Privacy Policy

The 50% Club ("we", "us", "our") is the data controller for the personal data described in this policy. We provide an AI-powered ACCA exam grading and study platform. This policy explains what personal data we collect, how and why we use it, who we share it with, and the rights you have under the UK GDPR and the EU GDPR.

We collect:

• Account data — your name, email address and password (stored only as a secure hash by our authentication provider), and your role (student, tutor or admin).
• Study data — the questions you attempt, the answers you submit, the AI grades and feedback produced, your flags, drafts and the analytics derived from them.
• Organisation data — if you belong to a tuition provider, your membership of that organisation and any grade overrides or notes a tutor records.
• Billing data — subscription status and history. Card details are collected and stored by our payment provider, Stripe, not by us.
• Usage data — product analytics events (such as pages viewed and features used) and basic technical data (such as device and browser type) to help us understand and improve the Service.

We use your data to:

• provide the Service — authenticate you, store your attempts, and generate grading and feedback;
• process your answers through our AI grading provider to produce examiner-style feedback and scores;
• operate the Classroom features so tutors can see their own cohort's attempts and analytics;
• take payment and manage your subscription;
• understand usage, fix problems, improve grading accuracy and secure the Service against abuse; and
• send you service-related messages (such as sign-in links and important account or billing notices).

We rely on: performance of our contract with you (to provide the Service and take payment); our legitimate interests (to secure, analyse and improve the Service, and to prevent abuse), balanced against your rights; consent, where required (for example certain non-essential analytics), which you can withdraw at any time; and legal obligation, where we must retain records.

We do not sell your personal data. We share it only with the service providers that help us run the platform, who process it on our instructions under contract:

• Supabase — authentication, database and file storage for your account and study data.
• Anthropic — the AI models that grade your submitted answers. Your answer text is sent to be graded and feedback is returned.
• Stripe — payment processing and subscription management.
• PostHog (EU region) — privacy-focused product analytics.
• Vercel — application hosting and delivery.

We may also disclose data where required by law, to enforce our terms, or to protect the rights, safety and security of our users and the Service. If your tuition provider enrols you in their organisation, tutors of that organisation can see your attempts and analytics as part of the Classroom feature.

Some of our providers may process data outside the UK or EEA. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses to ensure your data remains protected.

We keep your personal data for as long as you have an account, and for a reasonable period afterwards where we need to for legal, accounting or dispute-resolution purposes. When you delete your account, your profile, attempts, drafts and memberships are removed; some limited records may be retained only where the law requires.

Under the UK GDPR and GDPR you have the right to access, correct, delete, restrict or object to our processing of your data, to data portability, and to withdraw consent where we rely on it. You can:

• export a machine-readable copy of your data at any time from your account settings; and
• permanently delete your account and associated data from your account settings.

You also have the right to complain to your data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk).

We use technical and organisational measures to protect your data, including encryption in transit, row-level access controls so users can only reach their own data, hashed passwords and restricted administrative access. No system is completely secure, but we work to protect your information and to respond promptly to any incident.

The Service is intended for users aged 16 and over and is not directed at children under that age. We do not knowingly collect data from children under 16.

We may update this policy from time to time; we will change the "last updated" date and, for material changes, take reasonable steps to notify you. For any privacy question or to exercise your rights, contact us at privacy@the50percentclub.com.