01Privacy at a glance
ScotRevision helps you revise for Scottish qualifications. Your questions, answers and course choices can be personal information. Only share what you need for revision. Leave out full names, school details, addresses, passwords and private information about other people.
Chat, files, test creation and Mark my work require a signed-in account. Each account includes five AI prompts per day, resetting at midnight UK time. Account registration is available when account services are connected. AI replies are made using an external AI service, so what you send is not kept only on your device.
You can ask us about your data, request deletion or raise a concern at [email protected]. If anything here is unclear, ask a parent, carer or trusted adult to help you read it.
02Who is responsible
Edward Tait, trading as ScotRevision, is the controller responsible for the personal information processed through ScotRevision. Contact [email protected] for privacy questions, rights requests or complaints.
This notice covers the ScotRevision website and workspace. It does not cover the independent websites you visit through links to past papers or other sources.
03What information we use
- Account details: your verified email, chosen name, school or college (or home education), year group, date of birth and record of accepted terms. Supabase provides authentication and private account storage when connected. Date of birth checks the minimum age of 13; school and year group describe your learning context. These fields do not give a school, parent or teacher access to your account. We do not add your school or date of birth to AI requests.
- Revision content: messages, replies, course and subject choices, the conversation context needed to answer, and explicit saved memory notes. Your selected display name and response preferences may be included with a request.
- Files, where access is enabled: file names, types, sizes, extracted text and normalised images or document pages used to answer or mark work. Unsigned visitors cannot upload files. Original files are processed temporarily; the service stores processed evidence with the conversation.
- Device preferences: profile details you enter, an optional profile picture, appearance, accessibility and notification preferences, selected subjects, local chats, test settings and timetables. These are stored in your browser. Signed-in subject choices, settings, test setups and timetables also sync to private account storage. Profile pictures remain on the device. A device profile field is separate from your verified sign-in email.
- Service and security data: a random session identifier, request timing and error information, and your connection’s IP address while requests are handled. A daily prompt count and its date are stored against your account ID. The allowance record does not store your IP address. Short-lived abuse counters use keyed hashes of network, account or email identifiers. We store login activity times to enforce inactivity and maximum login limits.
- Family and learning: optional account links and their approval state, chosen study limits, homework questions and schedules, submitted answers, AI practice feedback and topic summaries. Approximate active study time is counted from occasional activity signals while the page is visible and recently used. We do not record keystroke contents, screens or other websites.
- Contact messages: the information you send us by email and our replies, so we can respond and keep an appropriate record.
Student sign-up requires email, name, school or home-education status, year group and date of birth. Parent sign-up requires email, name and date of birth. Profile pictures, optional preferences and files are optional. You can browse the overview without sending a question. Chat needs your message and the session and connection information used to deliver and limit requests; without that information we cannot provide account chat.
We do not need health information, diagnoses or other sensitive information to provide ordinary revision support. Do not include it in messages or files unless you have a specific reason to do so. We do not infer ability from a disability or support need.
04Why we use it
| Purpose | Information | Legal basis |
|---|---|---|
| Provide the revision features you request and remember your settings | Revision content, course choices, session and preferences | Performance of our agreement with you, or steps you request before entering it |
| Protect the service and enforce the free allowance | Session, hashed network identifier, prompt count and limited technical data | Legitimate interests in preventing abuse, controlling costs and keeping the service available |
| Respond to support requests and resolve problems | Contact messages and relevant service information | Performance of our agreement or legitimate interests in providing support |
| Meet legal duties and handle rights requests | Information necessary for the request or obligation | Compliance with a legal obligation |
| Optional processing that needs consent | Only the information described when asking you | Your consent, which you may withdraw |
We consider the effects on children and other users when relying on legitimate interests. We do not sell personal information, use it for targeted advertising or run advertising trackers. The current service does not train its own AI model on your conversations.
05AI and marking
To generate a reply, we send your question, relevant conversation history, selected course context and enabled saved notes to an external AI inference provider. If file access is enabled, relevant extracted text and images are also sent. Official resources may be included to support the answer. Input and output safety checks also use the AI provider. Homework creation uses selected subjects and recorded topic weaknesses; marking uses the original practice rubric and submitted answers. You should not submit anything you are not entitled to share.
The provider processes submitted content to operate its service. Do not assume a zero-retention arrangement or that processing is confined to the UK. Contact us for information about the providers and safeguards applying to your data.
AI feedback and suggested marks are for revision. They are not official grades, admissions decisions or qualifications. ScotRevision does not make decisions with legal or similarly significant effects about you solely through automated processing.
07Processing outside the UK
External AI, font, speech and email services may process information in other countries. These countries may have different data-protection laws. Where UK data-protection law restricts a transfer, an applicable adequacy arrangement or other lawful safeguard is required.
You can ask [email protected] which destinations and safeguards apply and how to obtain a copy of relevant safeguards. Account services depend on the connected providers. This notice does not claim that all future hosting arrangements have been selected.
