AI Science Tutor
Privacy Notice
Version 1.0 | Last updated: 27 August 2026
This Privacy Notice explains how Mr Mark Scates, a sole trader trading as Online Science Tuition, collects and uses personal information in connection with the AI Science Tutor.
It applies to the AI Science Tutor, its account and subscription functions, and information processed when a student uses the Tutor. It does not cover separate one-to-one tuition services, which will have separate terms and privacy information.
Quick privacy summary for students and parents
• We need a username or nickname and an email address to create an AI Science Tutor account.
• We do not ask a student for their date of birth. For the AI Science Tutor, we apply child-protective privacy defaults to all users rather than asking children to provide extra age information.
• Questions, answers and supported uploads are processed to provide the Tutor. They are sent to OpenAI through its business/API services so that safety checks and AI responses can be produced.
• Ordinary Tutor conversations and uploaded files are not stored in a permanent conversation database on our WordPress website. The current browser tab temporarily stores the Tutor session so that a normal refresh does not immediately lose the session. Closing the tab ends that browser session storage.
• OpenAI does not use API inputs and outputs to train its models by default. OpenAI may retain API data for up to 30 days for abuse monitoring and, where response state is used, for up to 30 days to provide that API functionality.
• If a serious safeguarding or safety concern is detected, we keep limited metadata about the event. We do not store the student’s full message in the safeguarding log or safeguarding alert email.
• Stripe processes subscription payments. We store subscription identifiers and status information, but we do not receive or store the customer’s full payment-card number.
• We do not sell AI Science Tutor personal information or use Tutor conversations for targeted advertising.
• A student can ask a parent or guardian to help them contact us about privacy. Data protection rights belong to the individual whose information is being used.
1. Who is responsible for your personal information
Mr Mark Scates trading as Online Science Tuition is the data controller for the personal information described in this Notice.
Our contact details are set out in section 16.
2. Children, parents and age-appropriate privacy
The AI Science Tutor is designed for school science and is likely to be used by children and teenagers as well as adults.
A paid subscription must be entered into by a person aged 18 or over. If the designated student is under 18, their parent or legal guardian must enter into the paid subscription.
We do not currently ask students to provide a date of birth. Instead, the AI Science Tutor is designed to use high-privacy, data-minimising protections for all users. This includes limiting the information requested at registration, restricting account sharing, minimising safeguarding records, avoiding targeted advertising based on Tutor conversations, and limiting retention of short-lived security and usage data.
Children have data protection rights in relation to their own personal information. A parent or guardian may help a child exercise those rights where appropriate, but we may need to consider the child’s own rights and level of understanding when responding.
3. Personal information we collect
Depending on how the AI Science Tutor is used, we may collect or process the following categories of personal information:
Account information: username or nickname, email address, securely hashed password, email-verification status, account-access status, suspension status, complimentary-access status and any applicable access-expiry date.
Subscription and billing information: Stripe customer and subscription identifiers, subscription status, price identifier, whether cancellation is scheduled, current paid-period end date and the date of the latest subscription synchronisation. Payment-card details are entered into Stripe’s systems and are not stored by us as full card details.
Tutor selections and learning context: selected level, exam board where relevant, subject, science area, course or tier, topic, selected activity and question-difficulty choices.
Tutor content: questions typed by the user, answers submitted during practice or testing, AI-generated responses, and supported images or PDF files that the user chooses to upload.
Browser-session information: the current Tutor session may be stored in the browser’s sessionStorage, including the selected Tutor context, current session state, drafts, Tutor responses and response identifiers. This is used so that a normal page refresh can recover the current session. SessionStorage is specific to the browser tab and is normally cleared when that tab is closed.
Usage and security information: request timestamps used to enforce fair-use limits, timestamps of repeated restricted requests, verification-email resend timestamps, short-lived request locks, response-ownership identifiers used to prevent one account using another account’s AI response, registration-attempt information derived from the connecting IP address, and technical security logs produced by the website, hosting and firewall systems.
Safeguarding metadata: where the safety system identifies a safeguarding event, the website may store an event ID, date and time, severity level, category, Tutor activity, selected learning context, WordPress user ID and review status. The safeguarding table does not store the student’s full message, AI response or uploaded file.
Communications: information contained in emails or other communications you send to us about the account, subscription, privacy, cancellation, a complaint or support request.
4. Where the information comes from
Most personal information is provided directly by the student, subscriber or parent/guardian when an account is created, a subscription is purchased, the Tutor is used, a file is uploaded, or we are contacted.
We also receive limited subscription-status information from Stripe, and technical/security information from our website, hosting and security systems.
If a parent or guardian creates or manages an account for a student, some account information may be provided by that parent or guardian on the student’s behalf.
