Privacy
What we keep, and what we don't
Written twice, because a student and a tutor need different answers to the same question. Neither version is longer than it needs to be.
The short version
What we actually store about you
- Your first name — so your tutor knows whose practice is whose
- Your code — the thing in your link that gets you in
- Whether you're Foundation or Higher, and which exam board
- For each word: whether you got it right, how you were asked, and how long you took
What we never ask for, and couldn't store if we tried
- Your email address
- Your surname
- A password
- Your school, your age, your address, your phone number
- Where you are
- Anything you type that isn't a Spanish answer
There isn't a box for any of it. You don't have an account — you have a link.
Who can see it
Your tutor. That's it. Not other students — they can't even see your name. Not other tutors. We don't sell it, share it, or use it for adverts. There are no adverts.
How long it's kept
Your tutor picks: six months, a year, or two years after you stop practising. Then it's deleted — all of it, not archived somewhere.
If you want it gone
Ask your tutor to remove you. That deletes your name, your code and every answer you ever gave, straight away. You don't need a reason and you don't have to ask us.
If your tutor won't, or you'd rather ask us directly, email hello@chuleta.co.uk and we'll do it.
Things you might reasonably worry about
Is my tutor watching me in real time? No. They see a summary — how many words you own, which ones are shaky, which sounds keep slipping. Not a live feed.
Does getting things wrong get recorded? Yes, and that's the useful part — it's how it knows which words to bring back. It isn't a grade and it isn't a mark against you.
What if someone else gets my link? Tell your tutor and they'll give you a new code in one tap. Your progress stays; the old link stops working.
Does it listen to me? Not currently. When you say a word out loud, you mark yourself — nothing is recorded or sent anywhere. If that ever changes we'll say so here first, clearly.
If you think something's wrong
Email hello@chuleta.co.uk. A real person reads it. You can also complain to the Information Commissioner's Office — the UK regulator — at ico.org.uk, and you don't have to ask us first.
Last updated 17 August 2026. hello@chuleta.co.uk · Registered with the ICO, ZC111613
Your position, in one paragraph
That means the relationship with your students' parents stays yours, which is almost certainly what you want. It also means we owe you a written processing agreement under Article 28 of the UK GDPR — you'll be asked to accept one when you sign up.
What we hold
About you
- Email address — how you sign in, and how we reach you
- Display name — shown to your students as “your name's practice”
- Your settings: retention period, session length, marking preferences
About each of your students
- First name only, and their access code
- Tier and exam board
- Every answer: which word, right or wrong, task type, response time
- Per word: state, counts, when last seen
There is no field for a student's surname, email, date of birth, school or location. Not disabled — absent from the schema.
How it's protected
- Students can't reach the database. Their browser has no permission on any table. Every read and write goes through a function that re-checks their own code. A mistake in a permission rule can't expose data because there's no route to the table.
- You can only ever see your own students. Enforced in the database, per row, not in the app.
- Students never see each other's names. Each has their own code; no roster is shown.
- Hosted in the UK (London region). Encrypted in transit and at rest.
- You sign in with a link, not a password.
These are tested rather than asserted — see our impact assessment.
Children's data
Your students are children, so the ICO's Age Appropriate Design Code applies. We've completed the impact assessment it requires. Some consequences you'll notice in the product:
- No streaks, leaderboards or notifications. Deliberate — those are nudge techniques aimed at children, and we won't use them.
- No comparison between students. No ranking, ever.
- No grade. The product describes what a student knows, never scores them.
- Response time is recorded but not acted on — a slow answer might just be a distracted teenager, and acting on that would be guessing.
We ask you to confirm no student you add is under 13. Below that age the consent rules change and we're not set up for it.
How long, and deleting things
You choose: 6, 12 or 24 months of inactivity, in Class settings. After that a student and everything about them is deleted automatically.
You can also remove a student at any time from their page. That deletes their name, code and every answer immediately and permanently.
If a parent asks what you hold about their child, or asks you to delete it, you can answer and act entirely from your own screen. If you'd like it in writing, email us.
Who else is involved
- Supabase — database hosting, London region
- Vercel — serves the website. Carries no student data
- Resend — email to you. Never used to email a student
No advertising networks. No analytics inside the app. Nobody buys this data because we don't sell it.
If something goes wrong
If there's a breach affecting your students we'll tell you without delay and give you what you need to inform parents. As controller that notification is yours to make; we'll support it. Where required, the ICO is informed within 72 hours.
Who we are, formally
Chuleta is Mr Guillermo Pernas Chamorro, a sole trader registered with the UK Information Commissioner's Office as a data controller, reference ZC111613. You can verify that at ico.org.uk — search the register for that number.
If you're ever unhappy with how your data or your students' data is handled, tell us first at hello@chuleta.co.uk. You also have the right to complain directly to the ICO at ico.org.uk/make-a-complaint without going through us.
Last updated 17 August 2026. Questions: hello@chuleta.co.uk · ICO registration ZC111613