Privacy Notice | The Bearded Tutor

Who is responsible for your data

The website, practice platform and resource shop are run by Martin Hill, trading as The Bearded Tutor. Martin is the sole tutor and the person responsible for your data — there is no separate company or team behind this site.

If you have any question about your data, or want to use any of the rights below, email martin@thebeardedtutor.com. That is the fastest way to reach Martin directly.

Access to your account

The UCAT practice platform is invite-only. Martin sends students an invitation to the email address he already has as their tutor; accepting it creates the student account. Signing up for student practice without an invitation is switched off.

Teachers can create or access a resource account from the resource shop. A buyer-only account provides access to its private purchase library and downloads; it does not provide access to UCAT student practice.

What we collect

We keep this as small as we reasonably can. This section itemises the practice data stored about a student — the platform records a fair amount about how you think and work through a question, so we want to say that plainly rather than bury it in vague language.

Your account

Your name.
Your email address (used to send you a one-time login link — see “How you sign in” below).
Your target exam date, if you choose to set one — this is optional and only used to show you a countdown.
Your account role (student, resource buyer, tutor or administrator) and the date your account was created.

How you sign in

There is no password to remember or store. You sign in with a one-time “magic link” emailed to you, which Supabase (our authentication provider — see below) issues and verifies. We don’t hold a password for you because one is never created.

Every question you answer

For every practice question you attempt, we record:

The answer you gave.
How long elapsed between our server sending the question and receiving your answer. We use the start time recorded by our server rather than trusting a duration sent by your device.
How confident you said you felt about your answer (not confident / fairly confident / very confident) — you’re asked this after every question.
If you got it wrong, the reason you tell us yourself — we ask you to tag your own mistake as one of: misread the question, misread the data, a gap in understanding, a calculation slip, running out of time, falling for a trap answer, changing your answer, guessing, or “other”.
Whether the answer was marked correct, and your score.
The date and time you answered, and which practice session and topic the question belonged to.
Automatic flags the system may add to an attempt — for example, if you answered implausibly quickly, or if you said you were very confident but got it wrong. These help Martin spot patterns (or technical glitches); they are not shown to you as a judgement.
Whether you flagged a question for your own review during the session (separate from reporting a question as wrong or unclear — see below).

Your practice sessions

We record when each practice session started and finished, what kind of session it was (for example, a general drill or one recommended for you), and which questions were served to you and when.

Drill recommendations

Based on your practice history, the platform works out which topics you’d benefit from practising more, and stores that recommendation (and whether you’ve seen, done, or dismissed it) so it can suggest useful practice next time you log in.

Question reports

If you flag a question as wrong, confusing or broken, we store the reason you give, linked to your account and to the specific attempt, so Martin can review and fix it.

What we do not collect

The UCAT practice platform does not ask for your date of birth, school, address, or any health information. A resource purchase separately requires country and billing information through Stripe, as explained below. We don’t use advertising or analytics cookies — the only cookie the platform sets is the one that keeps you logged in, which is strictly necessary for the site to work. The signed-in practice platform has no analytics at all. The cookieless page counts used on public marketing pages are explained separately below.

Why we collect it

The practice data above is used for these purposes:

To show you your own progress — your dashboard and progress pages are built directly from the data above, so you can see your accuracy, pace and where you’re improving.
To let your tutor teach you better. Martin can see your individual results — every answer, your timing, your confidence ratings and your self-tagged mistakes — so he can target sessions at what you actually need. You should not be surprised by this: it is the whole point of the platform, and it works the same way a marked homework book would, just with more detail.

We also use your practice history, in aggregate, to work out which questions are too easy, too hard, or badly worded, so the question bank keeps improving for everyone.

Who else sees it

We do not sell personal data, use it for advertising, or share it with unrelated third parties. The service providers named below receive only the data needed to do their specific jobs.

A small number of service providers process data on our behalf, strictly to make the platform work. Each only does the specific job below:

Supabase — hosts our database, private resource-file storage and sign-in. Practice records, enquiries and resource order records are stored in a Supabase database in Ireland (the “eu-west-1” region), inside the European Economic Area. Supabase also issues and verifies your one-time login link.
Vercel — hosts the website itself: it serves the pages you see and runs the platform’s server code. It also provides the limited, cookieless public-page analytics described below.
Google Workspace — sends the login-link emails, from Martin’s @thebeardedtutor.com address. It sees the email address a login link is sent to, for that purpose only.
Stripe— provides the resource-shop checkout, processes payment and helps prevent fraudulent payments. Stripe receives the buyer’s name, email address, billing address, delivery/postal address and payment-card details. The Bearded Tutor receives Stripe references, billing- and delivery-country evidence and payment status, but does not receive or store the full card number or security code. Stripe may also process information to meet its own legal and regulatory duties; see Stripe’s privacy policy.

