PrimaryHQ - Resources for Teachers

Privacy Policy

1. Who We Are

PrimaryHQ is operated by Ryan Gall, a sole trader trading as PrimaryHQ, of PrimaryHQ, C/O Unit 2, Hounsell Building, North Mills Trading Estate, Bridport, Dorset DT6 3BE hello@primaryhq.co.uk (“PrimaryHQ”, “we”, “us” or “our”). This Privacy Policy sets out how we collect, use, store and share personal data when you use the PrimaryHQ website and Services. PrimaryHQ is registered with the Information Commissioner’s Office (ICO) under registration number ZC228980. If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at hello@primaryhq.co.uk. Capitalised terms used but not defined in the Privacy Policy have the meanings given to them in the User Agreement.

2. Personal Data We Collect

Depending on how you use PrimaryHQ, we may collect the following information:

Account Information

We receive personal data directly from you when you create an Account, subscribe to the Services, contact us or use the platform.

When you create an Account, we collect your:

  • Email address
  • Name, place of employment and postcode of employment
  • Account authentication information

Your password is securely managed through our authentication provider and is not stored by us in a readable format. It is securely handled by our authentication provider Supabase. The data collected relating to your employment is collected for marketing purposes, user analytics purposes, customer support, customer segmentation, fraud prevention, understanding the educational settings using the platform and business planning.

Usage Data

We collect information about how you use PrimaryHQ, including when Generations are generated, which tools are used, generation quotas and usage limits and technical information relating to service performance and security.

Subscription and Billing Information

If you purchase a subscription, we receive information relating to subscription status, subscription plan, billing period dates and payment status. Payment card details are collected and processed directly by Stripe. We do not receive or store your full payment card details.

Worksheet Input Data

Where you enter worksheet topics, instructions or prompts, we collect the content you provide and send it to our AI provider for the purpose of generating educational materials.

Country Information

We may process limited location-related information derived from IP addresses, such as country, to verify eligibility for UK subscriptions, for security, fraud prevention, analytics and to comply with applicable tax and payment requirements. We do not otherwise track or store your precise location.

Marketing Information

If you choose to receive marketing communications, we may collect your marketing preferences, records of consent and unsubscribe requests.

3. How We Use Your Personal Data

We process personal data in accordance with applicable data protection laws and on the legal bases described in this Privacy Policy.

We use personal data to:

  • Create and manage your account;
  • Provide access to PrimaryHQ services;
  • Generate worksheets and educational content;
  • Process subscription payments and manage billing;
  • Track usage and enforce service limits;
  • Send service-related communications, including account confirmations, password resets and billing notifications;
  • Maintain, secure and improve the platform;
  • Detect misuse, fraud and security incidents;
  • Comply with legal and regulatory obligations;
  • Send marketing communications where permitted by law and in accordance with your preferences.

We do not sell your personal data, and we do not use your personal data for third-party behavioural advertising.

4. Our Legal Bases For Processing

Under UK data protection law, we process personal data under one or more of the following legal bases:

Contract

Processing is necessary for the performance of our contract with you, including creating Accounts; providing worksheet generation services; managing subscriptions and providing customer support.

Legitimate Interests

Processing is necessary for our legitimate interests in operating and improving the platform; maintaining security; preventing fraud and abuse; monitoring performance and managing our business activities. We only rely on legitimate interests where we consider those interests are not overridden by your rights and freedoms.

Legal Obligation

We process certain data to comply with legal obligations, including tax, accounting, fraud prevention and regulatory requirements.

Consent

Where required by law, we rely on your consent for marketing communications. You can withdraw your consent at any time.

5. AI-Generated Content

PrimaryHQ uses AI services provided by Anthropic to generate worksheets and related educational content on behalf of users. When you submit worksheet topics, prompts, instructions or other content through the service, that information may be shared with Anthropic solely for the purpose of generating the content you request. Anthropic acts as our data processor in relation to this processing and processes data under our instructions and in accordance with its contractual data protection obligations. Users must not submit personal data relating to children; special category personal data; health information; criminal offence data; safeguarding information; confidential information about students, parents or colleagues; or any information that is not necessary for generating educational content. The information submitted to generate worksheets should be limited to educational topics, themes and teaching instructions wherever possible.

6. Email Communications

If you create an account or interact with PrimaryHQ, we may send transactional emails relating to your use of the service, including account verification; password reset emails; subscription and billing notifications; important service updates; and customer support communications. These emails are necessary for the operation and administration of the Services and are not marketing communications. We use Resend to provide these email delivery services on our behalf. If we send marketing communications, we will do so only where permitted by applicable law and you may opt out at any time.

7. Who We Share Your Personal Data With

We use the following trusted providers to operate PrimaryHQ:

Supabase: We use Supabase to provide database, account-management and authentication services. Supabase stores your account and usage data and acts as our data processor.

Vercel: We use Vercel to host and deliver the PrimaryHQ website and application. Vercel acts as our data processor.

