Privacy Policy

Last updated: February 2026

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

We use Your Personal data to provide and improve the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

  • Account means a unique account created for You to access our Service or parts of our Service.
  • Company (referred to as either “the Company”, “We”, “Us” or “Our” in this Agreement) refers to Cognito Education Limited, Merretts Court, Rear 137 High Street, Merretts Court, Tewkesbury, Gloucestershire, United Kingdom, GL20 5JR. For the purpose of the GDPR, the Company is the Data Controller.
  • Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.
  • Country refers to: United Kingdom
  • Data Controller, for the purposes of the GDPR (General Data Protection Regulation), refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.
  • Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
  • Personal Data is any information that relates to an identified or identifiable individual. For the purposes of GDPR, Personal Data means any information relating to You such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity.
  • Service refers to the Website.
  • Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used. For the purpose of the GDPR, Service Providers are considered Data Processors.
  • Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
  • Website refers to Cognito, accessible from https://cognito.org
  • You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable. Under GDPR (General Data Protection Regulation), You can be referred to as the Data Subject or as the User as you are the individual using the Service.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

  • Email address
  • First name and last name
  • Whether You are a student, teacher, parent or tutor, and (for students) Your year group
  • The subjects, qualification levels, exam boards and tiers You study
  • Your answers to questions, including written answers, drawings You make on the answer canvas, and any screenshot You attach when reporting a problem
  • Your results and progress – marks, scores, XP, streaks and time spent studying
  • Marks and written feedback produced automatically when Your answers are marked by AI
  • What You type into the search box
  • If You subscribe, a customer reference from our payment provider. We never receive or store Your card details
  • Usage Data

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.

We may also collect information that Your browser sends whenever You visit our Service or when You access the Service by or through a mobile device.

Tracking Technologies and Cookies

We use cookies and similar technologies (including browser local storage) to run the Service and, with Your consent, to understand how it is used.

Essential technologies are necessary for the Service to work, such as keeping You signed in and remembering Your preferences. These are always on.

Analytics technologies help Us understand how the Service is used so We can improve it. If You accept analytics cookies, We use Google Analytics, Amplitude and Statsig. These store an identifier in Your browser, allow Us to recognise You across visits, and may process data in the United States under appropriate safeguards. Amplitude also records a replay of some sessions so We can see where new users get stuck; text and form inputs are masked in those recordings.

Before You make a choice, and if You decline, Google Analytics still runs in a restricted mode. In that mode it sets no cookies and no identifier on Your device, and it cannot recognise You across visits or across sessions. It sends Google an anonymous signal for each page You view, containing the page address (including any campaign information in the link You followed), the site that referred You, the time, and general information about Your browser and device. It does not include Your Cognito account ID. We use this to understand which sites and campaigns bring people to Cognito. If You accept analytics cookies, Google Analytics switches to its full mode described above.

Amplitude, Statsig, the TikTok pixel and Our own analytics record are not used at all unless You accept analytics cookies.

Always on, regardless of Your choice: We use Vercel Web Analytics to count visits, which sets no cookies and does not identify You, and Sentry to record technical errors so We can fix them. Error reports can include the page You were on, Your account ID, and the content of the request that failed – which may include text You had entered.

Marketing: if You accept analytics cookies, We use the TikTok pixel to measure whether our TikTok advertising leads to sign-ups. This sets a cookie and shares Your visit with TikTok. We do not run Google Ads tracking.

Third-party technologies: Our videos are hosted on YouTube (Google), payments are processed by Stripe (and Paddle for subscriptions started before We moved to Stripe), and signing in with Google uses Google Identity Services. Each may set its own cookies. Where We use AI to mark Your answers, this is described under Automated marking of Your answers below.

You can change Your choice at any time. If You have an account, the Analytics cookies setting is in Your account settings, under Preferences. You can also use the Cookies link in the footer of Our website.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

  • To provide and maintain our Service, including to monitor the usage of our Service.
  • To manage Your Account: to manage Your registration as a user of the Service. The Personal Data You provide can give You access to different functionalities of the Service that are available to You as a registered user.
  • To provide insight to Your School: if You are part of a school account, then We will share Your results with the school, so that your teachers can track your progress and see your homework results.

We do not sell Your personal information. We share it only with service providers who process it on Our behalf (for example hosting, analytics and payment providers), with Your school if You have a school account, and where the law requires, as described in this policy.

Retention of Your Personal Data

How long We keep Your information depends on what it is:

  • Your account details (name, email, year group, courses) are kept for as long as Your account exists.
  • Your answers, results and progress are kept for as long as Your account exists, so that You can see Your history and pick up where You left off.
  • Payment records are kept for six years after the transaction, because We are required to keep them for tax and accounting purposes.
  • Error reports are kept for 90 days and then deleted automatically.

If You delete Your account, We delete Your personal data straight away. It can take up to 30 days for copies to clear from Our backups. We may keep a minimal record of the deletion itself, and any payment records We are legally required to retain.

Transfer of Your Personal Data

Your account, Your answers and Your results are stored in the United Kingdom, using Amazon Web Services in the eu-west-2 (London) region. Our own analytics records are also stored in the UK.

Some of the services We rely on process data outside the UK, including in the United States. These are: Google (Analytics and YouTube), Amplitude, Statsig, TikTok, Sentry, Vercel, Stripe, and the AI provider that marks Your answers. Some parts of Our website are also served from servers close to You rather than from the UK, to make pages load faster.