5. Why we use personal information and our lawful bases
We only use personal information where we have a lawful basis under UK data protection law. The basis depends on the purpose and on whether the individual is the adult customer or an under-18 student.
Creating and administering an adult customer’s account and subscription: Necessary to enter into or perform our contract with the adult customer.
Providing the Tutor to an adult who is the customer: Necessary to perform our contract with that adult.
Providing the Tutor to an under-18 designated student whose parent or guardian is the customer: Our legitimate interests in providing the educational service requested and paid for by the parent or guardian, balanced against the rights and best interests of the child. We minimise the information used and apply child-protective defaults.
Processing payments, subscription status and cancellations: Contract, and where applicable our legal obligations relating to financial and accounting records.
Email verification, account security, fair-use controls, fraud prevention and service protection: Our legitimate interests in keeping accounts and the service secure, preventing misuse and maintaining reliable availability.
AI safety checks, moderation and safeguarding controls: Our legitimate interests in operating an educational service safely and protecting users and others. In exceptional circumstances other lawful bases, such as legal obligation or vital interests, may apply where the law permits or requires this.
Responding to support, privacy, complaints and legal requests: Contract, legitimate interests and/or legal obligation depending on the request.
Keeping records needed for tax, accounting, disputes or legal claims: Legal obligation and our legitimate interests in establishing, exercising or defending legal rights.
6. AI processing and OpenAI
The AI Science Tutor uses OpenAI’s API services to carry out safety checks, moderation and generation of educational responses.
Information sent to OpenAI can include the student’s question, selected educational context, supported attachments, and information needed to continue a Tutor session. Candidate AI responses may also be checked by safety systems before they are shown to the user.
OpenAI states that data submitted through its API and business services is not used to train its models by default.
OpenAI may retain API data in abuse-monitoring logs for up to 30 days unless a longer period is required or permitted under its applicable policies. Parts of the Tutor that use retained response state may also result in response data being retained by OpenAI for up to 30 days so that a multi-step Tutor session can continue. Some safety-processing requests are configured not to retain application state, although OpenAI’s standard abuse-monitoring retention may still apply.
The AI Tutor may automatically refuse or limit a request because of safety, privacy, copyright, medical, security or fair-use controls. These controls are used to protect users and the service. They are not used to make decisions that have legal or similarly significant effects on a person.
7. Safeguarding and sensitive information
The AI Science Tutor is designed not to require personal medical information, highly sensitive personal details, passwords, payment-card details, government identification numbers or similar information in order to answer ordinary school-science questions.
Users should avoid including unnecessary personal information in Tutor questions or uploads. In particular, students should ask general curriculum-science questions rather than providing personal medical histories, test results, diagnoses or treatment details.
If a user nevertheless submits information that reveals health or other sensitive matters, that information may be processed transiently by the safety systems in order to decide whether the request can be answered safely.
For safeguarding events, our WordPress safeguarding log stores metadata rather than the student’s full message. Serious events may also generate an administrator alert email containing limited metadata and an event reference, not the full student prompt.
Where safeguarding processing involves special-category or criminal-offence information, we process it only where an appropriate condition under applicable UK data protection law is available and the processing is necessary and proportionate. We keep this information as limited as reasonably possible.
8. How long we keep information
We do not keep personal information for longer than reasonably necessary for the purpose for which it is used, taking account of legal, accounting, security and dispute-resolution requirements.
Ordinary Tutor prompts and responses in our WordPress database: We do not maintain a permanent WordPress conversation table containing ordinary Tutor prompts and responses.
Uploaded files on our website: Files are processed through PHP’s temporary upload area for the request and are not deliberately stored as a permanent Tutor-upload library on the website. Temporary upload files are scheduled for deletion as part of request handling.
Browser Tutor session: Stored in sessionStorage for the current browser tab so the session can survive a normal refresh. It is normally removed when the tab is closed or when the Tutor session is cleared.
OpenAI API data: OpenAI may retain abuse-monitoring data for up to 30 days. Response/application state used for continuing applicable Tutor sessions may also be retained by OpenAI for up to 30 days, subject to OpenAI’s current API data controls and any legal requirements.
Fair-use request timestamps: Only timestamps still capable of affecting the rolling 24-hour limit are retained; older entries are pruned.
Restricted-request timestamps: Normally retained only for the rolling one-hour control period.
Verification-email resend timestamps: Normally retained only for the rolling one-hour control period.
Response-ownership mapping: A short-lived mapping between a response identifier and the WordPress user account is retained for up to 7 days to prevent cross-account session use. It does not contain the response text.
Registration-attempt control: A non-plain-text key derived from the connecting IP address is used for a one-hour registration rate limit.
Safeguarding test events: 7 days.
Safeguarding Level 1 or 2 metadata: 30 days by default.
