Privacy Policy

Effective Date: 27 February 2026

1. Data Controller

Static Carnival Technologies Limited, trading as Laila's GCSEs, acts as the data controller for your personal data for the purposes of the UK GDPR and applicable UK data protection law.

2. Information We Collect

In order to provide Laila's GCSEs, we collect and store certain categories of personal data, including:

• Account Data: Your email address and authentication-related account information, collected through Firebase Authentication.
• Study Data: Information relating to your use of the platform, including selected exam boards, subjects, topics, questions submitted, and AI-generated responses and study history stored in Firestore.
• Usage Data: Request counts and related usage information used to manage plan entitlements, Annual Pass limits, and the operation of the service.

3. How We Use Your Data

We use your personal data to operate, maintain, and improve Laila's GCSEs. This includes providing access to the service, generating study responses, tracking plan usage, maintaining account functionality, processing payments, supporting customer queries, and monitoring the performance and security of the platform.

4. Third-Party Processors

We use carefully selected third-party providers to help deliver the service. These may process personal data on our behalf, including:

• Google Firebase: For authentication, hosting, and database services.
• Stripe: For secure payment processing of Annual Pass purchases. We do not store your full credit or debit card details ourselves.
• Google Gemini API: Study questions and related prompts may be processed by Google in order to generate tutoring responses, explanations, feedback, and related study support.

5. Retention and Account Status

We retain your account and study data while your account remains active. If your Annual Pass expires, your account may revert to the free "Foundation" tier, and your existing study data will remain available unless and until you request deletion. We generally retain data until you ask for it to be deleted, subject to any lawful need to retain limited records for payment, audit, fraud-prevention, or legal compliance purposes.

If your account remains completely inactive for a continuous period of 12 months, we may begin the account deletion process. We will attempt to provide notice before permanent deletion takes place.

6. Your Rights

Under the UK GDPR, you may have rights in relation to your personal data, including the right to request access to your data, request correction of inaccurate data, and request deletion of your data, subject to any lawful exceptions. Where this functionality is available, you may also download a copy of your study data from your dashboard settings.

7. Data Security

We take reasonable technical and organisational measures to protect personal data and to reduce the risk of unauthorised access, loss, misuse, or disclosure. However, no online service can guarantee absolute security.

8. Contact Information

If you have any questions about this Privacy Policy or the way your personal data is handled, please contact us at:

• Email: graham@staticcarnival.com