Privacy Policy

Information we collect

• Membership purchases: parent or guardian name, email address, the child's year group, the subject or membership chosen, digital or printed format, payment and subscription status, and order and fulfilment records.
• Printed memberships only: the UK delivery address you give at checkout.
• Consultation enquiries: parent or guardian name, email address, the child's year group, the service you are asking about, the subject, and anything you choose to tell us in the message — for example an exam, a target school, an exam date or the concerns you would like to discuss.
• Email records: whether a transactional email to you was sent, delivered or failed.
• Website and technical information: the requests our hosting and backend providers log in order to serve and secure the site.

Information about children

We minimise information about children. Purchase does not ask for a child's name, date of birth, school or any other personal detail — only the year group, because that determines which resources we prepare.

For Finch Personal and Finch Exam Intensive, a parent may choose to tell us more about their child's learning — for example a target school, an exam date or where they are finding work difficult — so that we can advise properly. We use that only to assess and deliver the support requested. Please do not send us more information about your child than we need.

Where Finch produces assessment or progress information for a child as part of a service, we process it solely to deliver that service to you as the parent.

Why we use it and our lawful basis

• To take and administer your membership, prepare and fulfil packs, and provide customer service — performance of our contract with you.
• To respond to a consultation enquiry and arrange a free consultation — taking steps at your request before entering a contract, or our legitimate interest in answering enquiries.
• To keep accounting and transaction records — compliance with our legal obligations.
• To keep the website and our systems secure and working — our legitimate interest in running the service safely.
• Where we ever rely on consent, we will ask for it clearly and you can withdraw it at any time.

Who processes information for us

We use a small number of service providers, acting on our instructions. We do not sell your information and we do not share it for advertising.

• Stripe — payment processing and subscription billing, reached through Lovable's managed payments service. The card form is displayed by Stripe on our checkout page: your card details go directly to Stripe and Finch never sees or stores a full card number. Stripe also collects your billing address, and the delivery address for printed memberships.
• Lovable (including Lovable Cloud, built on Supabase) — website hosting, our database, private file storage for learning packs, and sign-in for Finch staff accounts.
• Lovable's managed transactional email service — sending your order confirmation, pack download emails, payment-problem emails and our internal enquiry notifications, from noreply@mail.finchlearning.com.

The optional Finch updates list

You can ask us to keep you updated about new year groups, resources and programmes by giving your email address on our website. We ask for nothing else — no name, and nothing about your child.

We send these updates only because you asked us to, and our lawful basis is your consent. Your email address, the date and wording of that consent, and the page you signed up from are stored separately from customer, order and enquiry records.

Every update email includes an unsubscribe link, and you can unsubscribe at any time by using it or by emailing us. Unsubscribing stops updates only — it does not affect essential emails about a membership, payment, pack or enquiry, which we must send in order to provide the service.

We do not use a third-party marketing platform for this list: it is held in our own backend and sent through the same managed email service described above. We do not sell or share it.

International transfers

Some of these providers may process information outside the UK. Where they do, the transfer is covered by the safeguards those providers put in place, such as UK-approved standard contractual clauses or an adequacy decision.

How long we keep it

We keep personal information only for as long as it is necessary for the purposes described in this policy, and for as long as we are required to keep records for legal and accounting purposes.

Customer, order and subscription records: up to 7 years from the end of the relevant financial year, where the record is needed for accounting, tax, legal or audit purposes. This longer period applies to the financial record itself — it does not automatically extend unrelated personal information, which is removed at the end of its own period.

Consultation enquiries: 2 years from when the enquiry is closed.

Fulfilment and delivery information, including your delivery address: 2 years from dispatch, unless a particular record must be kept longer for accounting or legal purposes.

Transactional email records: 12 months.

Failed and abandoned checkout information: 6 months.

At the end of these periods we review the records before removing them. Nothing is deleted automatically today, so if you would like your information removed sooner, email us and we will do so wherever we are not required to keep it.

Security

Customer and enquiry records are stored in our backend with access controls that restrict them to authorised Finch staff accounts. Payment card data is handled entirely by Stripe. Downloadable learning materials are held in private storage and issued through individual, time-limited links rather than public web addresses.

Your rights

You have the right to ask for a copy of your information, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable form, in the circumstances the law provides.

To exercise any of these rights, email hello@finchlearning.com. If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office (ico.org.uk), though we would appreciate the chance to put things right first.