Back to home

Privacy Policy

Last updated: October 23, 2026

This policy explains what personal data Edveera collects, why, who we share it with, how long we keep it and how you can control it, including the information we receive when you sign in with Google. We have kept it in plain language.

1. Who we are

Edveera (edveera.com) is an exam-preparation service for Cambridge students. It shows past-paper questions with their official mark schemes, marks your answers with AI against those mark schemes, and analyses which topics come up in exams.

Edveera is operated by EDVEERA TECH LTD, a company registered in the United Kingdom with registration number 17055082. Registered address: Office 17588, 182-184 High Street North, East Ham, London, United Kingdom, E6 2JA.

EDVEERA TECH LTD is the "controller" of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018). When we say "Edveera", "we", "us" or "our", we mean EDVEERA TECH LTD.

2. The data we collect

We collect only what we need to run Edveera:

Account details: Your email address, your name, and your password if you sign up with email. Passwords are stored only as a one-way hash by our authentication provider; nobody at Edveera can see them.
Google account details: If you choose "Continue with Google": your name, email address, profile picture link and Google account ID. See section 3.
Purchases: Which passes you bought, for which subjects and exam session, the price, the order number and the payment status, plus Stripe's reference numbers for the payment. Your card details go straight to Stripe; we never receive or store them.
Your study activity: The answers you submit for marking, the marks and feedback the AI gives, your ratings of that feedback and any comment you add, questions you report as wrong, and the progress and topic statistics we calculate from your attempts.
Support messages: Live-chat messages (and the name and email you give us if you chat without signing in), contact-form messages, and the reasons you give in refund or downgrade requests.
Device and security information: Each account can be used on up to 3 devices. To enforce this we keep, per device, a random device ID, your browser's user-agent string, the country your connection comes from (worked out by Cloudflare from your IP address; we do not store the IP address itself) and when the device was last used. Our hosting and sign-in providers also process IP addresses to protect the service from abuse.

We do not use advertising, analytics or tracking tools, and we do not build profiles of you for marketing.

3. Google user data

You can sign in with your Google account. When you do, Google asks for your permission and then shares only basic profile information with Edveera (the "openid", "email" and "profile" permissions):

What we receive: Your name, email address, profile picture link and Google account ID. We do not ask for, and cannot see, your Gmail, Google Drive, contacts, calendar or any other Google data.
How we use it: Only to create your Edveera account, sign you in, show your name in the app, and email you about your account and purchases (for example receipts and password or access notices).
How we store it: In our authentication system and database (Supabase), protected as described in section 9.
Who we share it with: No one, except the service providers in section 6 that run Edveera on our behalf (for example Supabase, which stores it, and Resend, which delivers our emails). We never sell Google user data, never use it for advertising, and never use it to train AI models.
Keeping and deleting it: We keep it while your account exists. To delete it, email support@edveera.com and we will delete your account within 30 days. You can also remove Edveera's access to your Google account at any time at myaccount.google.com/permissions.

Edveera's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use your data, and our legal basis

UK data protection law requires a legal basis for each use of personal data. Ours are:

To provide the service (contract): Creating and running your account, granting the passes you bought, marking your answers, showing your history and progress, and answering your support requests.
To keep Edveera secure and fair (legitimate interests): Preventing fraud, bots and abuse, enforcing the 3-device limit and daily marking limits, and keeping records of support conversations and decisions.
To improve marking quality (legitimate interests): Staff review AI feedback that students rate as unhelpful, and questions students report, so we can correct mistakes. An anonymised example may be added to our internal tests of the marker.
To meet legal duties (legal obligation): Keeping order and payment records for tax and accounting.

We send emails about your account, purchases, trials and refunds. We do not send marketing emails.

5. How we use AI

AI is a core part of Edveera. Here is exactly what it receives:

Marking your answers: When you submit an answer, we send the question, its official mark scheme and examiner notes, and your answer to Anthropic's Claude API. We do not send your name, email or any other details about you.
What we keep: Your answer and the marking are saved to your account so you can see your history and progress, and so staff can check marking quality as described in section 4. They are deleted with your account.
What Anthropic keeps: Under Anthropic's commercial terms, data sent through its API is not used to train its models, and it is kept only for a limited period for safety and abuse monitoring.
Support chat: When you start a live chat, your first message is sent to Cloudflare Workers AI to write a quick first reply until a member of our team joins.

