Data protection

Who does what

Uni Admissions Prep Ltd, trading as UniGenius (company 17325935, 28 Denton Close, Barnet, EN5 3AP, United Kingdom), runs the courses and the school dashboard.

• For the class lists you import and the progress your staff see on the dashboard, your school is the controller and we process that data only on your instructions: to run your licence.
• Each pupil also has their own UniGenius account, for which Uni Admissions Prep Ltd is the controller under our privacy policy at unigenius.co.uk/privacy.
• For the GCSE English marking workspace, your school is the controller of the scripts your teachers upload; we process them only to suggest marks to your teachers.

What we hold

• Pupils: name, email, class, and their work on the courses (answers, lessons finished, mock results and when they studied).
• Teachers: name, email and school, and the order and payment record.
• A class list you import: each pupil's name, email and class, until they join.
• The marking workspace: typed scripts under aliases your teachers choose (never names or emails), suggested and approved marks and comments, and your teachers' emails.

We do not ask for dates of birth, addresses, phone numbers, or special needs or other sensitive information. We do not connect to your MIS.

Who sees it

• Whoever holds your dashboard link: each pupil's name, email, last activity, lessons, questions, accuracy, mocks and set work. Share the link only with staff who should see this.
• A class or school link shows only that class's or school's pupils.
• Pupils see their own work, never anyone else's.
• Marking workspace scripts and marks: only your department's teachers. Billing contacts see usage counts only.

We do not sell pupil data or use pupils' work for advertising.

Sub-processors

Supabase, Inc.

The database: accounts, rosters, classes, set work and progress. Where: United States (AWS, North Virginia).

Vercel, Inc.

Hosts the site and runs its servers. Where: Servers in the United States (Washington, D.C.); pages served from the nearest edge, London for UK schools.

Resend, Inc.

Sends sign-in, licence and service emails. Where: Sent from Ireland (EU).

OpenRouter, Inc.

Passes messages to Mia, the AI tutor, and written answers sent for AI marking to a company that runs a DeepSeek model, which it picks for each request. It receives the message or answer and the question, never a name or email address. Marking scripts go only to endpoints with zero data retention (see the marking pilot pack). Where: OpenRouter in the United States; the company running the model may be in the United States or another country.

Stripe

Takes card payments (teachers and finance staff only, never pupils). Where: UK, EU and United States.

Google

Sign-in, only for pupils who choose Sign in with Google. Where: Global.

Apple

Sign in with Apple, only for pupils who use the iPhone app that way. Where: Global.

Supabase, Vercel, Resend and Stripe work under their data processing agreements; OpenRouter, Google and Apple under their published terms and privacy policies. Scripts in the GCSE English marking workspace go to the AI model only through zero-data-retention endpoints; the marking pilot pack sets out each step, where it happens and what is kept. We update this list before adding a new sub-processor.

Keeping it safe

• Rosters, classes, set work and progress can be read only by our servers, never directly from a browser.
• Every page and email link uses HTTPS. Dashboard links are long secret links; make a new join code at any time if one is shared too widely.

How long we keep it

• Names on an imported class list for pupils who never joined are deleted when the licence ends or is refunded.
• When a licence ends, course access ends. Pupils keep their own accounts and work; your dashboard stays so you can export the record.
• Removing a pupil from your dashboard ends their access at once.
• A pupil can delete their account themselves at any time, which deletes their work and their place on your roster.
• Marking workspace scripts, suggestions and comments are deleted after 30, 60 or 90 days (your lead teacher chooses), or at once when a teacher deletes them. Approved marks stay for your record.
• The order, quote and payment record is kept as our sales record.

The full agreement

The data processing agreement, retention schedule and DPIA answers are in the school data pack at unigenius.co.uk/schools/data-pack.

Deletion and other requests

To see, correct or delete data, including all of your school's classes, class lists and set work, or to report a concern, email support@unigenius.co.uk with the school and the pupils concerned. We act within one month. If a breach affects your pupils' data, we tell you without undue delay.