Privacy Policy

Last updated: 10 May 2026

Who we are

Chuleta Labs Ltd (“we”, “us”) provides a GCSE Spanish speaking practice tool at chuleta.co.uk.

Data Controller: Chuleta Labs Ltd, a company registered in England and Wales, operating at chuleta.co.uk. For any data-related requests or questions about this policy, contact us at hello@chuleta.co.uk. We will respond within 30 days.

What data we collect

  • Account information — name, email address, and password (managed securely by Clerk).
  • Payment information — processed by Stripe. We do not store card details.
  • Educational preferences — your exam board (e.g. AQA, Edexcel) and tier (Foundation or Higher). These are stored solely to personalise the content and difficulty shown to you. Providing them is optional; you can change or delete them at any time in Settings.
  • Practice sessions— your spoken answers are sent to OpenAI’s Whisper API for speech-to-text transcription. The audio is transmitted over an encrypted connection and is not retained by OpenAI or by us after transcription completes. Only the resulting text transcript, AI feedback, and session timestamps are stored, to show you your history and generate personalised feedback.
  • Technical data — browser type, IP address, and usage logs for security and performance purposes.

Why we collect it

  • Contract performance — to provide the service you paid for (account access, question filtering, AI feedback, session history).
  • Legitimate interests — security monitoring and abuse prevention.

We do not sell your data to third parties. We do not use your data for advertising.

Third-party services

  • Clerk — authentication and account management.
  • Stripe — payment processing.
  • Supabase — database hosting (EU region).
  • OpenAI Whisper — speech-to-text transcription of your answers.
  • Anthropic Claude — AI feedback generation.
  • ElevenLabs — pre-generated examiner audio (not personalised).

Each provider processes only the data necessary for their function and is bound by their own privacy policies and data processing agreements.

Young people (under 18)

Chuleta is designed for GCSE students. The service is intended for users aged 13 and over. Users under 18 must have the permission of a parent or guardian before purchasing or using the service.

We apply the UK ICO’s Age Appropriate Design Code principles: we collect only the minimum data needed, we do not profile young users for advertising or commercial purposes, privacy settings are high by default, and we do not use dark patterns to encourage young people to share more data than necessary.

Educational preferences (exam board and tier) are ordinary personal data under UK GDPR — not sensitive data — and are collected solely to personalise practice content. Providing them is optional and you can change or delete them in Settings at any time.

Parents or guardians can request access to or deletion of their child’s data at any time by emailing hello@chuleta.co.uk. We will respond within 30 days.

Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Request deletion of your data (use the “Delete account” button in Settings, or email us).
  • Object to or restrict processing.
  • Lodge a complaint with the ICO (ico.org.uk).

Data retention

We keep your data for as long as your account is active. When you delete your account, all personal data — including session history, preferences, and account details — is permanently deleted within 30 days.

Cookies

We use strictly necessary cookies for authentication (Clerk session tokens). No tracking or advertising cookies are used.

Third-party services we use may set their own strictly necessary cookies:

Changes to this policy

We may update this policy from time to time. Significant changes will be communicated by email. Continued use of the service after changes constitutes acceptance.