Privacy Policy

Website: yumio.co.uk

This policy explains what personal data Yumio collects, why we collect it, how we use and protect it, who we share it with, and the rights you have. It is written for students and for parents and carers. If you are under 18, you may want to read it with a parent or carer.

The short version

• Yumio is a GCSE revision website. We collect what we need to run it: your account, your learning progress, your answers and uploads, and your conversations with our AI tutor.
• We do not sell your data. We do not show adverts. We do not use advertising or analytics cookies.
• We keep the messages you send to Yumio AI and the AI’s replies as your own chat history, so you can see it and so we can keep Yumio safe. You can delete your chat history.
• We do not store every prompt to improve Yumio. We store only a randomly selected sample of prompts, with the AI’s replies, and use that sample to train and fine-tune Yumio’s own AI models. The rest of your messages are kept only as your own chat history.
• We do not use your personal data to train third-party AI models, and we do not share it with anyone so that they can train theirs.
• Many of our users are children, so we follow the ICO’s Children’s Code. Younger users get high-privacy settings by default.
• Some of our service providers process data outside the UK. When they do, we use legal safeguards.
• You can download your data or delete your account in Settings, and you can complain to the Information Commissioner’s Office (ICO).

1. Who we are

1.1 Yumio is operated by Alexandro Ghanem, a sole trader trading as Prismwell Labs, in England and Wales (“we”, “us”, “our”). We are the data controller for the personal data described in this policy. This means we decide how and why your personal data is used, and we are responsible for protecting it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.

1.2 Our details:

• Postal address: Radcliffe, Greater Manchester, UK
• Email for privacy questions: support@yumio.co.uk
• Email for legal notices and legal requests from courts, the police or regulators: legal@yumio.co.uk
• ICO registration number: registration pending

1.3 Transfer to Prismwell Labs Ltd. Alexandro Ghanem is operating Yumio as a sole trader temporarily, until a limited company called Prismwell Labs Ltd is incorporated in England and Wales. When that happens, Yumio, your account, your subscription and your personal data will transfer to Prismwell Labs Ltd, which will become the data controller. Prismwell Labs Ltd will continue to use your data only in the ways described in this policy. We will tell you before, or as soon as reasonably possible after, the transfer happens, and we will update this policy with the company’s details. The legal basis for this transfer is our legitimate interest in continuing to provide Yumio through a company, and it is also necessary to keep providing the service under our contract with you.

1.4 We do not have a formal Data Protection Officer. Alexandro Ghanem is responsible for data protection at Yumio and can be contacted at support@yumio.co.uk.

2. Who Yumio is for

2.1 Yumio is made for UK GCSE students. Most of our users are aged 13 to 19, including students in Years 10 and 11 and students aged 17 to 19 who are resitting GCSEs.

2.2 If you are 13 or over, you can sign up yourself. We ask whether you are under 13, and we use your age band to set the right privacy settings.

2.3 If you are under 13, you can only use Yumio with the verified consent of a parent or carer. We ask for their email address (which must be different from yours) and send them a link to confirm the account. Until they confirm, social and interactive features are switched off. If they do not confirm within 14 days, we close the account and delete its data. A parent or carer can withdraw consent and ask us to delete the account at any time.

2.4 If we learn that a child under 13 is using Yumio without parental consent, we will suspend the account and delete the data unless consent is given.

3. The personal data we collect

We collect the following types of personal data.

3.1 Account information. Your email address, password (stored as a secure hash, never in plain text), display name, age band, the date you accepted our terms, and two-factor authentication settings if you turn them on. For under-13 accounts, the parent or carer’s email address and whether they have confirmed consent.

3.2 Profile information (optional). Your year group, school, subjects, exam boards, tiers, target grades, study goals and email preferences, if you choose to add them.

3.3 Learning data. Lessons you complete, quiz and flashcard activity, worksheets, mock exams, timings, marks, grade estimates, streaks, your revision plan, and the data held in Memory (the mistake tracker), such as the topics and question types you find difficult.

3.4 Your answers and uploads. Answers you type, handwriting and drawings on screen, whiteboard content, and photos, PDFs or other files you upload for help or marking.

