Privacy Policy

Algosys Technologies Ltd is the data controller for personal data processed through the StageX Academy learning platform. We are registered with the Information Commissioner's Office (ICO) under the Data Protection Act 2018.

We are registered with the ICO under registration number ICO:00310319687.

Our Privacy Team can be contacted at: contact@stagexacademy.com

Parent account data:

• •Email address (stored encrypted using AES-256-GCM; only the HMAC-SHA256 hash is used for lookups)
• •Password (hashed using PBKDF2-SHA512 with 100,000 iterations and a unique random salt)
• •GDPR consent timestamp and IP address
• •Marketing preferences
• •Timezone and locale
• •Login timestamps and IP addresses (for security)

Child profile data:

• •Auto-generated display nickname (e.g. "dan-7484") — we do not store the child's real name
• •Age group and exam pattern (GL, CEM, General, Independent)
• •Target exam date
• •A friendly username and PIN (PIN stored as a hash, never in plain text)
• •Learning progress, test results, scores and streak data
• •Star count and achievement data

Usage data:

• •Test sessions — questions answered, time taken, score percentages
• •Revision card interactions
• •AI tutor interactions (question prompts and responses)
• •Device type and browser (for compatibility, not tracking)

Payment data:

• •Subscription plan and billing dates
• •Last 4 digits of payment card and card brand (stored for reference only)
• •Full payment processing is handled by our payment provider — we do not store full card numbers

We collect only the minimum data necessary. Children's data is never used for advertising or marketing and is never sold to or shared with third parties for commercial purposes.

Children under 13 cannot create independent accounts — they access StageX Academy only through a parent account.

Parents can view, correct, export or delete their child's data at any time through account settings or by contacting contact@stagexacademy.com.

• •Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service
• •Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, service improvement
• •Consent (Art. 6(1)(a)): Marketing emails — you can withdraw at any time
• •Legal obligation (Art. 6(1)(c)): GDPR compliance records, tax obligations

We do not sell your data or your children's data to anyone, ever.

• •SMTP email provider — transactional emails only
• •Payment processor — subscription billing; full card data never touches our servers
• •Cloud hosting — UK or EEA infrastructure
• •AI/LLM provider (Cloudflare Workers AI) — educational responses only; provider does not use data to train models

We may disclose data to law enforcement where required by law or to protect the safety of a child.

We store and process most data in the United Kingdom. Where processing occurs outside the UK (e.g. our AI provider), we ensure appropriate safeguards such as UK adequacy decisions or Standard Contractual Clauses.

• •Passwords: PBKDF2-SHA512 with 100,000 iterations and a unique random salt
• •Email addresses: AES-256-GCM encryption at rest; HMAC-SHA256 hash for lookups
• •Child PINs: Hashed — never stored in plain text
• •Transport: TLS 1.2 or higher on all connections
• •Tokens: Short-lived JWTs (15 min); refresh tokens rotated on each use with theft detection
• •Database: Row-Level Security (RLS) enforced at the database layer
• •Account lockout: Automatic after 5 failed login attempts

In the event of a breach, we will notify the ICO within 72 hours and affected users without undue delay.

• •Right of access (Art. 15): Request a copy of the data we hold
• •Right to rectification (Art. 16): Correct inaccurate data
• •Right to erasure (Art. 17): Request deletion of your account and data
• •Right to data portability (Art. 20): Receive your data in a machine-readable format
• •Right to restrict processing (Art. 18): Ask us to pause processing
• •Right to object (Art. 21): Object to legitimate interests processing
• •Withdraw consent: Withdraw marketing consent at any time

Email contact@stagexacademy.com to exercise your rights. We respond within 30 days.

The StageX Academy app uses browser local storage (not cookies) for authentication. Our marketing website uses cookies only with your consent — see our Cookie Policy.

We will notify you of material changes by email or in-app notice at least 14 days before they take effect.

Email: contact@stagexacademy.com

To complain to the ICO: ico.org.uk · 0303 123 1113

Algosys Technologies Ltd · Registered in England and Wales · contact@stagexacademy.com