Where personal data leaves the UK, We rely on appropriate safeguards, such as the UK International Data Transfer Agreement or the UK extension to the EU-US Data Privacy Framework, or on a UK adequacy decision where one applies. You can ask Us for a copy of the safeguards We rely on by emailing Us at the address at the end of this policy.

The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other personal information.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

  • Comply with a legal obligation
  • Protect and defend the rights or property of the Company
  • Prevent or investigate possible wrongdoing in connection with the Service
  • Protect the personal safety of Users of the Service or the public
  • Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

GDPR Privacy

Legal Basis for Processing Personal Data under GDPR

We may process Personal Data under the following conditions:

  • Consent: You have given Your consent for processing Personal Data for one or more specific purposes.
  • Performance of a contract: Provision of Personal Data is necessary for the performance of an agreement with You and/or for any pre-contractual obligations thereof.
  • Legal obligations: Processing Personal Data is necessary for compliance with a legal obligation to which the Company is subject.
  • Vital interests: Processing Personal Data is necessary in order to protect Your vital interests or of another natural person.
  • Public interests: Processing Personal Data is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Company.
  • Legitimate interests: Processing Personal Data is necessary for the purposes of the legitimate interests pursued by the Company. Where We rely on this basis, Our legitimate interests are: keeping the Service secure and preventing misuse; diagnosing and fixing technical faults; understanding which websites and campaigns bring learners to Cognito, so We can reach more students; and understanding how the Service is used so We can improve it. You can object to any processing We carry out on this basis – see Your rights below.

Providing Your name and email address is necessary to create an account and use the Service – without them We cannot provide it. Everything else, including Your year group and the subjects You choose, You give Us voluntarily to make the Service more useful to You, and You can change or remove it in Your account settings.

Your Rights under the GDPR

The Company undertakes to respect the confidentiality of Your Personal Data and to guarantee You can exercise Your rights.

You have the right under this Privacy Policy, and by law if You are within the EU, to:

  • Request access to Your Personal Data. You can ask Us for a copy of the personal data We hold about You. Where possible You can view and change it directly in Your account settings; if You cannot, contact Us and We will help.
  • Request restriction of processing. You can ask Us to pause Our use of Your personal data – for example while We look into a correction You have asked for, or an objection You have raised. We will keep the data but stop using it until the matter is resolved.
  • Request correction of the Personal Data that We hold about You. You have the right to have any incomplete or inaccurate information We hold about You corrected.
  • Object to processing of Your Personal Data. This right exists where We are relying on a legitimate interest as the legal basis for Our processing and there is something about Your particular situation, which makes You want to object to our processing of Your Personal Data on this ground. You also have the right to object where We are processing Your Personal Data for direct marketing purposes.
  • Request erasure of Your Personal Data. You have the right to ask Us to delete or remove Personal Data when there is no good reason for Us to continue processing it.
  • Request the transfer of Your Personal Data. We will provide to You, or to a third-party You have chosen, Your Personal Data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which You initially provided consent for Us to use or where We used the information to perform a contract with You.
  • Withdraw Your consent. You have the right to withdraw Your consent on using your Personal Data. If You withdraw Your consent, We may not be able to provide You with access to certain specific functionalities of the Service.

Exercising of Your GDPR Data Protection Rights

You may exercise Your rights of access, rectification, cancellation and opposition by contacting Us. Please note that we may ask You to verify Your identity before responding to such requests. If You make a request, We will try our best to respond to You as soon as possible.

We do not have a designated Data Protection Officer. If You have a question or concern about how We handle Your personal data, email Us at hello@cognitoedu.org and it will reach the person responsible for data protection at Cognito.

If You are not happy with how We have handled Your personal data, You have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. You can reach the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather hear from You first so We can put things right, but You are not required to contact Us before going to the ICO. If You live outside the UK, You can also complain to Your local data protection authority.

Automated marking of Your answers

Some question types are marked automatically using AI, so You get feedback straight away instead of waiting. For written and essay answers this produces a mark and short written feedback on what You did well and what to improve.

To do this We send the question and Your answer to our AI provider, Cerebras, which processes it in the United States. We do not send Your name, email address or account ID with it. The mark and feedback that come back are saved to Your account so You can see Your progress over time.

This is used only to give You feedback on Your work. It is not used to build a profile of You, and it is not used for advertising, remarketing, or any decision that affects You outside the Service. Marks given by Cognito are practice feedback to help You revise – they are not formal assessment, they are not shared with exam boards, and they carry no weight outside Cognito. Where Your school has an account, Your teachers can see Your results, as described above.

We do not use Your work, Your answers, or anything else You give Us to train AI models – not Ours, and not anyone else's. Your answer is sent to be marked, the result comes back, and that is the end of it.

If You think a mark is wrong, You can ask for the answer to be marked again, and You can contact Us at hello@cognitoedu.org if You want a person to look at it.

Children's Privacy

Cognito is designed for school-age students, so most of Our users are under 18. We ask for Your year group rather than Your date of birth, so We know roughly what stage You are studying at but not Your exact age.

We do not rely on Your consent to provide the Service itself – We provide it under Our agreement with You. We only ask for consent for analytics and marketing cookies. Under UK data protection law a child aged 13 or over can make that choice themselves. If You are under 13, We ask that a parent, guardian or Your school makes that choice, and is involved in setting up and overseeing Your use of Cognito.

If You are a parent or guardian with any questions about Your child's data, or You would like to access, correct or delete it, please contact Us at hello@cognitoedu.org.

If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, We may require Your parent's consent before We collect and use that information.

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the “Last updated” date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, You can contact us by email: hello@cognitoedu.org