3.5 Prompts, messages and AI responses. We store the prompts and messages you send to Yumio AI, together with the AI’s responses. This includes your messages in Ask Yumio, your messages and whiteboard interactions in Teach me sessions, and marking requests (the question, your answer or uploaded work, and the mark and feedback returned). We also store short facts you ask the AI to remember about you (for example, “I’m doing Higher maths”). This is your chat history, which you can see and delete. We do not use all of it to improve our models: only a randomly selected sample is used for that. Section 5A explains why we keep this data, what the sample is, how long we keep it, and how you can delete it.

3.6 Voice and audio. Yumio does not use your microphone and does not record, store or process your voice. Some features read text aloud (text-to-speech), using your device’s built-in voice or a text-to-speech provider. Only the text to be read aloud is sent to that provider, never any audio from you.

3.7 Paper Together and ranked mode. Your display name, room activity, answers, scores, whiteboard content and chat messages in Paper Together rooms. In ranked mode, your rating, results and match history.

3.8 Parent reports and email results. Where a parent report is set up, the parent or carer’s email address and the progress information included in the report. The email address that results are sent to.

3.9 Safety and support. Reports and blocks you make or that are made about you, messages flagged by our safety filters, messages you send to support, and bug reports (including any screenshots).

3.10 Payment information. If you buy a paid plan, our payment provider, Stripe, collects and processes your payment card details. We do not see or store your full card number. We receive a customer reference, your plan, payment and subscription status, billing country, and renewal or end dates.

3.11 Device and usage data. Your IP address, browser and device type, sign-in times, pages and features used, error logs, and counters of how much you use AI features (used to apply plan limits and fair use).

3.12 Cookies and device storage. See section 13.

3.13 Information you should not give us. Please do not put sensitive or private information into chats, uploads or Paper Together, such as your home address, phone number, passwords, health information or private details about other people. If you mention sensitive information, such as information about your health, it will be stored as part of your chat history (see section 5A), but we use it only to respond to you and, where needed, to keep you safe (see section 6). We do not knowingly use sensitive information of this kind for quality review or model improvement, including the randomly selected sample described in section 5A, and we take reasonable steps to exclude it.

4. How we use your data and our lawful bases

UK data protection law says we need a lawful basis for each way we use personal data. We rely on:

• Contract: the use is necessary to provide Yumio under our terms with you.
• Legitimate interests: we have a genuine reason, such as keeping Yumio safe or improving it, and we have checked it does not override your rights. Because many of our users are children, we give their interests extra weight.
• Consent: you (or your parent or carer) have agreed. You can withdraw consent at any time.
• Legal obligation: the law requires it, for example keeping tax records.
• Vital interests: in rare cases, to protect someone’s life or safety.

5. How Yumio uses AI

5.1 Yumio uses AI to explain topics, run Teach me sessions and the whiteboard, answer Ask Yumio questions, read photos of your work, mark answers, and suggest what to revise next.

5.2 Some AI processing is carried out by third-party AI service providers acting as our processors. We send them only what is needed for the specific request, such as your question, the relevant part of your conversation, the answer you want marked or the image you uploaded. We aim not to send your email address or other account details with these requests. A list of these providers is available on request by emailing support@yumio.co.uk.

5.3 Training. We do not use your personal data to train third-party AI models, and we do not share it with third parties so that they can train theirs. We choose providers whose terms do not allow them to use the data we send to train their models. We do not store every prompt to train our own models. We use only a randomly selected sample of prompts, with the AI’s replies to them, to train and fine-tune Yumio’s own AI models, as explained in section 5A.

5.4 Automated decisions. Some things happen automatically without a person involved, such as AI marking, ranked matchmaking and ratings, usage limits, and safety filters that block messages. None of these produces a legal effect on you or a similarly significant effect. An AI mark is not an official grade and does not affect your real exams. You can ask for a person to review any automated mark or decision by contacting us.

5.5 Profiling. Yumio uses your learning data to personalise your revision, for example to track mistakes and suggest topics. This is a core part of the service, it stays inside Yumio, and we do not use it for advertising or any other purpose.