08Cookies, local storage and daily prompts
The workspace uses a first-party session cookie, scot_session, to connect your browser to its server-side conversations and allowance. It is inaccessible to page scripts, restricted to API requests and set to last up to 30 days. It is a session identifier, not proof of an authenticated account.
When you sign in, separate scot-auth cookies (which may be split into numbered chunks) hold the account session. They are inaccessible to page scripts, restricted to API requests, use HTTPS on the public site and are refreshed while you use your account. You must sign in again after seven days, or after 60 minutes without meaningful activity; background polling does not extend that limit. Signing out revokes the login and removes these cookies and that account’s cached workspace from this browser.
Browser storage remembers your workspace and settings until you clear them. No advertising or analytics cookies are added by the application. Browser permissions control optional microphone access.
Your account includes five AI prompts each day, resetting at midnight in the Europe/London time zone (including British Summer Time). New responses, regenerations and retries that begin another AI request count towards the allowance; retrieving an already completed response does not. Homework creation, marking and automatic weekly homework also use the creator’s or submitter’s allowance. A safety-rejected, failed or interrupted request can still use a slot. Changing chats, clearing cookies or using another device does not reset the account count. Other accounts on your network have their own allowance.
09How long we keep information
- Browser data: remains until you remove it through the workspace, browser controls or device storage. Downloaded files remain wherever you save them.
- Conversations and processed evidence: remain in private Supabase storage for signed-in accounts, or the server’s local database for guest/local sessions, until you delete the connected conversation or request deletion. There is currently no automatic age-based deletion of active conversations.
- Family and learning records: homework, submissions and links remain until account deletion or a deletion request is fulfilled. Removing a family connection revokes access but does not delete the student’s work. Activity older than 90 days is removed by the background maintenance job while the service is running. Invitation codes expire after 15 minutes and are stored as hashes.
- Account profile: your profile and eligibility record remain while your account is active, until an account deletion request is fulfilled, subject to any necessary legal retention.
- Saved memory: is separate from chat history. Disable or clear it in Personalisation; deleting a chat does not automatically clear a saved note.
- Unsent staged files: processed uploads expire after 15 minutes or are removed when discarded. Raw upload buffers are released after processing.
- Daily allowance records: one account-linked row stores the date and number of prompts used. It is updated when you next use a prompt on a new day and removed when your account is deleted. Deleting a conversation or clearing cookies does not remove this count.
- Support and legal records: kept for as long as needed to resolve the issue and meet applicable legal duties or defend a claim, then deleted or minimised.
Copies processed by independent external services are subject to the arrangements applying to those services. Contact us if you need help understanding or exercising your rights in relation to that processing.
10Your choices and rights
Depending on the circumstances, you can request access to your personal information, correction, deletion, restriction of processing or a portable copy. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Your right to object: you can object to processing based on legitimate interests, including the account-allowance records, by contacting us. We will consider your circumstances and explain our response.
Use the workspace’s Data controls to export or remove available local data, delete conversations, and manage saved memory separately in Personalisation. Clearing your browser alone does not delete server records. Contact [email protected] for server data requests or if you lose access to a session. Please do not email passwords or unnecessary identity documents.
We normally respond to rights requests within one month. We may need proportionate information to identify the relevant records, or additional time for a complex request as the law permits. We will explain any lawful reason why we cannot fulfil part of a request. Rights are not dependent on creating an account.
You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. You can contact us first, but you do not have to.
11Young people and security
ScotRevision is intended for learners, including teenagers. We aim to minimise information collected and provide private revision spaces. There are no public student profiles, location-sharing features or targeted advertisements. Parents and carers can help a learner use these controls; they do not automatically have access to a child’s private messages.
If a feature relies on a child’s consent, we will apply the relevant age and parental-authorisation requirements before offering it. You must be 13 or over to create an account. We use your date of birth to check eligibility; this is a self-declaration, not verified identity or guaranteed age assurance. Parent accounts require age 18 or over. Family access is optional: the student creates a private, expiring invitation, the parent redeems it, and the student separately approves the named account. This is a declared relationship, not verification of legal guardianship. An approved parent can read past and future saved chat text, see homework results and approximate study time, assign homework and set a daily AI study-time limit. File contents and separate private memory notes are excluded from this view, but information quoted in chat messages remains visible. Either person can revoke access; this stops future access and the removed parent’s weekly homework schedules, but cannot remove information already read or copied. Contact us if you believe a child’s information has been used inappropriately.
Technical protections include session isolation, bounded file validation, restricted access to processed evidence and server-side usage controls. No service can promise perfect security. Report suspected exposure to [email protected], and avoid sending the affected private content unless we need it to investigate.
12Changes to this notice
We will update this page when our practices change and show the effective date. Material changes will be brought to users’ attention through the service where practicable. New features or new uses of information may require an additional explanation or consent before they are enabled.
For questions about this notice, contact [email protected].