LogoLogo

Privacy Policy

Last updated: 06/10/2026

1. Who we are

This Privacy Policy explains how KnowItAll Ninja Ltd uses personal data when you use RevisionSensei.

In data protection law, KnowItAll Ninja Ltd is the controller of the personal data described in this policy. That simply means we decide how and why your personal data is used.

Our details are:

  • Company name: KnowItAll Ninja Ltd
  • Company number: 14339425
  • Registered office: Venture House, 2 Arlington Square, Downshire Way, Bracknell, Berkshire, RG12 1WA
  • VAT number: 382570091
  • Email: help@revisionsensei.com

This policy applies to:

  • visitors to our website;
  • learners who create an account;
  • parents or guardians who create a parent account or link to a learner account;
  • people who receive or send account-link invitations; and
  • people who start a free trial or buy a subscription.

2. A short version

Here is the quick version.

  • We use your account details to create and run your account.
  • We use your revision activity and progress data so the site can show what you have studied and how you are getting on.
  • If a learner account is linked to a parent account, the parent can see the learner’s revision journey and progress information described in this policy.
  • Some profile information may be visible to other users in the leaderboard.
  • If you use our contact form, we use the details you submit to answer your enquiry and keep a record of support requests.
  • If you accept analytics cookies, we use Google Analytics to understand how the site is used. We do not use advertising trackers.
  • Payment card details are handled by Stripe, not stored by us.
  • You can contact us at help@revisionsensei.com if you have privacy questions.

If you are a learner aged 13 to 17 and anything in this policy is unclear, please ask a parent, guardian, or contact us.

3. The personal data we collect

We collect the following categories of personal data.

3.1 Account and profile information

When you register or update your profile, we may collect:

  • email address;
  • password (stored in hashed form, not plain text);
  • first name;
  • username;
  • profile image, if you choose to upload one; and
  • whether your account is a learner account or a parent account.

3.2 Learning and progress information

When a learner uses Revision Sensei, we may collect and store:

  • lesson progress, including whether something has been started, is in progress, or completed;
  • scroll position and timestamps showing when content was started or completed;
  • flashcard progress, such as whether a flashcard is marked as known or not yet known;
  • exam question progress and points awarded;
  • quiz attempts, including selected answers, whether answers were correct or incorrect, XP earned, and completion state;
  • XP transactions, including amount, source and date;
  • activity events, such as lessons completed or level-ups, with timestamps and related course or lesson IDs;
  • enrolment information, including courses added, enrolment status, and current and target grades; and
  • free-tier usage counts, such as how many lessons, exam questions or quizzes have been accessed within the current month.

3.3 Parent and learner linking information

If a parent and learner link their accounts, we may collect and store:

  • inviter email address;
  • invitee email address;
  • invitation token;
  • invitation status and expiry; and
  • the linked parent/learner relationship.

3.4 Subscription and billing information

If you start a free trial or buy a subscription, we may collect and store:

  • whether you have used a free trial;
  • subscription status;
  • subscription plan;
  • Stripe customer ID; and
  • related subscription identifiers needed to manage the subscription.

Payment card details and billing address are handled by Stripe. We do not see or store your full card details in our own systems.

Billing records may sit on the account that pays for the subscription. That may be a learner account or a parent account.

3.5 Communications

We may keep records of communications such as:

  • welcome emails;
  • email verification emails;
  • password reset emails;
  • receipts and subscription confirmations;
  • failed payment notices;
  • renewal reminders;
  • cancellation confirmations;
  • trial ending reminders;
  • parent or learner linking invitations;
  • contact form submissions, including your name, email address, subject and message; and
  • messages you send to our support team.

We do not currently send marketing emails or newsletters.

3.6 Technical information and storage technologies

We use some cookies and browser storage so the site works properly and remembers certain choices.

We currently use:

  • jwt — an HTTP-only authentication cookie used to keep you signed in. Duration: 7 days.
  • cookie_consent — stores your cookie consent choice. Duration: 1 year.
  • theme in local storage — stores your dark/light theme preference.
  • auth_return_url in session storage — remembers where to return you after login.
  • lessonBackHref in session storage — remembers which course page you came from.
  • _ga and _ga_DFKGX4NF05 — Google Analytics cookies that tell visitors and visits apart. Set only if you choose “Accept All”. Duration: up to 2 years.
  • rs_ga_events — passes a sign-in or sign-up event to Google Analytics on the next page. Set only if you choose “Accept All”. Duration: 5 minutes.

We may also receive technical information from our infrastructure and security providers, such as:

  • IP address;
  • browser type and version;
  • operating system;
  • referring URL;
  • pages visited and timestamps; and
  • rough country or region derived from IP address.

