Privacy Policy

1. Who is the controller?

EduConnect Asia Ltd (“we”, “us”, “our”) is the data controller for personal data processed through Guidelight (https://getguidelight.com), except where a school or teacher is independently responsible for student data under their own policies. Our address is 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

Privacy questions or data-subject requests: support@getguidelight.com.

2. Data we process

Depending on how you use the service, we may process:

• Teacher account data — name, email address, password hash, email verification and reset tokens, session identifiers
• Student profile data — names, usernames, credentials, class membership, and related classroom metadata created by teachers
• Learning activity — homework and assessment content, attempts, marks, reports, lesson materials, mock exams and archives, reading and CEFR-related activity
• AI usage and billing — feature usage events, estimated token/cost metrics, spending caps, Stripe customer and subscription identifiers, billing email
• Technical data — session cookies and basic request logs needed to operate and secure the service

3. Purposes and lawful bases

• Provide the service — contract (teacher accounts) and legitimate interests / teacher instructions (student classroom use)
• AI features — process task and attempt content via Cloudflare Workers AI to generate or mark work (contract / legitimate interests)
• Billing — charge for AI usage via Stripe (contract / legal obligation for tax records)
• Security and account recovery — verify email, magic links, password resets (legitimate interests / contract)
• Support — respond to messages sent to support@getguidelight.com (legitimate interests)

4. Processors and transfers

We use trusted processors to run the product:

• Cloudflare — hosting (Workers), database (D1), AI inference (Workers AI), transactional email sending, and (when configured) inbound email routing for support
• Stripe — payment processing and customer billing portal

Cloudflare and Stripe may process data in the UK, EEA, United States, or other locations where they operate. Where transfers leave the UK/EEA, we rely on appropriate safeguards such as standard contractual clauses or the provider’s transfer mechanisms.

We do not sell personal data. We do not send class data to OpenAI or ChatGPT for inference; AI features run on Cloudflare Workers AI as described in the product.

5. Cookies

We use an essential session cookie to keep you signed in. We do not use third-party advertising or analytics cookies today. Because the session cookie is strictly necessary for the service to function, we do not show a separate cookie consent banner for it.

6. Retention

We retain account and classroom data while your account is active and for a reasonable period afterwards so teachers can recover work or we can resolve disputes, comply with law, or secure the service. Billing records may be kept longer where tax or accounting rules require. You (or a teacher, for student accounts they control) may request deletion via support@getguidelight.com; we will respond subject to legal retention needs.

7. Your rights (UK GDPR)

Where UK GDPR applies, you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase data in certain circumstances
• Restrict or object to certain processing
• Data portability where processing is automated and based on contract or consent
• Withdraw consent where processing is based on consent

To exercise these rights, email support@getguidelight.com. You may also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

8. Data portability and deletion

If you are a teacher, you can request a copy of the personal data you have provided and that we process on your behalf by emailing support@getguidelight.com. We will also add self-service export and deletion tools inside the product. When you delete your teacher account, we remove your profile, classes, students, tasks, attempts, exam profiles, and billing records from active systems within a reasonable time, subject to any legal or tax retention requirements.

9. Children’s and student data

Guidelight is designed for classroom use. Student accounts are created and managed by teachers. Teachers and schools are responsible for ensuring they have a lawful basis and any required parental or school consents before submitting children’s personal data. Please do not use the service to collect unnecessary sensitive information about students.

10. Security

We use industry-standard measures appropriate to a cloud-hosted education app (encrypted transport, hashed passwords, session controls, infrastructure provided by Cloudflare). No method of transmission or storage is perfectly secure; please use strong passwords and protect account access.

11. Changes

We may update this Privacy Policy from time to time. The effective date at the top of this page will change when we do. Continued use of the service after an update means you acknowledge the revised policy.

12. Contact

EduConnect Asia Ltd
71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Email: support@getguidelight.com