Safeguarding Level 3 metadata: 90 days by default.
Safeguarding Level 4 metadata: 180 days by default.
Account information: Normally kept while the account remains active. When an account is deleted, account data is removed unless some information must be retained for legal, accounting, fraud-prevention, dispute or safeguarding reasons.
Subscription, transaction and accounting records: May be retained for up to six years where reasonably necessary for tax, accounting, contractual or legal-claim purposes. Stripe may retain its own payment records in accordance with its legal obligations and privacy terms.
Support and complaint correspondence: Kept only for as long as reasonably necessary to deal with the matter and any related legal or record-keeping requirement.
9. Who we share personal information with
We do not sell AI Science Tutor personal information.
We may share or make information available to the following service providers or categories of recipient where necessary:
OpenAI: for AI moderation, safety checks and generation of Tutor responses.
Stripe: for subscription checkout, recurring payments, billing status and cancellation/customer-portal functions.
Hostinger and website infrastructure providers: for website hosting, databases, backups, network operation and related technical services.
Wordfence / Defiant and security providers: for firewall, login-security, threat detection and protection of the website.
Email and hosting providers: to deliver account verification, security, subscription and other necessary service messages.
Professional advisers, regulators, courts or public authorities: where reasonably necessary to obtain advice, establish or defend legal rights, comply with the law, or protect a person from serious harm.
10. International transfers
Some service providers used by the AI Science Tutor, including OpenAI, Stripe and security or infrastructure providers, may process personal information outside the United Kingdom, including in the United States or other countries in which they or their subprocessors operate.
Where UK data protection law requires a safeguard for an international transfer, we rely on an applicable UK adequacy regulation or appropriate contractual safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or equivalent lawful arrangements used by the relevant provider.
You can contact us if you would like more information about the safeguards relevant to a particular transfer.
11. Cookies, login data and similar technologies
The AI Science Tutor uses technologies needed for account login, security and service operation. WordPress login cookies may be required when an account is signed in.
The Tutor also uses browser sessionStorage for temporary session recovery as described in this Notice. SessionStorage is browser storage rather than a traditional cookie, but it can contain Tutor-session information until the browser tab is closed or the session is cleared.
Our separate Cookie Policy will explain cookies and similar technologies used on the website, including any non-essential services and the choices available to visitors.
12. Security
We use technical and organisational measures intended to protect AI Science Tutor information. These include authenticated accounts, email verification, role and access controls, request nonces, rate limits, file restrictions, safety checks, firewall/security tools, restricted administrator access, and minimisation of safeguarding logs.
Passwords are handled through WordPress authentication and are not stored by us as readable plain-text passwords.
No internet service can guarantee absolute security. Users should use a strong password, keep login details private, and contact us if they believe an account has been compromised.
13. Your data protection rights
Depending on the circumstances and the lawful basis used, you may have rights to ask us for access to your personal information, correct inaccurate information, erase information, restrict how information is used, object to processing, and receive certain information in a portable format.
Where processing is based on consent, you may withdraw that consent at any time. The core AI Science Tutor service is not generally based on consent as its lawful basis.
Some rights are not absolute. For example, we may need to retain information where the law requires it or where it is necessary for the establishment, exercise or defence of legal claims.
The right to object is particularly important where we rely on legitimate interests. You may object to processing based on legitimate interests by contacting us. We will consider the objection and whether we have compelling legitimate grounds to continue.
A child may exercise their own data protection rights where they are able to understand them. A parent or guardian may assist. We may need to verify identity or authority before releasing or changing account information.
14. If you do not provide information
Some information is necessary to provide the service. For example, without a valid email address and account credentials we cannot create and verify an account, and without a Tutor question or selected learning context we cannot provide the requested AI Tutor function.
Users are not required to provide unnecessary sensitive personal information, and we encourage them not to do so.
15. Changes to this Privacy Notice
We may update this Notice when the AI Science Tutor, our service providers, the law or our data-processing practices change.
The latest version will be published on the website with an updated version number or date. If a change materially affects how existing users’ personal information is used, we will take reasonable steps to bring it to their attention where required.
16. Contact details and complaints
If you have a question about this Privacy Notice, want to exercise a data protection right, or have a concern about how personal information has been used, please contact us first and we will try to resolve it.
Data controller: Mr Mark Scates trading as Online Science Tuition
Legal status: Sole trader
Business address: 155 Ford Lane, Rainham, Essex, RM13 7BA, United Kingdom
Email: markscates486@yahoo.com
Telephone: 07722 510681
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator.
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ICO helpline: 0303 123 1113
Website: ico.org.uk
If you live outside the United Kingdom, you may also have the right to complain to a data protection or privacy regulator in the country where you live, where applicable.