Resend: We use Resend to send transactional and account-related emails, including account verification emails, password reset emails and service notifications. In providing these services, Resend acts primarily as our data processor. Resend may also process certain account and service usage information as an independent controller for its own operational, security, compliance and business purposes.

Anthropic: We use Anthropic to provide AI-powered worksheet generation functionality. Worksheet prompts and instructions submitted by users may be processed by Anthropic solely to generate requested content and maintain the service. Anthropic acts as our data processor for this purpose.

Stripe: We use Stripe to process payments, prevent fraud and manage subscriptions. Stripe stores your billing information. Stripe never shares your full card details with us. Stripe may act both as a data processor and as an independent data controller depending on the processing activity involved, including fraud prevention, regulatory compliance and payment network operations.

We may also share personal data where required by law, regulation or court order.

8. International Transfers

Some of our service providers are located outside the United Kingdom and may process personal data in other countries outside the UK, including the United States and Singapore. In particular, personal data may be processed by our providers in the United States, Singapore and other countries where those providers or their approved subprocessors operate. This includes:

  • Supabase, which provides database and authentication services;
  • Vercel, which hosts the PrimaryHQ platform;
  • Anthropic, which provides AI-powered worksheet generation services;
  • Resend, which provides email delivery services;
  • Stripe, which provides payment processing and billing services.

Where personal data is transferred outside the UK, we ensure that an appropriate safeguard is in place before the transfer takes place. Some transfers may be made to countries that benefit from an adequacy decision or adequacy regulations under Article 45 UK GDPR. Where transfers are not made on the basis of an adequacy decision, we rely on one or more of the safeguards recognised by Chapter V of the UK GDPR, including:

  • the International Data Transfer Addendum issued by the UK Information Commissioner’s Office;
  • Standard Contractual Clauses approved by the European Commission;
  • the UK Addendum to the Standard Contractual Clauses;
  • the EU-US Data Privacy Framework and UK Extension to the EU-US Data Privacy Framework where applicable; and
  • other legally recognised transfer mechanisms available under UK data protection law.

Further information about the safeguards used by our service providers is available in their respective privacy and legal documentation. You may request further information about the international transfer safeguards we rely on, including a copy of the relevant contractual safeguards where appropriate, by contacting us at hello@primaryhq.co.uk.

9. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy. Typical retention periods include:

  • Account information: while your Account remains active and for up to 12 months following account closure.
  • Usage records: for as long as reasonably necessary to operate, secure and improve the service.
  • Billing and transaction records: for up to 6 years after the end of the relevant financial year to comply with tax and accounting obligations.
  • Marketing records: until you withdraw consent or unsubscribe.

We may retain information for longer where required to comply with legal obligations, resolve disputes or protect legal rights.

Generated content and worksheet prompts are not retained by PrimaryHQ unless retention is required for legal, security or operational purposes.

10. Children’s Privacy

PrimaryHQ is designed for use by teachers, educational professionals and adults. It is not intended for use by anyone under the age of 18. Children must not create accounts; use PrimaryHQ; or submit information through the platform. As PrimaryHQ uses AI, users must not enter personal data relating to children into PrimaryHQ, including names of pupils; contact details; assessment records; behavioural records; safeguarding information; health information; or any information capable of identifying a child. If we become aware that personal data relating to a child has been submitted in breach of this policy, we may delete that information and take appropriate action to protect the affected individual.

11. Your Rights

Under UK data protection law, you have the right to:

  • Ask what personal data we hold about you;
  • Request access to your personal data;
  • Request correction of inaccurate personal data;
  • Request deletion of your personal data (‘the right to be forgotten’);
  • Request restriction of processing;
  • Object to processing based on legitimate interests;
  • Object to direct marketing;
  • Ask for your data in a portable format or request transfer of your personal data to another organisation;
  • Withdraw consent where processing is based on consent.

To exercise any of these rights, email hello@primaryhq.co.uk. You also have the right to complain to the UK Information Commissioner’s Office (ICO) if you think your personal data has been handled unlawfully. The contact number for the ICO complaints team is 0303 123 1113 or you can find further information on how to make a complaint on the Information Commissioner’s Office website.

12. Cookies and Analytics

PrimaryHQ uses a small, essential cookie to keep you logged in securely. We do not currently use tracking or advertising cookies. We also use Vercel Analytics to understand how visitors interact with our website. It is cookieless and does not store any personal identifiers - it only collects anonymised, aggregated usage data such as page views. If we introduce any non-essential cookies in the future, we will request consent where required by law.

13. Security

We take appropriate technical and organisation measures to protect personal data from accidental loss, misuse, unauthorised access, alteration or disclosure. While no system can guarantee absolute security, we work with carefully selected providers who maintain recognised security standards and contractual commitments regarding data protection.

14. Changes To This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will let you know before they take effect. The latest version of this Privacy Policy will always be available on our website.

15. Contact

Questions about this policy or your data? Email hello@primaryhq.co.uk.