Privacy Policy

Every child account on Clem is linked to a parent or guardian account. The parent account holder is the person we contract with and who exercises data protection rights on behalf of a child under 13. Children aged 13 and over may exercise some rights themselves in line with the ICO's guidance on children's data, but the parent account retains oversight and billing control throughout.

• Parent account data: guardian name, email, billing details, and consent records (including your declared confirmation that you are 18 or over and the parent/guardian — we do not collect your date of birth).
• Student profile data: preferred name, year group, exam board, exam provider, avatar choices, and which learning areas (exam track, Life Skills, Languages, Affirmations) the parent has enabled for the child.
• Learning data: answers, mastery progress, time spent, coin transactions, essay submissions, and language mastery records (which vocabulary items a child has been introduced to and their recall state).
• Life Skills interaction data: when your child uses a Life Skills scenario (Financial Literacy, Emotional Intelligence, Storytelling & Selling, or Staying Safe), responses are processed through the same safety pipeline as all other Clem conversations. Scenarios are fictional — Clem never collects real financial details or asks a child to share personal information about themselves.
• Voice data: when your child uses the "ask Clem out loud" feature, speech is transcribed on-device by the browser and the transcript is kept as part of the lesson record; the transcript is retained unless it forms part of a safeguarding flag (see 1.6), in which case it is retained under a stricter, access-limited process.
• Technical data: device/browser information and basic usage logs, for security and service reliability. A device identifier is stored in your browser's local storage so your child's access link is bound to the device it was first opened on, preventing it being shared to another device.
• Cookie consent: your cookie preference (accepted or rejected non-essential cookies) is stored in your browser's local storage. See our Cookie Policy.
• Safeguarding records: where our safety systems flag a possible concern (see Safeguarding Policy), a record of that flag and how it was handled.

We do not collect more than we need. We do not use children's data to build advertising profiles, and Clem does not carry advertising.

• Contract: delivering the tutoring service itself (lessons, progress tracking, coin economy) — necessary to provide what you signed up for.
• Consent: where consent is the basis for a specific piece of processing (for example, optional voice-based features, non-essential cookies, or any account belonging to a child under 13), we obtain it from the parent or guardian, specifically and separately from general terms acceptance — not implied by the act of creating an account.
• Legitimate interests: basic security, fraud prevention and service-improvement analytics, balanced against your child's rights and always excluding anything used for marketing to children.
• Legal obligation: where we're required to retain or disclose information — for example, in a genuine child-protection matter.

Where we rely on consent, you (or your child if 13+, per ICO guidance) can withdraw it at any time through account settings or by contacting us — this won't affect processing that already happened lawfully.

We use a small number of carefully selected third-party providers to operate Clem, bound by data processing agreements requiring UK GDPR-equivalent protection. Our current sub-processor is:

• Base44 — application platform, AI teaching engine and data storage. Base44 is not permitted to use a child's data to train its own general-purpose models.

Beyond sub-processors, we share data with:

• Human reviewers (our staff): Teacher Reviewers and Super Admins, for content quality, essay marking and safeguarding review, under confidentiality obligations — never with people outside HBSS Limited.
• Authorities: where legally required, or where necessary to protect a child from harm.

We do not sell personal data, we do not share it with advertisers, and no third party outside HBSS has visibility into a child's individual data — only the linked parent account and vetted HBSS staff.

Clem's data is hosted on Base44's managed infrastructure. Where any sub-processor is based outside the UK or EEA, we ensure appropriate safeguards are in place in line with UK GDPR Chapter V — such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

If Clem's safety systems detect something suggesting a child may be at risk (see our Safeguarding Policy), the relevant conversation excerpt is retained separately, accessible only to trained Teacher Reviewers, and is not deleted on the normal schedule — this is necessary to protect the child and to maintain an accurate safeguarding record. Parents are notified that a check-in is recommended without automatically receiving the full transcript, to avoid inadvertently escalating risk in situations where the home environment itself may be a factor. This applies in every learning area, including Life Skills scenarios where the Staying Safe strand involves fictional safety situations that may surface real concerns.

• Learning / progress data: retained for the duration of the account plus 12 months after closure, to support continuity if the family returns.
• Voice audio: speech is transcribed in-browser; audio is not retained beyond the session. The transcript follows the standard learning-data retention period unless flagged.
• Safeguarding records: retained in line with standard safeguarding record-keeping practice — typically until the child reaches the age of 25, or longer where a concern remains live.

Under UK GDPR, the parent/guardian account holder (and the child themselves, where age-appropriate) can request: access to the data we hold, correction of inaccurate data, deletion, restriction of processing, data portability, and can object to processing based on legitimate interests. To exercise any of these, contact Emmanuel at info@hbssuk.com. You also have the right to complain to the ICO (ico.org.uk) if you're unhappy with how we've handled your data.

Clem is designed with the ICO's Age Appropriate Design Code in mind: privacy settings default to the most protective option, we don't use nudge techniques to encourage children to weaken their privacy, we don't profile children for marketing, and this policy is available in a plain-English form as above, separate from the full legal text, so it's genuinely readable by parents (and, at an appropriate level, by older students).

Questions about this policy: info@hbssuk.com. Full contact details are on our Contact Us page.