Maevious Learn — Privacy Policy (for parents & carers)

Last updated: 16 July 2026 · Version 1.0

Controller: Daralexion Ltd, a company registered in England and Wales (company no. 17279214), registered office 14b-14c Faversham Road, London SE6 4XF, United Kingdom.
ICO registration: ZC200234.
Contact for privacy questions: info@maevious.com.

There is also a short, child-friendly version written for young people who use the app.

1. Who we are and what this covers

Maevious Learn is a free practice app for students following the national curriculum of England. It is published by Daralexion Ltd ("we", "us"), who is the data controller for the information described here.

Maevious Learn is a parent/carer app. The account holder is an adult. Your child uses the app through a learner profile you create inside your account — your child is never asked to create their own login, and we deliberately hold as little information about your child as possible.

The online school promoted inside the app ("Our School") is operated by a separate company, Maevious Ltd, which is a separate data controller with its own privacy notice. Signing your child up to practise in this app does not sign you up to any Maevious Ltd marketing.

2. The information we collect, and why

We practise data minimisation: we collect the least we can to run the app.

About you (the parent/carer)

Data	Why we hold it	Where it lives
Email address	To create and secure your account, sign you in, and send password resets and the weekly progress summary you can turn off	Supabase Auth (EU)
Password	Stored only as a secure one-way hash — we never see it	Supabase Auth (EU)
Display name (optional)	To personalise the parent area	Our database
Your choice to receive the weekly summary	To honour your opt-out	Our database
Referral code (assigned to every account); referral count (only if you invite someone)	To run the optional invite-a-friend feature and reward you (only you, never the person you invite)	Our database
Messages you send us via "Contact & concerns"	To answer your question or concern	Our database
Reports you raise on a question	To fix bad content	Our database

We do not collect your date of birth, your address, your phone number, or any payment details in the app. If you later enrol your child in the paid Maevious online school, that payment is taken outside the app by Maevious Ltd on their website — we never see card details.

About your child (the learner profile)

We hold the minimum only:

Data	Why
A nickname or first name (your choice)	So your child can tell their profile apart from a sibling's
Year/level (e.g. "Year 8")	To show suitable topics first (it is a filter, not a lock — your child can practise below or above it)
A cosmetic avatar (emoji + colour)	Fun personalisation only; it has no effect on learning
Practice progress: which topics attempted/mastered, XP, streak	To show progress and let your child pick up where they left off

We do not collect your child's email, date of birth, precise age, location, photograph, or any way to contact your child. There is no chat, no messaging, and no user-generated content anywhere a child can reach.

Usage analytics (privacy-preserving)

We use PostHog, hosted in the EU, to understand how the app is used at an aggregate level (for example, how many practice sessions are completed). This is configured to be privacy-preserving:

events are tied to a random account identifier, never your email or name;
we never send a child's nickname, or any free text, or anything that could identify a child;
there is no automatic screen or tap capture, no session replay, and no advertising or behavioural tracking SDK anywhere in the app.

3. Our lawful bases (UK GDPR)

A fuller table is in our lawful-basis map. In summary:

Contract / provision of the service — creating your account, storing learner profiles and progress, and sending you the weekly service summary.
Legitimate interests — keeping the app secure, fixing faulty content you report, and privacy-preserving analytics to improve the app. We have balanced these against your and your child's interests and kept them narrow.
Consent — any Maevious Ltd school marketing is done only with separate, active opt-in collected by Maevious Ltd on its own website, never inside this app. You can withdraw that consent at any time.

Marketing to children is never done. Promotion of the school is parent-facing, sits behind an adult check, is clearly labelled as advertising, and is never pushed to a child's device.

4. Who we share information with (our processors)

We do not sell your data. We share it only with service providers who process it on our instructions:

Processor	What they do for us	Region
Supabase	Database, authentication, hosting	EU (`eu-central-1`)
PostHog	Privacy-preserving product analytics	EU
Cloudflare R2	Hosting lesson images/diagrams (learning content only — no personal data)	Global CDN
Resend	Sending the weekly progress email	US (transfer safeguard below)

Lesson content (not your personal data) is generated with the help of Anthropic's Claude; that process reads and writes curriculum content, not child personal data. The only user data touched by back-office review is the content-report queue you contribute to when you tap "Report a problem".

International transfers. Our database, authentication and analytics are EU-hosted. Where a processor is outside the UK/EEA (e.g. Resend in the US, or Anthropic in the US for content generation), the transfer is protected by the UK International Data Transfer Agreement / IDTA (or the UK Addendum to the EU Standard Contractual Clauses), as incorporated into that processor's data-processing agreement.

Daralexion Ltd and Maevious Ltd are separate controllers; any data passing between them (for example, confirming that a referral converted) is governed by a data-sharing agreement and you receive the normal privacy notice from whichever company you interact with.

5. How long we keep it, and deleting your data

We keep your account and your child's learner profiles for as long as your account is active.
You can delete your account and all associated data from inside the app at any time (Settings → after an adult check → Delete account). This permanently and irreversibly removes your account, every learner profile, and all progress, streak, report and concern records, cascading through our database.
Full detail is in our retention and deletion policy.

6. Your rights

Under UK GDPR you (and, where appropriate, your child) have the right to access, correct, delete, restrict, object to, and port your personal data, and to complain to the ICO. To exercise any right, use the in-app deletion for erasure, or contact us at info@maevious.com. You can complain to the Information Commissioner's Office at ico.org.uk.

7. Security

The app talks to our database only through a restricted, per-user API secured by row-level security — an account can only ever reach its own family's data, enforced by the database itself.
Administrative database keys never ship in the app.
All traffic is encrypted in transit (HTTPS/TLS).

8. Children's Code

We have designed the app to the ICO's Age Appropriate Design Code: high privacy by default, data minimisation, no nudge techniques or dark patterns, no behavioural profiling of children, geolocation off (we don't collect it at all), transparency in child-friendly language, and no detrimental use of children's data. This is documented in our internal Data Protection Impact Assessment (available on request).

9. Changes to this policy

If we make material changes we will update the "Last updated" date and, where appropriate, tell you in the app or by email.

10. Contact

Privacy questions: info@maevious.com · Daralexion Ltd, 14b-14c Faversham Road, London SE6 4XF, United Kingdom.