Privacy Policy — FS Maths

Effective date: August 2026 · Version 1.1

This Privacy Policy explains how Functional Skills Maths ("we", "us", "our") collects, uses, and protects personal data when you use our website and services. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Functional Skills Maths (functionalskillsmaths.online) is an online educational platform provided by Developing Maths Ltd, offering Functional Skills Maths revision resources including past papers, level assessments, and practice examinations.

For data protection purposes, Developing Maths Ltd is the data controller. If you have any questions about how we handle your data, please contact us at: phil@developingmaths.co.uk

2. What Data We Collect

Account information

Username (chosen by you or provided by your teacher)
Email address (optional)
Password (stored as a secure, irreversible hash — we cannot see your password)
Account creation date
Account role (pupil or teacher)

Assessment data

Assessment scores and percentage results
Level recommendation (Level 1 or Level 2)
Topic-by-topic scorecard results
Time taken to complete each section
Date and time of each assessment attempt

Technical data

IP address (used for rate limiting to prevent abuse — not stored long-term)
Browser type and device information (standard server logs)

Payment information

If you purchase a subscription, past papers, or a 1-to-1 tutoring lesson, your payment is handled entirely by Stripe, our payment processor. We never see or store your full card number — Stripe passes us only a confirmation that payment succeeded, along with your name and email address so we can activate your access or booking. See Stripe's own privacy policy for how they handle your payment details.

We do not collect your card number, location data, or any other sensitive personal data.

3. How We Use Your Data

We use your personal data only for the following purposes:

To provide and maintain your account
To save your assessment results so you can track your progress over time
To allow your teacher (if applicable) to view your assessment results
To prevent abuse of the service (rate limiting)
To communicate with you about your account if necessary

We do not use your data for advertising, profiling, or sell it to any third parties.

4. Legal Basis for Processing

Under the UK GDPR, we rely on the following legal bases:

Contract performance — processing is necessary to provide the service you have signed up for
Legitimate interests — to maintain the security of the service and prevent abuse
Consent — where you have provided your email address voluntarily

5. Children's Data

We recognise that some users of this platform may be under the age of 18. If you are a teacher or educational provider creating accounts for pupils, you are responsible for ensuring you have the appropriate authority to do so under your organisation's data protection policies. Pupil accounts should be created only with appropriate consent and in compliance with your organisation's safeguarding obligations.

We do not knowingly collect data directly from children under 13. If an account is created for a child, this must be done by a teacher or responsible adult.

6. Who We Share Your Data With

We do not sell or rent your personal data, and we never share it with third parties for their own marketing purposes. Your data is shared only with:

Your teacher — if your account was created by a teacher, they can view your assessment results and account details
Supabase — hosts our database and handles account authentication (password storage, login sessions). Your account details and assessment results are stored on Supabase's infrastructure.
Stripe — processes payments for subscriptions, past papers, and tutoring bookings. See "Payment information" above.
Cloudflare — hosts the website itself and the backend services (Pages, Workers) that power it, including standard web-server logs (IP address, request timing) used for security and abuse prevention.
Google Analytics — collects anonymous usage statistics, but only if you accept analytics cookies via the cookie banner. See "Cookies" below.
Legal requirements — if required by law or a court order

Each of these providers only processes your data to the extent needed to provide their service to us, and is bound by its own data protection obligations.

7. Data Storage and Security

Your data is stored securely on our servers. We implement the following security measures:

Passwords are hashed using bcrypt — they cannot be recovered or read by anyone
Authentication uses time-limited tokens (JWT) that expire after 30 days
Login attempts are rate-limited to prevent brute-force attacks
Access to teacher and administrative functions is restricted by role

While we take reasonable steps to protect your data, no online service can guarantee absolute security. Please use a strong, unique password.

8. How Long We Keep Your Data

Account data — kept for as long as your account is active
Assessment results — kept for as long as your account is active
Server logs — typically retained for 30 days

If you request deletion of your account, all associated personal data will be permanently removed.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access — you can request a copy of the data we hold about you
Right to rectification — you can ask us to correct inaccurate data
Right to erasure — you can ask us to delete your account and all associated data
Right to restrict processing — you can ask us to limit how we use your data
Right to data portability — you can request your data in a portable format
Right to object — you can object to processing based on legitimate interests

To exercise any of these rights, contact us at phil@developingmaths.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have handled your data unlawfully.

10. Cookies

We use the following cookies and similar technologies:

Essential

Authentication tokens are stored in your browser's local storage to keep you logged in. These are strictly necessary for the service to function and cannot be disabled.

Analytics (Google Analytics) — opt-in only

We use Google Analytics to collect anonymous information about how visitors use the site — for example, which pages are visited most often and how long people spend on each page. This data helps us improve the service and does not identify you personally.

Analytics is off by default. The Google Analytics script itself is not even loaded until you click "Accept" on the cookie banner shown on your first visit — if you click "Reject", or don't respond, no analytics data is sent to Google at all.

You can change your choice at any time:

Click here to manage your cookie preference and show the banner again.
Or install the Google Analytics Opt-out Browser Add-on for a browser-level opt-out.

We do not use advertising cookies, social media tracking cookies, or any cookies that build a profile of you for marketing purposes.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any significant changes by updating the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact:

Developing Maths Ltd
Email: phil@developingmaths.co.uk