Privacy Notice

Identity and contact information. Your display name, email address, authentication identifiers, and the basic profile information we receive if you choose to sign in with Google.

Study profile. Your qualification, curriculum year, selected examination window, study stage, weekly study hours, and the onboarding settings and study preferences you choose.

Learning activity. Diagnostic answers and results, practice attempts, correctness and response information, study session activity, concept evidence and mastery information, Review activity, Formula Gym activity, mock examination responses, timings, flags and scores, plus your study history and the learning signals we derive from it.

Billing and access. Stripe customer and subscription identifiers, product and price identifiers, subscription status, entitlement and purchase state, and the payment event identifiers we need to keep access correct. We do not store complete payment card details. Card details are entered into and handled by Stripe.

Support and content quality. Support correspondence, question reports and any free-text comments you submit to us.

Technical and security information. Ordinary request, device, browser, IP and security information processed by our infrastructure, authentication and payment providers, and the technical logs needed for security, reliability and debugging.

Browser storage. See our Cookies and Browser Storage notice.

• directly from you, when you create an account, complete onboarding or contact us
• generated through your use of Cliro, such as answers, timings and progress
• from Google, when you choose Google authentication
• from Stripe, in connection with billing and payment events

Performance of our contract with you. To create and manage your account, provide the learning service, personalise your study direction, store your progress, deliver diagnostics, practice and mock examinations, operate Review and Formula Gym, maintain your paid access and provide customer support.

Our legitimate interests. To keep Cliro secure, prevent abuse and fraud, diagnose technical problems, maintain and improve product and content quality, investigate question and content reports, and understand service reliability. We rely on this basis only where our interests are not overridden by your rights and interests.

Legal obligation. For accounting, tax, legal and regulatory record keeping where applicable, and to respond to lawful requests.

Consent. Where an activity is genuinely optional and relies on your consent, we ask for it separately and you can withdraw it at any time. We do not currently operate a marketing consent programme.

We do not sell your personal data.

Cliro uses your study activity and performance evidence to work out what to prioritise next, which topics to revisit and when to bring material back for review. This is how the product decides what to show you.

These educational recommendations do not make decisions that produce legal effects concerning you or similarly significantly affect you.

We share personal data with service providers who help us run Cliro. They act on our instructions and are bound by contract.

• Lovable and Lovable Cloud, for application infrastructure
• Supabase, for database and authentication infrastructure
• Stripe, for payment processing and billing
• the transactional email infrastructure used to send authentication emails
• Google, where you choose to sign in with Google
• hosting and infrastructure providers required to operate the service

We may also disclose personal data where we are legally required to do so, or to establish, exercise or defend legal claims.

Some of our service providers process personal data outside the United Kingdom. Where a restricted transfer takes place, we rely on an appropriate lawful transfer mechanism where one is required, which may include UK adequacy regulations or approved contractual protections such as the International Data Transfer Agreement or Addendum.

Account and study data. Retained while it is reasonably required to provide and administer your account and the learning service.

Accepted deletion requests. Where we accept a verified deletion request, we delete or anonymise your personal study and account data, unless there is a lawful reason to retain particular records.

Payment and accounting records. Retained for the period required for accounting, tax, fraud prevention or legal purposes, which may be up to six years, or longer where the law requires it.

Support correspondence and question reports. Retained for as long as reasonably needed to resolve the issue, maintain service and content integrity, and handle any related dispute.

Platform and security logs. Subject to the operational retention periods of the relevant infrastructure provider.

Deletion from backups is not instantaneous. Where data still exists in a backup, it is not restored into active use except where required for disaster recovery.

Depending on the circumstances, you have the right to:

• access the personal data we hold about you
• have inaccurate personal data corrected
• ask us to erase personal data
• ask us to restrict processing
• object to processing based on our legitimate interests
• receive certain data in a portable format
• withdraw consent, where we rely on consent
• complain to the Information Commissioner's Office

To make a request, email privacy@cliro.co. Requests are handled manually by our team. We may need to verify your identity before we act on a request, and we will tell you the outcome.

Deleting your learning data does not remove billing and accounting records that we are legally required to keep.

If you are unhappy with how we have handled your personal data, please contact us first at privacy@cliro.co. If you remain concerned, you can complain to the UK Information Commissioner's Office at ico.org.uk.

Authentication is provided through our backend authentication infrastructure, and payments are processed by Stripe. We do not store complete payment card details ourselves. We take reasonable technical and organisational measures to protect personal data, but no online service can be guaranteed to be completely secure.