5.6 Accuracy. AI can make mistakes. Marks and feedback are guidance, not official grades. If an AI output contains wrong information about you, you can ask us to correct it.

5A. Stored prompts and AI responses

5A.1 What we store. When you use Yumio AI, we store the prompts and messages you send, along with the AI’s responses. This covers Ask Yumio, Teach me (including the whiteboard steps), and marking requests (the question, your answer or uploaded work, and the mark and feedback returned). This is your chat history: it is kept so you can see it and continue where you left off, and it is not all used to train our models (see (e) below).

5A.2 Why we store it. We keep this data to:

• a. provide the service: so the AI can reply in context, mark your work, and continue a session where you left off (contract);

• b. show your history: so you can look back at past chats, sessions and marked work (contract);

• c. keep users safe and moderate content: so our safety systems, and where needed a person, can detect and deal with harmful content, misuse and safeguarding concerns (legitimate interests; vital interests where someone is at serious risk);

• d. check quality: so we can review a randomly selected sample of answers, explanations and marks for accuracy, and fix problems (legitimate interests); and

• e. train and fine-tune our own models: we do not store every prompt to improve Yumio. We store only a randomly selected sample of prompts, together with the AI’s replies to them, and we use that sample to train and fine-tune Yumio’s own AI models (never third-party models) and to evaluate and improve Yumio’s AI features, for example by testing new versions against real questions or improving marking accuracy (legitimate interests). When we choose the sample, we remove or replace names, email addresses and other direct identifiers where possible, limit access to authorised people, and do not use it for advertising. We do not share it with third parties to train their models. The rest of your messages are kept only as your own chat history (purposes (a) and (b)) and are not used for model training.

5A.3 Your right to object. You can object to us including your prompts and AI responses in the sample used for quality review, training and fine-tuning (purposes (d) and (e)) by emailing support@yumio.co.uk. If you object, we will stop selecting your prompts and AI responses for the sample and will remove those already in it, unless we have compelling legitimate grounds, which in practice we do not expect to apply to model improvement. This will not affect your use of Yumio.

5A.4 How long we keep it. We keep your chat history (stored prompts and AI responses) until you delete it or your account, whichever is sooner. Prompts and AI responses in the randomly selected sample are kept until you delete the chat or your account, or ask us to remove them, whichever is sooner. Data that has been reported or flagged for a safety review may be kept for longer, as shown in section 10. Data that has been fully anonymised, so it can no longer identify you, is no longer personal data and may be kept after this period.

5A.5 Deleting your chat history. You can delete individual chats and sessions in Yumio where the product allows this. You can also ask us to delete your stored prompts and AI responses at any time by emailing support@yumio.co.uk. When you delete them, we remove them from your history and from our active systems within 30 days, they are removed from backups within a further 35 days, and we stop using them for quality review and model improvement. This includes any copies of those prompts and AI responses held in the randomly selected sample. A model that has already been trained cannot be changed to remove what it learned, but we will not use your deleted data to train any further. Deleting your account deletes all of your stored prompts and AI responses, and any copies in the sample, in the same way.

6. Safeguarding

6.1 Our systems check messages in Ask Yumio, Teach me and Paper Together for signs that a user may be at risk of harm, and for harmful or abusive content. If a message suggests that you or someone else may be in danger, Yumio may show you support information, including Childline (0800 1111), Samaritans (116 123) and the advice to call 999 in an emergency.

6.2 Yumio is not an emergency service. In rare cases, where we believe there is a serious risk to someone’s life or safety, we may share relevant information with the emergency services, the police or other appropriate bodies, without asking first. We would do this only where necessary and proportionate, relying on vital interests or, where it applies, the safeguarding provisions of the Data Protection Act 2018.

6.3 A small number of authorised people may review flagged or reported content to deal with safety issues. Access is limited and logged.

7. Children’s data and parental rights

7.1 We follow the ICO’s Age Appropriate Design Code (the Children’s Code). Our default settings for children are:

• High privacy by default. Profiles of users under 18 are private. School, year group and subjects are not shown to other students. Leaderboards show users under 16 anonymously.
• Limited sharing for under-16s. In Paper Together, free-text sharing features such as chat, shared notes or drawing may be limited unless everyone in the room is on the user’s friends list. If we do not know a user’s age, we treat them as under 16.
• No location tracking, no adverts, and no selling of data.
• Optional emails are off by default.
• No nudges to weaken privacy. We do not use design tricks to encourage children to share more data or turn off protections.
• Data minimisation. We collect only what we need to provide the features a child is actively using.