Cookieless analytics on public marketing pages

We use Vercel Web Analytics to count visits to the public home page, resource-shop page and public product pages. This is only to understand whether people find and read those pages. We do not set analytics cookies, track you across other websites, record clicks or form interactions, and no page view is sent from login, account, checkout, private resource-library, practice, progress, session, review, student or tutor pages.

For an accepted page view, we send only the canonical page address (with any query string or fragment removed). Vercel adds standard page-view context such as the time, referring site, browser, operating system, device type and approximate location. It derives a short-lived visitor identifier from request data rather than setting a cookie; the identifier resets every day, so it cannot follow a visitor from one day to the next. We do not add a name, email address, account identifier or UCAT practice activity to analytics data, and we do not send custom analytics events. Analytics data is available to Martin in aggregate for the rolling retention period included with Vercel Pro.

A control below the footer on each measured public page lets you turn these page counts off. The choice is stored only in your browser’s local storage so it applies when you return; it is not sent to Martin or Vercel. We also honour Global Privacy Control and Do Not Track browser signals automatically. This limited audience measurement is intended to use the statistical purposes exception in UK storage-and-access rules, while still giving every visitor a simple, free way to object.

How long we keep it, and how to get it deleted

While you’re an active student, we keep your account and practice history so your progress and your tutor’s view of it stay accurate and complete.

There is no automatic deletion after a period of inactivity. We keep your account and practice history for as long as your account exists. You're in control of when it ends: you can delete your own account at any time from Account in the menu at the top of the page once you're signed in. You'll be asked to type a confirmation first.

When an account is deleted, it's closed straight away: you're signed out and can't sign back in. Everything that hangs off it (your practice sessions, every answer you've given, your drill recommendations and any question reports you've made) is kept for 30 days in case the deletion was a mistake. Within those 30 days Martin can reopen the account if you ask him. After 30 days it is all deleted automatically and permanently, together, with no separate step needed. You can also ask for your account to be deleted by emailing martin@thebeardedtutor.com, and if you need it deleted sooner than 30 days, say so.

After that final deletion, a restricted disaster-recovery backup may keep a copy until its normal 14-day retention period ends. Backups are not used during normal operation and access is limited to Martin. If scheduled cleanup cannot run, an overdue snapshot is removed on the next successful backup run. If a backup ever has to be restored, deleted accounts are deleted again before the platform is reopened to students. To make that possible, we keep a note that an account was deleted: an internal reference number and the dates, with no name or email.

Resource-order, payment-reference and cancellation-waiver records are different from practice history. They are not automatically erased with a practice account because Martin may need to retain core transaction records for tax, accounting, consumer-rights or legal-claim purposes. They are kept only for as long as those purposes require; information that no longer needs to be retained should be deleted or minimised.

Your rights

Under UK data protection law, you can ask us to:

Show you the personal data we hold about you.
Correct it, if anything is wrong or out of date — your name and target exam date can be changed yourself in your account; anything else, email Martin.
Delete it — see “How long we keep it” above. This right may be limited where a legal obligation requires a financial transaction record to be retained.
Restrict or object to how we use it.

To use any of these rights, email martin@thebeardedtutor.com. If you’re unhappy with how we’ve handled your data and we haven’t resolved it, you can complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO).

If you’re under 18

Students using this platform are 14 or over, and most UCAT practice students are 16 to 18. A parent or guardian can have their own view-only login to see their child's classroom work; see "Your private classroom and subject access" below. If you're a parent or guardian and you have any question about what we hold on your child, or want anything changed or deleted, you're welcome to contact Martin directly at martin@thebeardedtutor.com. You don't need to go through your child to do this.

If you send an enquiry through the website

This section covers the “Send your enquiry” form on the main Bearded Tutor site, which anyone can use to ask about tutoring — most people who fill it in are prospective parents or students, not platform users, and some are not students at all yet.

When you submit that form, we store:

Your name and email address.
Your phone number, if you chose to give one — it’s optional.
What you’d like help with, if you picked a subject (or the UCAT platform) from the dropdown — also optional.
The message you typed.
The date and time you sent it.

We store this only so Martin can read and reply to your enquiry. We do not use it for marketing, we will not add you to a mailing list, and we will not contact you about anything other than the enquiry itself unless you separately agree to that — for example, by becoming a student. Only Martin can read enquiries stored on the platform. The same Supabase database and Google Workspace email account described in “Who else sees it” above are used to store your enquiry and to email Martin that it has arrived; no other service sees it.

