Privacy policy

AltEd (alted.ac) is a portal for alternative education in the UK, connecting home-educating families with tutors and education providers. In this policy "we" means AltEd, and "you" means the account holder using the service. For the personal data described below, AltEd is the data controller unless stated otherwise, and we operate under UK data-protection law (the UK GDPR and the Data Protection Act 2018).

• Account details — your name and email address, used to sign you in (by magic link — or the six-digit code in the same email, which works once and only for 15 minutes — password, passkey or a linked Google, Microsoft or Apple account) and to send you service emails.
• Student information entered by guardians — a student's first and last name, date of birth, and any notes a guardian chooses to record. Learners don't sign up themselves: their profiles are created and managed by their guardian, who may also give a learner their own sign-in — an email address, or a password the guardian sets — and can change or remove it.
• Education records you create — curricula, lessons, assignments, resources, calendar events, session records, and the notes attached to them.
• Billing records — lesson prices, session charges, credits and the resulting transaction history between a provider and a family. Card details themselves never touch AltEd (see Payments below).
• Technical data — your browser type, device and IP address, collected automatically to keep the service secure and working.
• Class requests — if you tell us on Find a class what you're looking for, the subject and the words you type, who it's for and where, your name and email address, and the search you were on. You don't need an account to send one.
• Your provider listing — if you choose to be listed as a provider, your name, picture, headline and bio, the subjects and ages you say you teach, and your open classes are shown to families: on Connect with a provider, on Find a class and on your public page. The subjects and ages of your open classes, and of the courses they follow, count towards what families can search you by. Turning the listing off takes all of it down.

AltEd is used by adults. Information about children (a student's name, date of birth and guardian-written notes) is entered and controlled by their guardian, who decides what to record and which providers may see it. We use that information solely to provide the service to the guardian and their chosen providers — never for advertising, profiling or any other purpose. Guardians can edit or delete a student profile at any time.

A learner their guardian has given their own sign-in can message the tutors and providers their guardian is connected to, and be messaged by them. Their guardian is always in every such conversation, and in any group the learner is added to, reads everything in it, and is told when the learner shares contact details. There is no messaging from the private link a guardian shares. Anything flagged or reported in a conversation with a learner in it is read by AltEd's moderators, never by AI.

• To provide the service — store and display your records, run the shared calendar, keep the provider↔family ledger accurate, and deliver sign-in links.
• To send service emails — magic links, verification emails and important account messages are delivered through our email provider, Brevo.
• To keep you up to date by email, as you choose — the notifications you have email on for; when a learner hands in, ticks off or logs work, one email listing it once they pause; each evening, a summary of your learners' day from your own records (what they did, how their plans and targets stand, what's next); and, for a learner with their own sign-in and a confirmed address, a morning summary of their own tasks, work and topics and an email when new work is set for them; and, for a provider, a few emails about what their classes are missing that families look for — further apart each time, at most four, and none once their classes are complete. These are worked out by AltEd from your records — no AI — and sent through Brevo, only to the account's own confirmed address. Each one can be switched off in Settings, or with the link in the email.
• To take payments — card payments are processed by Stripe; we receive confirmation of payment but never see or store full card numbers. We email you a confirmation of what you bought or subscribed to, with links to Stripe's receipt and invoice. If a payment is refunded in full, we take back what it bought and tell our team which account it was, so they can check it.
• To keep the service secure — diagnose problems, prevent abuse and protect accounts.
• To keep conversations safe — every message, and the note sent with a request to connect, is checked against AltEd's own rules as it is sent, on our own servers, with no AI and no third party involved (only a message the rules or a person flag is then read by AI — see below). Swearing is hidden from the person reading it; a phone number, email address, messaging app or bank details bring a notice (and a family is told, by the bell and by email, when their tutor shares contact details); and a message that looks harmful — above all to a child — is shown to AltEd's moderators, or held for them before the other person sees it. Either person in a conversation can report a message or the other person.
• To run group conversations — a provider can add families they work with to a group. Everyone in a group sees the others' names (never their email addresses) and what they write there; someone added later sees only what is written after they join. A family can leave a group at any time, and leaves a provider's groups when they end their connection with that provider.
• To moderate — when screening holds a message or someone reports one, the report keeps a copy of that message (for a report about a person, the last twenty messages both people could see), who reported it and why, so a moderator can decide even if the conversation later ends. Moderators' decisions — removing a message, a warning, a restriction on sending messages, a suspension, and the answer to an appeal — are recorded, and the person a decision is about is told what it was and why. An appeal is kept with the suspension it answers.
• To check flagged messages first — a message screening holds or flags, a note with a request to connect that it flags, and a message or note someone reports are read by AI (OpenAI) before a moderator sees them. AltEd sends OpenAI the flagged words, up to six messages before them in the same conversation, whether each writer is the tutor or the family (never anyone's name or account), what the rules noticed or the reason the reporter chose, and anything the reporter wrote. When the AI is sure a message is fine, it is delivered or the report is closed; when it is sure a message breaks the guidelines, the message is removed and its sender is told which guideline, in AltEd's own words; anything less goes to a moderator. The AI never reads a conversation a learner is in, never decides anything about a child's safety, never warns, restricts or suspends anyone, and never decides the same words twice — a report after its decision goes to a person. This is part of keeping AltEd safe, so no setting switches it off; AltEd pays for it. If you think the AI got something wrong, report the message again, or contact us, and a person will look.
• To answer a class request, or a question about a listing its provider hasn't claimed yet — an administrator reads it, looks for a tutor or co-op who runs that class (and may ask one to list it on AltEd, without passing on your details), and writes back to the email address you gave. A question about an unclaimed listing is kept with that listing, and when we invite the provider we tell them how many families asked and about which class — never who you are or what you wrote. Nothing else is done with it.