7.2 Under-13s. For users under 13, we rely on the consent of a parent or carer for the processing that requires consent. The parent or carer can review, change or withdraw consent and ask us to delete the account at any time by contacting us or using the link in their confirmation email.

7.3 Parent reports. Parent reports are optional. For users under 13, the parent or carer who gave consent can receive reports. For users aged 13 and over, reports are only sent to a parent or carer if the student sets this up or agrees to it, and the student can see that reports are being sent.

7.4 Who can use data rights for a child. In the UK, children aged 13 or over are usually considered mature enough to exercise their own data protection rights. A parent or carer can also make a request on behalf of a child where the child agrees, or where the child is not mature enough to understand their rights. We will always consider what is in the child’s best interests and may need to verify that the person making the request has parental responsibility.

7.5 Explaining things simply. We will explain important changes to this policy in plain language for younger users.

8. Who we share data with

8.1 We do not sell your personal data. We share it only when needed to run Yumio, when the law requires it, or to keep someone safe.

8.2 Service providers (processors). We use trusted providers who process data on our behalf, under written contracts that require them to protect it and use it only on our instructions. These include:

• Database, authentication and file storage: Supabase.
• Website and server hosting: Railway.
• Payments: Stripe (which also acts as an independent controller for some payment data, such as fraud prevention, under its own privacy policy).
• AI services: third-party AI service providers for text and image processing, and for text-to-speech (turning text into spoken audio).
• Email delivery: an email delivery provider, to send account emails, results, reminders and parent reports.

A full list of our processors, what they do and where they process data is available on request.

8.3 Other users. Information you share in Paper Together, ranked mode or other social features (such as your display name, chat messages, whiteboard content and scores) is visible to the other users in that room or match.

8.4 Parents and carers. Where parent reports are set up, we share progress information with the parent or carer, as described in section 7.

8.5 Legal and safety reasons. We may share data with the police, courts, regulators or other authorities where the law requires it, or where necessary to protect someone’s safety (see section 6). Legal requests should be sent to legal@yumio.co.uk.

8.6 Transfer to Prismwell Labs Ltd. Your data will transfer to Prismwell Labs Ltd when it is incorporated, as described in section 1.3. If Yumio is ever sold or transferred to another organisation, your data may be transferred to them, and they will be bound by this policy.

9. International transfers

9.1 Some of our providers store or process data outside the UK, for example in the European Economic Area or the United States. Our database is hosted by Supabase. You can ask us which region it is in by emailing support@yumio.co.uk.

9.2 When personal data is transferred outside the UK, we make sure it is protected by at least one of the following:

• a UK adequacy decision (also called “data bridge” or adequacy regulations), where the UK government has decided the country protects personal data to an adequate standard, including the UK Extension to the EU-US Data Privacy Framework for certified US organisations;
• the UK International Data Transfer Agreement (IDTA); or
• the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

9.3 You can ask us for more information about these safeguards by emailing support@yumio.co.uk.

10. How long we keep your data

We keep personal data only for as long as we need it. These are our retention periods:

Where the law requires us to keep data for longer, or where it is needed for a legal claim or safety investigation, we may keep it for longer than shown above.

11. How we keep your data safe

11.1 We use appropriate technical and organisational measures to protect your data, including:

• encrypted connections (HTTPS) for all traffic;
• passwords stored as secure hashes;
• optional two-factor authentication and sign-in alerts;
• access controls, so only authorised systems and people can access personal data;
• limits on repeated actions to prevent abuse;
• checks on uploaded files; and
• written contracts with our processors.

11.2 No online service can be completely secure. Please use a strong, unique password and turn on two-factor authentication.

11.3 Data breaches. If a personal data breach is likely to result in a risk to people’s rights, we will report it to the ICO within 72 hours of becoming aware of it. If there is a high risk to you, we will tell you (and, for users under 18, where appropriate, a parent or carer) without undue delay, and explain what happened and what you can do.