3.7 Usage information (Google Analytics)

If you choose “Accept All” in our cookie banner, Google Analytics collects information about how you use the site: the pages you visit, actions such as signing up, starting a free trial, opening revision notes or completing quizzes, your device and browser type, and your approximate location (derived from your IP address). If you are signed in, we also send your account’s internal ID number (not your name or email address), whether it is a learner or parent account, and your subscription status. Google’s advertising features and Google signals are turned off.

If you choose “Only Necessary”, Google Analytics does not load.

4. What we do not currently collect in our application

At the time of this policy, our application does not currently collect or store:

  • geolocation data;
  • device fingerprinting data;
  • free-text answers or learner notes;
  • sensitive information such as health data;
  • advertising tracker data;
  • download tracking data; or
  • a dedicated last-login field.

Our application also does not itself log IP addresses or browser user-agent data. However, some technical data is processed in infrastructure-level logs by our hosting and security providers as described above.

5. Where we get personal data from

We usually get personal data directly from you.

We may also get personal data:

  • from a parent or learner who sends an account-link invitation;
  • from Stripe, so we can see subscription and payment status information needed to run subscriptions;
  • from our hosting and security providers when you use the site; and
  • from your use of the site itself, such as when progress, activity or quiz results are generated.

6. How we use personal data and our lawful bases

Data protection law requires us to explain both why we use personal data and the lawful basis we rely on.

We use personal data for the following reasons.

6.1 To create and run your account

We use account details, login details, and service data to create your account, sign you in, keep you signed in, and give you access to the features linked to your account.

Lawful basis: performance of a contract.

6.2 To provide the learning service

We use learning activity, progress data, XP data, enrolments, and free-tier usage data so the site can provide revision features, track progress, apply free and paid access rules, and show what has been completed.

Lawful basis: performance of a contract.

6.3 To run free trials and paid subscriptions

We use subscription and billing data to activate trials, manage subscriptions, renew plans, process payments, send receipts, and deal with failed payments.

Lawful basis: performance of a contract, and legal obligation where we must keep accounting and tax records.

6.4 To run parent-linked accounts

We use invite and link data so parents and learners can connect accounts and so linked parents can see the learner data made available through that feature.

Lawful basis: performance of a contract for linked-account functionality, and legitimate interests in operating and managing the invite process.

6.5 To send service emails and respond to enquiries

We use contact details and support correspondence to send account, security, billing and subscription emails, to answer questions, investigate issues, provide support, and keep a record of support requests.

Lawful basis: performance of a contract where the communication is needed to provide the service or manage your account; steps at your request before entering into a contract where you contact us about starting a free trial or buying a subscription; and legitimate interests in administering and supporting the service and keeping records of support requests.

6.6 To keep the site secure and working properly

We use technical and security data to maintain the site, protect accounts, detect misuse, troubleshoot issues, and protect the platform against fraud, abuse or security threats.

Lawful basis: legitimate interests.

6.7 To comply with legal obligations and deal with disputes

We may use personal data to comply with legal requirements, respond to lawful requests, handle complaints, establish or defend legal claims, and keep required business records.

Lawful basis: legal obligation, and legitimate interests where appropriate.

6.8 To remember certain choices on your device

We use essential cookies and session storage so login, navigation and consent choices work properly. Where we store a non-essential preference, such as theme choice, we do so based on your choice.

Lawful basis: performance of a contract and legitimate interests for essential technologies, and consent where required for non-essential storage.

6.9 To understand how the site is used and improve it

If you accept analytics cookies, we use Google Analytics statistics to see which pages and features are used, where visitors come from and where they leave, so we can improve the site.

Lawful basis: consent. You can withdraw it at any time by clearing the cookies for revisionsensei.com in your browser; Google Analytics then stops loading unless you accept again.

7. Parent accounts and linked learner accounts

Revision Sensei includes a parent-link feature.

A link between a parent and a learner account is only created when the invitation is accepted by the other side.

Once a parent account is linked, the parent may be able to see:

  • the learner’s revision journey, including activity such as quizzes completed and revision notes viewed, with dates;
  • course progress;
  • the course structure and some course content pages, including exam question pages; and
  • subscription or billing information where relevant to the linked arrangement.

Parents do not currently have direct access to the learner’s flashcards or quizzes as interactive tools, although they may still be able to see the overall structure around that content.

The learner can see that a parent account is linked and who that linked parent is.

At present, the learner cannot remove a linked parent relationship by themselves through the account settings. If you need help with a parent link, contact us at help@revisionsensei.com.

8. Leaderboard and information visible to other users

Revision Sensei includes a leaderboard feature.

Information that may be visible to other users in the leaderboard includes:

  • profile name, first name and/or username used for display;
  • profile image, if one has been uploaded;
  • level; and
  • experience points earned that week.