6. Service providers we share data with

We do not sell your data or share it with advertisers. We share it only with these providers, which process it on our behalf under data-processing agreements, and only for the purposes described:

Supabase: Database and sign-in (account details, Google profile, study activity, support messages, device records). Privacy policy: supabase.com/privacy.
Cloudflare: Website hosting, security and bot protection (including the Turnstile check on sign-in forms), and the AI that writes the first support-chat reply. Privacy policy: cloudflare.com/privacypolicy.
Stripe: Payments and refunds. Privacy policy: stripe.com/privacy.
Anthropic: AI marking of your answers, as described in section 5. Privacy policy: anthropic.com/legal/privacy.
Resend: Sending our emails (your email address, name and the email's content). Privacy policy: resend.com/legal/privacy-policy.
Google: Sign-in if you choose "Continue with Google". Our pages also load fonts from Google Fonts, so your browser sends your IP address and browser details to Google when it downloads them. Privacy policy: policies.google.com/privacy.

We may also disclose data if the law requires it, or to protect the rights and safety of our users or of Edveera.

7. Where your data is stored

Our database is hosted by Supabase in South Korea, which the UK recognises as giving personal data an adequate level of protection. Some of our providers (such as Cloudflare, Stripe, Anthropic and Resend) process data in the United States and other countries. Where data leaves the UK, it is protected by the safeguards UK law requires, such as the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or the UK-US Data Bridge.

8. Cookies and browser storage

We use only cookies that are strictly necessary for the site to work, so we do not ask for cookie consent:

Sign-in (sb-access-token, sb-refresh-token): Keep you signed in. Expire after 7 days without use, or when you log out.
Device (edveera_device): A random ID for this device, used for the 3-device limit. Up to 1 year, removed when you log out.
Subject (edveera_subject): Remembers which subject you are studying.
Chat (edveera_chat_token): Lets you return to a support chat you started without signing in.
Sign-in helpers: Short-lived cookies (10 minutes) that protect the Google sign-in process.
Cloudflare security cookies: Set by Cloudflare to tell people from bots.

We also save two things in your browser's local storage, which never leave your device: the ID of your current support chat, and drafts of answers you have not submitted yet.

9. How we protect your data

We protect your data with:

Encryption: All connections use HTTPS (TLS), and stored data is encrypted at rest.
Access controls: Database rules stop anyone reading another person's data, and only authorised staff can see student data, each with the minimum access their role needs.
Account protection: Passwords are hashed, sign-in forms are protected against bots, and resetting your password signs out your other devices.

10. How long we keep your data

Your account and study data: For as long as your account exists. When you ask us to delete your account, we delete it within 30 days.
Orders and payment records: 6 years, because UK tax law requires it, even if you delete your account.
Support conversations and requests: While your account exists, so we can follow up and keep a record of decisions, and deleted with it. Chats started without an account are deleted on request.
Device records: Removed when you log out on that device or reset your password; otherwise they stop counting towards your limit after 30 days without use.

11. Your rights

Under UK data protection law you have the right to:

Access: Get a copy of the personal data we hold about you.
Correction: Have inaccurate data corrected. You can change your name and password yourself in your account settings.
Deletion: Have your account and data deleted (except records we must keep by law).
Portability: Receive your data in a common, machine-readable format.
Objection and restriction: Object to, or ask us to limit, uses based on our legitimate interests.

To use any of these rights, email support@edveera.com from the address on your account. We will reply within one month, and usually much sooner.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the UK Information Commissioner's Office (ico.org.uk), or to the data protection authority where you live.

12. Children

Edveera is designed for secondary-school students, usually aged 14 to 19. You must be at least 13 to create an account. We do not knowingly collect personal data from children under 13.

If you are a parent or guardian and believe a child under 13 has given us personal data, email support@edveera.com and we will delete it promptly.

13. Changes to this policy

If we make important changes to this policy, we will email you and update the "Last updated" date above. Small clarifications may be made without notice.

14. Contact

Questions about this policy or your data:

Email: support@edveera.com
Post: EDVEERA TECH LTD, Office 17588, 182-184 High Street North, East Ham, London, United Kingdom, E6 2JA