12. Your rights

12.1 Under UK data protection law, you have the right to:

• Access: get a copy of the personal data we hold about you;
• Rectification: have inaccurate or incomplete data corrected;
• Erasure: have your data deleted in certain circumstances;
• Restriction: ask us to limit how we use your data in certain circumstances;
• Object: object to us using your data where we rely on legitimate interests;
• Data portability: receive data you gave us in a commonly used, machine-readable format, or have it sent to another organisation;
• Withdraw consent: where we rely on consent, withdraw it at any time (this does not affect processing before you withdrew it); and
• Automated decisions: ask for a person to review an automated decision and give your point of view.

12.2 How to use your rights.

• In Settings, you can download a copy of your data and delete your account.
• You can delete individual chats, sessions, notes and flashcard decks in Yumio where the product allows this, or ask us to delete your stored prompts and AI responses (see section 5A). Deleting a chat or your account also removes any copies in the sample we use to train our models.
• You can object to your prompts and AI responses being included in the randomly selected sample we use for quality review, training and fine-tuning (see section 5A.3).
• You can change email preferences in Settings or by using the unsubscribe link in any optional email.
• You can email us at support@yumio.co.uk or write to us at Radcliffe, Greater Manchester, UK.

12.3 We may need to check your identity, or a parent or carer’s authority, before acting on a request. We will respond within one month. If a request is complex, we may extend this by up to two further months, and we will tell you why. Requests are normally free.

13. Cookies and similar technologies

13.1 Yumio uses only cookies and device storage that are strictly necessary for the service to work. Under the Privacy and Electronic Communications Regulations 2003 (PECR), we do not need consent for these, but we must tell you about them.

13.2 These include:

• yumio_session: keeps you signed in;
• yumio_refresh: renews your sign-in when it expires;
• local device storage: your sign-in tokens, theme (light or dark), whether you have signed in before, your email if you tick “Remember email”, offers you have dismissed, and unfinished drafts so you do not lose work.

13.3 Our payment provider may set its own strictly necessary cookies on its checkout pages to process payments and prevent fraud.

13.4 We do not use advertising, analytics or tracking cookies. If we ever want to use non-essential cookies, we will ask for your consent first and you will be able to refuse.

13.5 Some pages load fonts or code from other services, which can see your IP address when this happens.

13.6 You can clear cookies and site data in your browser settings, but this will sign you out of Yumio. See our Cookies page for more detail.

14. Emails and marketing

14.1 Service emails. We send emails that are needed to run your account, such as sign-in codes, security alerts, receipts, renewal reminders, results you have asked for, and important changes to our terms or this policy. You cannot opt out of these while you have an account, because they are part of the service.

14.2 Optional emails. Revision reminders, tips and product updates are off by default. We only send them if you turn them on. You can turn them off at any time in Settings or by using the unsubscribe link in any such email.

14.3 We do not send marketing on behalf of other companies, and we do not share your email address with advertisers.

15. Your right to complain

15.1 If you are unhappy with how we have handled your personal data, please contact us first at support@yumio.co.uk so we can try to put it right. We will acknowledge your complaint within 30 days and respond without undue delay.

15.2 You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

16. Exams and exam boards

Yumio is not affiliated with, endorsed by or connected to AQA, Pearson Edexcel, OCR, WJEC Eduqas or any other exam board. Yumio marks and grade estimates are guidance, not official results.

17. Changes to this policy

We may update this policy when Yumio, the law or our providers change, including when Yumio transfers to Prismwell Labs Ltd. The date at the top shows the latest version. If we make an important change, we will tell you in Yumio or by email before it takes effect, and we will explain it in plain language for younger users. Where a change requires your consent, we will ask for it.

18. Contact us

• Data controller: Alexandro Ghanem trading as Prismwell Labs (transferring to Prismwell Labs Ltd on incorporation)
• Postal address: Radcliffe, Greater Manchester, UK
• Email: support@yumio.co.uk
• Email for legal notices: legal@yumio.co.uk
• ICO registration number: registration pending
• Website: yumio.co.uk