Privacy Policy

Who we are

JDS Vanguard Holdings Ltd (Company No. 16392512), 150 Sycamore Close, Burghfield, Reading, England, RG30 3SW, is the data controller for PassNova. We have not appointed a Data Protection Officer and are not required to. Send privacy questions to support@passnova.co.uk.

What we collect and why (UK GDPR Article 6)

Our legitimate interests are running a secure, affordable service, helping learners keep up their study, and preventing misuse. We have balanced these against your interests, taking extra care where the learner may be under 18. You can object at any time (see “Your rights”).

Newsletter. If you choose to join our newsletter — by ticking the box when you register, by choosing “Email me” while signed in to your account, or by confirming a link we email you after you sign up on our newsletter page — we will email you roughly twice a month. This is optional, we record when and how you opted in, and every issue carries an unsubscribe link that takes effect immediately. Unsubscribing from the newsletter does not affect account emails such as password resets and receipts.

Free-trial card code. To keep the Premium free trial to one per person, our payment processor Stripe gives us a code that identifies the card used at checkout. It is not your card number and cannot be used to make a payment. We keep it with the purchase record, including after you delete your account, and use it only to stop the same card starting a second free trial.

Automated decisions. We make no decisions based solely on automated processing that have legal or similarly significant effects on you. Readiness scores, adaptive practice and AI marks are study aids only.

Do you have to give us data? You need an email and a password to create an account, and payment details to subscribe. Everything else is optional. Most of PassNova can be used without an account. We do not sell your data.

Cookies and analytics

We use cookies and browser storage for sign-in and, only with your consent, for analytics (Google Analytics 4 and our own Vanguard Analytics heatmaps and session recordings). Vanguard Analytics never records what you type into forms, hides your name and email wherever they appear on a recorded page (such as the site header and certificates) and anonymises your IP address. Neither tool runs on Kids Zone pages, on Key Stage 3 course pages, or on pages that show account details (sign-in, registration, password reset, email verification, your account and dashboard, team and admin pages); see our Cookie Policy. You can manage cookie preferences via the banner that appears on your first visit, and change your choice later from the Cookie settings link in the footer.

Children and young people

PassNova is used by children and teenagers. The Kids Zone is for ages about 5 to 11, and our school-stage courses (Key Stage 2 and 3, 11+, GCSE, A-level and Functional Skills) are used by learners up to 18. We follow the ICO’s Age Appropriate Design Code (the Children’s Code), which applies to everyone under 18. In practice: we collect as little as we can, there is no advertising and no profiling for advertising, we do not sell data, and we explain things in plain language.

Kids Zone and Key Stage 3 pages

On Kids Zone pages, Kids Zone course pages, Key Stage 3 course pages and the parent pages:

• No analytics, session recording or heatmaps. Google Analytics and Vanguard Analytics never load on these pages, so there is no cookie banner either.
• No advertising.
• No account needed. A child can play and practise without giving a name, email or age.
• No chat with other people and no social features.
• A grown-up check. Links from Kids Zone pages to other websites, and to the adult parts of PassNova, ask a grown-up to answer a question first.

What stays on the device. Game progress, coins, stars, day streaks, decorated rooms, unlocked characters and parent reward goals are saved in the browser’s storage on your device only. They are not sent to us. Clearing site data deletes them. Coins and stars are pretend rewards: they cannot be bought and have no money value, and there are no purchases in the Kids Zone.

What reaches our servers. The browser asks our server for the questions, which is an ordinary web request; our hosting provider keeps short-lived technical logs (such as IP address and time) to run and secure the service. If a child practises while a parent or carer is signed in, the quiz scores are saved to that adult’s account so that the adult can see progress. The account belongs to the adult. We do not create a separate child profile.

The PassNova Kids app has its own privacy policy. It collects no personal data.

Accounts for young people (13 to 17)

• You must be 13 or over to create an account. We ask you to confirm this when you register; we cannot verify it. Under-13s can use the Kids Zone without an account. If you are under 18, please ask a parent or carer before you subscribe to Premium.
• Newsletter sign-up is off unless you tick it. We do not use your data for advertising or sell it. You can delete your account yourself at any time.
• Analytics on GCSE, A-level and Functional Skills pages. These pages use the same cookie banner as the rest of the site. Google Analytics and Vanguard Analytics (including session recordings) run only if you choose “Accept”, and you can say no without losing anything.

Nova, the AI tutor, and marked writing

• Nova is only available to signed-in accounts, so a child can use it only on an adult’s account or on the account of someone aged 13 or over.
• On Kids Zone courses, and on accounts set up for a child, Nova works in a child-safe mode: it uses simple language, it does not ask for or repeat personal details, and it tells a child who says they are unsafe or upset to talk to a trusted grown-up or call Childline (0800 1111). Photo questions are switched off.
• Marked writing. On some Functional Skills, GCSE and A-level courses a signed-in learner can send a piece of writing to be marked by Nova. The writing is sent to our AI provider, Anthropic (USA), only to produce the mark and feedback. We do not store the writing, and it is not used to train AI models. Learners should not put personal details about themselves or anyone else in their writing. The marking is automatic and can be wrong; it is a study aid, not an exam-board grade.
• What a learner types to Nova is handled in the same way: sent to Anthropic only to produce the reply, and not stored by us.

