Privacy Notice

Revise Computing is operated by Lloyd Stevens trading as ProgressBytes, a UK sole trader (“we”, “us”, “our”). The service is Revise Computing (ReviseComputing.co.uk).

Privacy, security and data protection contact: support@revisecomputing.co.uk.

A shorter notice for students is at /privacy-notice/student.

For people who register and use Revise Computing independently, and for ProgressBytes’ own operation of the service, ProgressBytes acts as controller.

Where a school uses Revise Computing to manage classes, assignments, teacher marking and related school-directed learning, the school will normally be the controller. ProgressBytes acts as processor for that school-directed processing, following the school’s instructions.

ProgressBytes currently treats itself as controller for the centrally operated safeguarding detection and review process, because it determines the purpose and essential means of that process. A school will ordinarily act as controller for its own safeguarding handling after safeguarding information is disclosed to it.

Depending on how you use the service, we may process:

• Account identifiers and email address

• Limited profile information (such as name)

• School affiliation and class/class-member relationships, where applicable

• Learning responses, including free-text answers and any images you submit

• Scores, self-assessment, teacher marks and feedback

• Progress and activity information

• Assignment records and related school-directed learning activity

• Subscription and limited payment-related information for paid individual plans. Card/payment details are handled by Stripe rather than stored by Revise Computing.

• Operational and security information needed to run and protect the service

• Technical information used for security and abuse prevention (for example by hosting or bot-protection providers). Revise Computing does not store IP addresses or browser fingerprints in its own application tables.

We do not ask users to provide health, ethnicity, religion or other special-category information as part of ordinary account creation or use of the learning service. Revise Computing is not intended to be used to collect this information.

However, some parts of the service allow users to submit free-text answers. ProgressBytes recognises that users may enter personal, sensitive or safeguarding-related information in these fields, including information that is unrelated to the learning activity.

We take measures to identify and appropriately handle potentially concerning content submitted through free-text answers and drawings. Further information about this processing, including its purpose and limitations, is provided in the Safeguarding scanning and review section below.

We use information to:

• Provide the learning service and keep your account working

• Save answers, scores, progress and assignment work

• Let authorised teachers see class-related work and marks

• Operate subscriptions and payments where you have a paid individual plan

• Keep the service secure, prevent abuse, and diagnose faults

• Scan free-text answers and submitted drawings for potentially concerning content, and support human safeguarding review inside Revise Computing, as described in this notice

• Communicate with you about the service, privacy or security when needed

We do not sell your personal data. We do not use advertising pixels or sell data for advertising.

Where a school uses Revise Computing to manage classes, assignments, teacher marking and related school-directed learning, ProgressBytes generally processes personal data as a processor on the school’s instructions. The school, as controller, is responsible for identifying the appropriate lawful basis for that processing.

Where ProgressBytes acts as controller, the lawful basis depends on the purpose and circumstances of the processing. The bases we may rely on include:

• Contract (UK GDPR Article 6(1)(b)) — where processing is necessary to provide a service under a contract directly with the individual, for example an eligible individual account or paid subscription.

• Legitimate interests (Article 6(1)(f)) — where necessary for purposes such as operating and securing the service, preventing misuse, diagnosing problems and carrying out the safeguarding detection and review process described below. Where we rely on legitimate interests, we consider the impact of the processing on the rights and interests of users, particularly children.

• Legal obligation (Article 6(1)(c)) — where processing is necessary for ProgressBytes to comply with a legal obligation.

For safeguarding processing for which ProgressBytes acts as controller, the current documented position is Article 6(1)(f) (legitimate interests). Where special-category data is involved, we rely, where applicable, on Article 9(2)(g) (substantial public interest) together with DPA 2018 Schedule 1 Part 2 paragraph 18 (safeguarding children and individuals at risk). Where criminal-offence data is involved, processing is subject to Article 10 and the applicable condition under UK law.

We do not rely on consent as the general lawful basis for operating Revise Computing. If a particular processing activity relies on consent, we will make this clear. Withdrawing consent does not affect processing carried out on another applicable lawful basis.

