Privacy
What we keep, and what we don't
Written twice, because a student and a tutor need different answers to the same question. Neither version is longer than it needs to be.
The short version
What we actually store about you
- Your first name — so your tutor knows whose practice is whose
- Your code — the thing in your link that gets you in
- Whether you're Foundation or Higher, and which exam board
- For each word: whether you got it right, how you were asked, and how long you took
What we never ask for, and couldn't store if we tried
- Your email address
- Your surname
- A password
- Your school, your age, your address, your phone number
- Where you are
- Anything you type that isn't a Spanish answer
There isn't a box for any of it. You don't have an account — you have a link.
Who can see it
Your tutor. That's it. Not other students — they can't even see your name. Not other tutors. We don't sell it, share it, or use it for adverts. There are no adverts.
The one number we count
On the free 43 phrases, where you have no account at all, we keep a running total of how many people got each phrase right. Not who — just a number that goes up.
It looks like this: dado que · 412 tries · 61% right. There is no list of answers, no session, no device, nothing stored about your visit and no cookie. We keep it so we know which phrases are badly explained and need rewriting.
How long it's kept
Your tutor picks: six months, a year, or two years after you stop practising. Then it's deleted — all of it, not archived somewhere.
If you want it gone
Ask your tutor to remove you. That deletes your name, your code and every answer you ever gave, straight away. You don't need a reason and you don't have to ask us.
If your tutor won't, or you'd rather ask us directly, emailhello@chuleta.co.uk and we'll do it.
Things you might reasonably worry about
Is my tutor watching me in real time? No. They see a summary — how many words you own, which ones are shaky, which sounds keep slipping. Not a live feed.
Does getting things wrong get recorded? Yes, and that's the useful part — it's how it knows which words to bring back. It isn't a grade and it isn't a mark against you.
What if someone else gets my link? Tell your tutor and they'll give you a new code in one tap. Your progress stays; the old link stops working.
Does it listen to me? Not currently. When you say a word out loud, you mark yourself — nothing is recorded or sent anywhere. If that ever changes we'll say so here first, clearly.
If you think something's wrong
Email hello@chuleta.co.uk. A real person reads it. You can also complain to the Information Commissioner's Office — the UK regulator — atico.org.uk, and you don't have to ask us first.
Last updated 24 August 2026.hello@chuleta.co.uk · Registered with the ICO, ZC111613
Your position, in one paragraph
That means the relationship with your students' parents stays yours, which is almost certainly what you want. It also means we owe you a written processing agreement under Article 28 of the UK GDPR — you'll be asked to accept one when you sign up.
What we hold
About you
- Email address — how you sign in, and how we reach you
- Display name — shown to your students as “your name's practice”
- Your settings: retention period, session length, marking preferences
About each of your students
- First name only, and their access code
- Tier and exam board
- Every answer: which word, right or wrong, task type, response time
- Per word: state, counts, when last seen
There is no field for a student's surname, email, date of birth, school or location. Not disabled — absent from the schema.
How it's protected
- Students can't reach the database. Their browser has no permission on any table. Every read and write goes through a function that re-checks their own code. A mistake in a permission rule can't expose data because there's no route to the table.
- You can only ever see your own students. Enforced in the database, per row, not in the app.
- Students never see each other's names. Each has their own code; no roster is shown.
- Hosted in the UK (London region). Encrypted in transit and at rest.
- You sign in with a link, not a password.
These are tested rather than asserted — see our impact assessment.
Children's data
Your students are children, so the ICO's Age Appropriate Design Code applies. We've completed the impact assessment it requires. Some consequences you'll notice in the product:
- No streaks, leaderboards or notifications. Deliberate — those are nudge techniques aimed at children, and we won't use them.
- No comparison between students. No ranking, ever.
- No grade. The product describes what a student knows, never scores them.
- Response time is recorded but not acted on — a slow answer might just be a distracted teenager, and acting on that would be guessing.
We ask you to confirm no student you add is under 13. Below that age the consent rules change and we're not set up for it.
How long, and deleting things
You choose: 6, 12 or 24 months of inactivity, in Class settings. After that a student and everything about them is deleted automatically.
You can also remove a student at any time from their page. That deletes their name, code and every answer immediately and permanently.
If a parent asks what you hold about their child, or asks you to delete it, you can answer and act entirely from your own screen. If you'd like it in writing, email us.
Who else is involved
- Supabase — database hosting, London region
- Vercel — serves the website. Carries no student data
- Resend — email to you. Never used to email a student
No advertising networks. No analytics inside the app. Nobody buys this data because we don't sell it.
If something goes wrong
If there's a breach affecting your students we'll tell you without delay and give you what you need to inform parents. As controller that notification is yours to make; we'll support it. Where required, the ICO is informed within 72 hours.
The mailing list
The 43 phrases at sheet.chuleta.co.uk/sheet is free and asks students for nothing at all — no account, no name, no email. Their progress stays on their own device. We deliberately do not collect a student email address at any point, because a school-age email is a child's personal data and there is no version of holding it that is worth it.
Teachers and tutors can ask us to email them the class link. If you do, here is exactly what that means:
- What we store: your email address, and — only if you typed them — your name, your school or practice, and whether you are a teacher or a tutor. Nothing else.
- Why we may store it: legitimate interests, in that you asked a supplier of a professional tool to send you that tool. You can object at any time and we will stop.
- How long: three years, then deleted automatically. Sooner if you ask.
- Who else sees it: Supabase host the database, in the EU. Resend send the email, and to do that they process your address. Nobody else, ever. It is not sold, rented, shared or used to advertise anything.
- Getting off it: one click on the unsubscribe link in any email we send. No sign-in, no reply, no reason needed. Or write tohello@chuleta.co.uk and we will do it by hand.
We keep a record that you unsubscribed rather than deleting the row outright. That is deliberate: a deleted address is one that a later import could silently add back, and the point of unsubscribing is that it sticks.
Who we are, formally
Chuleta is Mr Guillermo Pernas Chamorro, a sole trader registered with the UK Information Commissioner's Office as a data controller, reference ZC111613. You can verify that atico.org.uk — search the register for that number.
If you're ever unhappy with how your data or your students' data is handled, tell us first athello@chuleta.co.uk. You also have the right to complain directly to the ICO at ico.org.uk/make-a-complaintwithout going through us.
Last updated 24 August 2026. Questions: hello@chuleta.co.uk · ICO registration ZC111613