A daily automatic sweep deletes the website’s database copy once it is more than 30 days old. The form also emails a copy to Martin’s Google Workspace account. That emailed copy is kept with his ordinary business correspondence while he deals with your enquiry. If you become a client, the relevant correspondence may be kept for longer as part of that ongoing client relationship; at that point it is no longer kept simply as an enquiry. You can email martin@thebeardedtutor.com at any time to ask what Martin holds about you or ask for it to be deleted.

If you buy a resource

The resource shop is for UK customers. Stripe collects the buyer’s name, email address, payment details, billing address and a delivery/postal address during checkout. Checkout restricts the delivery country to the United Kingdom, and the verified payment notification checks both billing and delivery countries before granting access. The Bearded Tutor’s order record stores the billing- and delivery-country evidence needed to enforce UK-only sales; the full addresses and payment-card details remain with Stripe.

For each checkout and completed order, we record:

The resource bought, amount paid and currency.
The buyer’s email address and account identifier.
Stripe’s checkout, customer and payment references, and whether the order is pending, paid, cancelled, rejected, fully refunded or finally reversed.
The billing- and delivery-country evidence used to keep checkout UK-only; Stripe also retains the full billing and delivery addresses supplied at checkout.
Whether and when the buyer expressly consented to immediate digital supply and acknowledged losing the 14-day cancellation right, together with the version of that wording.
When the order was created and last updated.

We use this information to take and reconcile payment, enforce the UK-only sales boundary, provide the purchased download to the correct buyer, handle full refunds or final payment reversals, evidence the buyer’s cancellation acknowledgement, prevent misuse and keep required business records. We do not use purchase details to add buyers to a marketing list.

Download files are held in a private Supabase Storage bucket. The permanent storage address is not public. After an authenticated buyer’s order is checked, the site issues a short-lived signed download link; possession of an expired or unsigned address does not provide access.

Core order and payment records may need to remain after download access or a practice account ends, for the tax, accounting and legal purposes explained above. You can ask what purchase data is held, correct an error, or request deletion by emailing martin@thebeardedtutor.com. Martin will delete information that is no longer needed, but may have to retain the minimum transaction record where the law requires it.

Your private classroom and subject access

The classroom is where Martin sets your homework, you do it online, and he marks it. It is for students aged 14 and over. Martin confirms your age when he invites you; we don't ask for your date of birth.

What we keep: your name and email address, the subjects you can use and when that access ends. For each piece of homework, we keep what was set and when it is due, your answers and working, numbers and units, the choices you picked, files and photos you upload, and when you saved and turned it in. When you turn work in, we keep a copy exactly as it was; later edits don't change that copy. We also keep your marks, whether a mark was checked automatically, Martin's feedback, and the messages between you and Martin in the classroom.

Some answers, such as a number with its unit or a multiple-choice answer, are checked automatically against a private mark scheme. Those marks are provisional until Martin has checked them. Martin marks written answers himself. You never see the private mark scheme or model answers. Reading checks work differently: the site marks each answer straight away, those marks are not provisional, and once you have used your tries you see the right answer and a short reason.

In a reading check you read a short section of your lesson notes, then answer a few questions with the text hidden. For each reading check we keep your answers, including your first try and your second try if you have one, whether each answer was right, and when you opened each section, finished reading it, answered each question and sent your answers. Martin can see all of this. A parent or guardian Martin has linked to your account sees your reading-check marks, how long you spent reading and answering each section, how long each question took, and whether you needed to re-read a section, only after Martin has returned the check.

Martin also uses your reading-check results to find topics you find hard. The site sorts each topic into secure, shaky or gap using your first try at each question, and keeps how that changes over time, so Martin can plan your lessons and set you revision. The site only suggests revision to Martin; he decides what to set. This summary is only for Martin: parents or guardians and other students can't see it. It is deleted with your account, like the rest of your classroom work.

Martin can also switch on daily revision for you. It is a short set of about six questions a day, which you can do on your phone, taken from reading checks Martin has set you and you have already done. Each day's set opens at 6am and closes at midnight, UK time, from Monday to Friday, and at weekends too if Martin turns that on. You can only do each day's set on that day: a missed day can't be made up later, and the next day's set can't be done early. Martin decides whether daily revision is on, but the site picks each day's questions itself: mostly from your latest lesson, some from earlier lessons when they are due to come back, and more of the questions you got wrong or found hard before. Daily revision is marked in the same way as reading checks.

Martin can choose daily maths for you instead. It works in the same way, with about five questions a day, but the questions come from a bank of GCSE maths questions written for daily practice, at the tier Martin sets for you (Foundation or Higher), so you don't need to have done a reading check first. The site picks them from across the course, more often from any topics Martin asks it to focus on, and brings back questions you got wrong.

