Privacy Policy.

We collect the minimum information we need to plan your revision and send you WhatsApp reminders. We don't sell anything to anyone. We don't run ads. We don't share your data with marketers. The only third parties that touch your data are the ones we depend on to run the service (Google, Anthropic, Meta, Railway) — listed in section 4.

Here's the full list. If we ever add to it, this table is the first thing we update.

We do notcollect your contacts, location, photos, browsing history outside RevisionBot, or anything else from your Google account beyond what's listed above.

The legal basis under UK GDPR is contract — to provide the service you signed up for — and, in a couple of places, legitimate interestfor keeping the service secure and debugging it. We don't rely on consent except where the law specifically requires it (e.g. analytics cookies, which we don't currently use).

• Google— to authenticate you and to put events on your calendar. Google's privacy policy applies to its handling.
• Anthropic — to generate your schedule. We send a snapshot of your subjects and routine; we do not send your name, email, or WhatsApp number. Anthropic does not train on this data.
• Meta WhatsApp Cloud API — to send and receive WhatsApp messages on your behalf.
• Railway & Postgres — where our application and your data are hosted, in the EU/UK region.

We do not use third-party analytics, advertising trackers, or data brokers.

We use one essential cookie to keep you signed in. It is strictly necessary for the service to function, and so does not require a consent banner under UK law. We do not currently use any analytics or marketing cookies. If we ever add analytics, we'll ask you first.

RevisionBot is designed for GCSE students, many of whom are 14 or 15. We ask under-16s to make sure a parent or guardian has agreed before signing up. Parents can write to us at any time to:

• see exactly what data we hold about their child;
• have it corrected;
• have the account deleted in full.

We respond to these requests within five working days, usually faster.

Under UK GDPR you have the right to:

• Access — ask for a copy of everything we hold about you.
• Rectify— fix anything that's wrong.
• Erase — have it all deleted.
• Object — to specific kinds of processing.
• Portability — get a machine-readable export.

Email privacy@revisionbot.co.ukfor any of these. There's no form to fill out.

Everything moves over HTTPS. Refresh tokens for Google are encrypted with AES-256-GCM before they hit the database. Database access is locked to our application servers. We don't email passwords or sensitive data. If a breach ever happens, we'll tell you within 72 hours, as the law requires.

For any privacy question: privacy@revisionbot.co.uk.

If we don't satisfy your request, you have the right to complain to the UK's Information Commissioner's Office (ico.org.uk). We hope it never comes to that.