Email addresses are not shown publicly in the leaderboard.

There is no in-platform messaging, comment system, or user-to-user communication feature.

Please think carefully about the profile name and image you use, especially if the account belongs to a child.

9. Who we share personal data with

We share personal data only where needed to run the service, meet legal obligations, or protect the service.

We may share data with:

  • Stripe for payment processing and subscription management;
  • Google / Gmail API for account emails such as invitations and password reset emails, and receiving or handling support enquiries sent through the contact form or by email;
  • Google (Google Analytics) for website usage statistics, only if you accept analytics cookies;
  • Cloudflare for CDN, security and related technical services;
  • Vercel for frontend hosting; and
  • Render for backend hosting.

We may also share data:

  • if required by law or a lawful request from a regulator, court or authority;
  • if needed to establish, exercise or defend legal claims; or
  • as part of a business sale, merger or restructure, where lawful.

We do not currently sell personal data.

We do not currently share personal data with advertisers or data brokers.

10. International transfers

Some of our service providers may process personal data outside the UK.

Google may process Google Analytics data outside the UK, including in the United States.

Where personal data is transferred internationally, we take steps to make sure it is protected in line with UK data protection law. This may include relying on:

  • a country or service covered by UK adequacy regulations; or
  • appropriate safeguards, such as approved transfer clauses.

11. How long we keep personal data

We keep personal data only for as long as we need it for the purposes described in this policy.

Our usual retention periods are:

  • Account, profile and learning data: while the account is active, and for up to 24 months after the last meaningful account activity, after which we delete or anonymise it unless we need to keep part of it for legal, security or dispute reasons.
  • Contact form messages and support records: up to 24 months after the enquiry is closed, unless we need to keep them longer for legal claims, complaints, fraud prevention, security or regulatory reasons;
  • Parent/learner linking records: while the link is active, and for up to 24 months after the linked relationship ends unless we need to keep a record for disputes or security.
  • Invitation records: up to 12 months after the invitation is accepted, expires, or is cancelled.
  • Support emails and complaint records: up to 24 months after the matter is closed, unless we need to keep them longer for legal reasons.
  • Subscription, payment, accounting and tax records: up to 6 years from the end of the relevant financial year, or longer where the law requires.
  • Cookie consent record: 1 year from the date it is set, unless cleared earlier.
  • Authentication cookie: up to 7 days, unless cleared earlier.
  • Google Analytics data: 14 months, after which Google deletes it.
  • Google Analytics cookies: up to 2 years, unless cleared earlier.
  • Session storage items: until the browser session ends.
  • Theme preference in local storage: until changed or cleared by the user.

If you ask us to delete your account, we will usually action that within a reasonable period, but we may keep limited information where we must do so for legal, accounting, tax, fraud-prevention, security, or dispute-handling reasons.

12. Security

We take reasonable technical and organisational steps to protect personal data.

These measures include, where appropriate:

  • hashed passwords;
  • secure authentication cookies;
  • HTTPS and encryption in transit;
  • security headers;
  • rate limiting on authentication endpoints; and
  • use of Stripe for payment card processing.

No online system can ever be guaranteed to be completely secure, but we work to keep your data protected.

13. Children’s privacy

Learner accounts are intended for users aged 13 and over.

We do not knowingly allow children under 13 to create learner accounts. If we discover that we have collected personal data from a child under 13 in a way that should not have happened, we will take appropriate steps to remove the account and delete the personal data, unless we must keep some of it for a legal reason.

If a learner account is linked to a parent account, the learner will be able to see that the parent link exists.

14. Automated decisions and profiling

We do not currently use personal data for:

  • advertising profiling;
  • personalised study recommendations based on automated profiling; or
  • solely automated decisions that have legal or similarly significant effects on users.

15. Your rights

Depending on the circumstances, you may have the right to:

  • ask for a copy of your personal data;
  • ask us to correct inaccurate personal data;
  • ask us to delete personal data;
  • ask us to restrict how we use personal data;
  • object to our use of personal data where we rely on legitimate interests;
  • ask for your data in a portable format in some cases;
  • withdraw consent where we rely on consent; and
  • complain if you are unhappy with how we handle your personal data.

To exercise your rights, email help@revisionsensei.com.

We may need to verify your identity before acting on a request.

If a request relates to linked parent and learner accounts, we may need additional information before deciding how to respond.

16. Complaints

If you have a privacy complaint, please contact us first at help@revisionsensei.com.

We will look into the complaint and try to resolve it fairly.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection.

17. Changes to this policy

We may update this Privacy Policy from time to time.

If we make an important change, we will take reasonable steps to let users know, for example through the website or by email where appropriate.