Martin can also choose daily science for you instead. It works in the same way, with about five questions a day, but the questions come from a bank of GCSE science questions (biology, chemistry and physics) written for daily practice, at the tier Martin sets for you (Foundation or Higher), so you don't need to have done a reading check first. You have one set a day, from one of these. The site picks the questions from across the course, more often from any topics Martin asks it to focus on, and brings back questions you got wrong.

For daily revision we keep which questions you were given each day and why the site chose them, your answers (your first try, and your second try if you have one), whether each answer was right, when you started each day's set and when you answered each question, and each day's score. We also keep whether daily revision is switched on for you, whether it includes weekends, and when that was changed. Martin can see all of this, including a calendar of the days you did and missed, how long each day took and how many days in a row you have done it. A parent or guardian Martin has linked to your account sees the calendar of days you did and missed, each day's score, how many days in a row, and for each question how long it took and whether each try was right, but not the questions or your answers. Daily revision sends no reminders, emails or notifications, and adding it to your phone's home screen doesn't store anything extra about you. It is deleted with your account, like the rest of your classroom work.

For daily maths we also keep your tier, any topics Martin has chosen to focus on, and when these were changed. Everything else about daily maths is kept, shown and deleted in the same way as daily revision.

For daily science we also keep your tier, any topics Martin has chosen to focus on, and when these were changed, in the same way as for daily maths. Everything else about daily science is kept, shown and deleted in the same way as daily revision.

Who can see your work: you, Martin, and any parent or guardian Martin has linked to your account. Other students can't. Martin can also see classroom records through the site's admin tools. Live-lesson notes are the exception: they are private to you, and not visible to Martin or to parents or guardians. Supabase stores the site's database and files for us, in Ireland.

A parent or guardian can have their own login to see your work. It is view-only. They can see your homework, what you have turned in, and your marks and Martin's feedback once he has returned them. If you have daily revision, they also see which days you did or missed it, each day's score and how many days in a row, straight away, without Martin returning anything. They can't change anything, turn work in, see work you haven't turned in yet, or read your messages with Martin. Your classroom page always shows the name of every parent or guardian who can see your work. Only Martin can add or remove one. If you are 18 or over, Martin will only add a parent or guardian if you agree.

For a parent or guardian's login we keep their name, their email address and which student's work they can see. They can delete their login at any time from its Account page, and it is deleted straight away. That does not affect the student's account or work.

Photos you upload through the classroom page are cleaned in your browser first, to remove hidden details such as where the photo was taken. That can't remove anything you can see in the picture itself, so upload only your schoolwork: no home addresses, medical details or photos of other people. PDFs and Word files are kept exactly as they are and can hold hidden details, such as the name of whoever made the file. Files are not scanned for viruses, so please tell Martin if a file looks wrong.

When your tutoring ends, Martin removes you from his class. That stops new homework, uploads and messages, but it doesn't delete your earlier work. That stays until your account is deleted. Removing you from the class also switches off daily revision.

You can delete your account yourself from the Account page, or ask Martin to delete it. A parent or guardian can ask Martin too. Your account is closed straight away: you are signed out, you can't sign back in, and any parent or guardian login stops showing your work. We keep your work for 30 days in case the deletion was a mistake; in that time Martin can reopen the account if you ask him. After 30 days, your account and everything in it are deleted automatically and permanently: homework answers, uploads, marks, feedback, messages and any practice history. If you need it deleted sooner, ask Martin.

After that final deletion, copies can stay in the site's private backups until those backups expire, normally within 14 days. If a backup run is missed, an old copy is removed at the next successful run. Backups don't include uploaded files. If a backup ever had to be used, deleted accounts would be deleted again before the site reopened. So that this is possible, we keep a note that the account was deleted: an internal reference number and the dates, but not your name or email.

If you choose to take notes in a live lesson, we keep your typed notes and your own drawings with your student account, linked to the lesson and slide, and when you last saved them. Only you can read these notes through the site: your tutor, parents or guardians and other students cannot. You can delete a lesson's notes or download a copy with the slides. Your tutor's live drawings are not stored. Closing your account immediately stops access to your notes, and they are deleted with the account after the same 30-day recovery period described above. The same backup rules apply. Copies you download remain on your device until you delete them.

The classroom has no advertising, marketing, location tracking or public profiles. Your classroom work and messages aren't used to recommend things to you or to train AI. The only exception is the reading-check summary described above, which Martin uses to choose revision for you. Daily revision, described above, is a second exception: the site uses your reading-check and daily revision answers to choose each day's questions for you. UCAT practice data is described in the sections above.

Changes to this notice

If how we handle your data changes, we’ll update this page and change the “last updated” date at the top. For anything significant, we’ll aim to let existing students know directly rather than relying on you to check back.

How we look after your data.