Parents and carers

• Seeing progress. A Premium account holder can see practice activity on their own account on the parent pages. We do not link it to any separate child identity.
• The weekly parent email. On Sunday evenings, Premium account holders whose account was used for practice that week may get a short summary: questions answered, accuracy and a topic to work on. It uses only the activity on your own account, it carries no advertising, and every email has a one-click unsubscribe link.
• Your rights for your child. A parent or carer can use any of the rights below on behalf of a child who cannot yet do so themselves. If a child has given us personal data without an adult’s knowledge (for example, by registering under 13), email support@passnova.co.uk and we will delete it.

Team plans

When an organisation, such as a college or employer, buys a team plan and invites you, its admins can see your activity, accuracy and progress on its courses. An admin can also ask Nova for an AI summary of your weak areas, which we store until your account is deleted. The organisation decides why it uses this information and should tell you about it.

Who we share data with

We do not sell personal data. We use the providers below. Each handles data only to provide its service to us.

We may also share data with professional advisers (accountants and lawyers) and with authorities where the law requires it.

International Data Transfers

Some of these providers are based in, or process data in, the United States. Where personal data is transferred outside the UK, it is protected by a safeguard that UK data protection law recognises: UK adequacy regulations (which cover the EU, and US companies certified under the UK–US Data Bridge), or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner’s Office, included in the provider’s data processing agreement. This applies to Netlify, Neon, Stripe, Resend, Anthropic and Google. You may ask for a copy of the relevant safeguard by emailing support@passnova.co.uk.

How long we keep data

Data	How long
Account and profile (name, email)	Until you delete your account. Deletion takes effect immediately; copies in routine backups expire shortly afterwards
Progress, practice history, study plans, certificates, saved questions	Until you delete your account
Nova messages, photos and writing sent for marking	Not stored by us. Sent to Anthropic only to produce the reply. The conversation lives only in your open browser tab
Nova usage record (date, feature, size of request)	Until you delete your account
Team AI learner summaries	Until the learner’s account is deleted
Purchase and payment records	6 years (UK tax law). When you delete your account, these are unlinked from you
Card code used to stop repeat free trials	6 years, with the purchase record
Record that an account was deleted	We keep a one-way hash of the email address and a count of what was deleted, as proof that we carried out the request
Log of emails we sent you	180 days, then deleted automatically
Newsletter subscription and consent record	Until you unsubscribe
Analytics data (Google Analytics 4)	14 months (consent required)
Heatmap and session-recording data (Vanguard Analytics)	90 days, then deleted automatically (consent required)
Support correspondence	2 years from last contact

Your Rights (UK GDPR)

Under UK data protection law you have the right to:

• be informed about how we use your data, which this policy does;
• access your data and get a copy of it;
• have wrong data corrected (you can edit most of it on your account page);
• have your data deleted. You can do this yourself at any time from your account page (“Delete my account”): it takes effect immediately and cancels any subscription;
• restrict our processing, for example while we look into a complaint;
• data portability: get the data you gave us in a machine-readable format;
• object to processing we base on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, for the newsletter (unsubscribe link), analytics (Cookie settings in the footer) or notifications. This does not affect processing we did before you withdrew.

To use any right, email support@passnova.co.uk. We reply within one month. We may need to confirm your identity. Using these rights is free.

Information for People in the United States

This section is for people in the United States and its territories. It adds to the rest of this policy and describes what we collected about you in the last 12 months, and the rights US state privacy laws give you.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Google Analytics runs without its advertising features. We do not ask for sensitive personal information such as health details, precise location or government ID; please do not put any in messages to the AI tutor.

Your rights. If you live in a US state with a privacy law, you can ask us to tell you what personal information we hold about you and give you a copy, to correct it, or to delete it, and you can ask us not to sell or share it (we do neither). You can delete your account yourself at any time from your account page. To make any request, email support@passnova.co.uk from the address on your account, so we can check it is you. We reply within 45 days, and may extend that once by a further 45 days if we tell you why. You can use an authorised agent. We will not treat you differently for using these rights. If we decline a request, you can appeal by replying to our answer, and we will respond within 60 days; if you are still not satisfied you may contact your state attorney general.

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a request not to be tracked: Google Analytics and Vanguard Analytics do not load, and no cookie banner is shown. This applies even if you accepted analytics earlier.

Records of US purchases. For US purchases we keep a record of your agreement to the renewal terms (the time, the version of the terms and your billing address) for at least three years, and the tax records the law requires. We may keep these after you delete your account where the law requires or allows it.

Age. PassNova accounts and Premium are for people aged 13 and over. If you are in the United States and think a child under 13 has given us personal information, email us and we will delete it.

Where your information is processed. PassNova is run from the United Kingdom, so information about people in the United States is sent to and handled in the UK, the United States and, for email delivery, the EU, by the providers listed in this policy.

Contact & Data Controller

Data controller: JDS Vanguard Holdings Ltd (Company No. 16392512). Email: support@passnova.co.uk.

Registered in England & Wales · Registered office: 150 Sycamore Close, Burghfield, Reading, England, RG30 3SW

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113 if you believe your data has been handled unlawfully. We would like the chance to put things right first.