Revise Computing scans student free-text answers, and drawings submitted with answers, for defined categories of potentially concerning content, including defined urgent categories. The scan is intended to identify content that may warrant human review. It does not make an automated safeguarding determination and does not make a decision producing legal or similarly significant effects on the student. It is not comprehensive and is not guaranteed to identify every safeguarding concern.

When content is flagged, Revise Computing stores a safeguarding concern record so that authorised school staff (teachers who manage the relevant class) and ProgressBytes administrators can review it securely inside Revise Computing. Reviewers can mark a concern as reviewed or as passed to the school’s own safeguarding process, and can download a working copy for that purpose. Students cannot see other students’ safeguarding concerns.

For defined urgent categories, after the student’s answer has been successfully stored, the system can also generate an immediate safeguarding alert to ProgressBytes. A daily safeguarding report provides a secondary, backstop review. These alert emails are deliberately limited. They do not contain the student’s answer text, name, email address or school name. They contain only limited identifiers and category information needed to locate and review the relevant record securely inside Revise Computing.

Immediate and daily alert emails currently go to ProgressBytes. Authorised school staff review flagged concerns inside Revise Computing. Where a safeguarding concern requires it, information may also be shared with appropriate school staff. After that disclosure, the school will ordinarily act as controller for its own safeguarding handling.

We use carefully selected service providers to operate Revise Computing. The legal role of each provider depends on the service it supplies to us.

Material services currently used include, where applicable:

• Supabase — database, authentication, backend storage and related cloud functions

• Vercel — application hosting, server-side functions and delivery

• Sentry — error and performance monitoring, configured to minimise and scrub personal data

• MailerSend — transactional email and safeguarding alert email

• Cloudflare — Turnstile bot/abuse protection where configured

• Stripe — individual subscriptions and payments

• Namecheap — domain, DNS and email forwarding

• Google / Gmail — current destination mailbox for support, privacy and security correspondence (we do not publish the private mailbox address)

The primary production database is configured in AWS London, UK (eu-west-2). Some of our service providers and their subprocessors may process or access personal data outside the UK. Where this involves a restricted transfer under UK data protection law, the transfer must be covered by an applicable UK adequacy regulation, appropriate safeguard or other permitted mechanism.

Authorised school staff may see class-related student work where the student is in that class, including safeguarding concerns they are permitted to review. We may also disclose information if required by law.

We take appropriate technical and organisational measures to protect personal data. These include encrypted connections, authentication, role and access controls, database access controls (including row-level security), server-side authorisation, data minimisation, and monitoring with log scrubbing.

No online service can be guaranteed completely secure. Please keep your account details safe and tell us if you think there has been unauthorised access.

We keep ordinary account and learning information for as long as it is needed to provide the service, support the relevant account or school relationship, and meet applicable legal or operational requirements. We are formalising a service-wide retention schedule. Deletion is currently handled through our administrative processes rather than automatic in-product expiry.

Current normal (not statutory) safeguarding retention:

• Safeguarding alert emails: normally a maximum of 30 days

• Safeguarding concern records, evidence snapshots and flagged underlying answers: provisional maximum of 12 months from the flag, unless an active safeguarding, legal or security matter justifies documented extended retention

• Separate safeguarding review or escalation notes: normally a maximum of 12 months after closure

Payment records held by Stripe, and error events held by Sentry, follow those providers’ own retention settings.

Under UK GDPR you may have rights of access, rectification, erasure, restriction, objection, and data portability, and the right not to be subject to a solely automated decision producing legal or similarly significant effects. Which rights apply depends on the circumstances and the lawful basis.

To exercise rights about processing for which ProgressBytes is controller, email support@revisecomputing.co.uk.

Where a student’s school is the controller for school-directed processing, the student or parent may need to exercise relevant rights through the school. ProgressBytes will assist the school where required.

You can complain to us at support@revisecomputing.co.uk. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.