someone — the coach stops tutoring, responds without judgement, and points them to Childline on 0800 1111 and Samaritans on 116 123, both free and open at any hour. In an emergency, call 999.

So that these do not go unseen, the platform also records that a concern was raised and notifies the person responsible for safeguarding at Omnify Labs Ltd. That notification contains the type and seriousness of the concern, the account it relates to and a link — it does not contain what the student wrote. This is not a monitored crisis service and no one is watching in real time; the helplines above are, and that is why the coach gives them immediately rather than waiting for an adult to read anything.

We rely on our legitimate interest in protecting children, and on the safeguarding provisions of the Data Protection Act 2018, for this processing. A student is not sent a message when a concern is recorded — being told would discourage exactly the disclosure that matters most.

11. Cookies

We use strictly necessary storage for authentication (Supabase session) and to remember your cookie choice. We do not use advertising cookies and never share data with advertisers. Only if you choose "Accept all" do we record first-party, privacy-respecting product analytics (e.g. which features are used) to improve the service; choosing "Necessary only" disables these. You can change your choice at any time via the cookie banner.

12. Changes to This Policy

We will notify you of material changes to this policy by email or prominent in-app notice at least 14 days before they take effect.

13. Contact

Data protection enquiries: privacy@examladder.co.uk
Exam Ladder