We do not run advertising, we do not sell personal data, and we do not use your records (or your children's) to train advertising or profiling systems.

AltEd can draft a written summary of a learner's records — the sort of thing a local authority might ask a family to provide — and suggest the details of a portfolio entry from a photo of a learner's work. These are off by default and do nothing unless a guardian switches on "Let AltEd draft from your records" in Settings.

Separately, a guardian can switch on "Let your learners' tutors use AI too". Only then can a tutor they are connected with use AI on that guardian's learners: to write up the tutor's own notes on a session as a report for the family, and to read a photo of the learner's work into a portfolio entry. The guardian's switch decides this — a tutor cannot turn it on. A session report sends OpenAI the tutor's notes, the learner's first name, the session's name, date and length, the title of any lesson already recorded for it, and the titles of the tutor's own lessons with their course titles. The report is shown to the tutor to edit, and reaches the family only when the tutor shares it; the family is told when AI helped write it.

A guardian with "Let AltEd draft from your records" on can also ask for a short read of a learner's last week. When they press the button, AltEd sends OpenAI the learner's first name and that week's records: days and hours logged and the number of absence days, the names of sessions booked (the class or tuition name) with how many were attended, missed or cancelled, the titles of work finished, marked (with marks) and still overdue, the progress log's counts of tasks, progress entries, events, notes and incidents with the titles of progress entries and events, how many things the learner recorded are waiting for a look, portfolio titles, curriculum topics ticked off, and up to four reports tutors shared with the family that week. The result is kept for the family on their home page; tutors never see it. A Monday reminder tells the family the week is ready — it sends nothing to OpenAI.

Whoever set a piece of work can ask AI to draft the feedback and suggest a mark — a family for work they set, on "Let AltEd draft from your records"; a connected tutor, only when the family has "Let your learners' tutors use AI too" on. When they press the button, AltEd sends OpenAI the learner's first name, the work's title, instructions and maximum score, the linked lesson's title and its specification topics with some of their curriculum statements, the marker's notes, any answers the setter kept with the work and, if they add one, a photo of the work. The draft goes back into the marker's form; nothing is marked until they save it, and the reason for a suggested score is shown only to the marker.

A guardian with "Let AltEd draft from your records" on can also ask AI to explain the gaps AltEd finds in a learner's plans and records. Finding the gaps sends nothing anywhere. Explaining them sends OpenAI the learner's first name and those gaps: plan titles and the topics behind schedule, target names with how often they were met, and the readiness questions with what the records show.

Reading a photo sends OpenAI the photo, the learner's first name, the subjects already in the learner's portfolio and — when the person asking keeps curriculum plans for that learner — the titles of those plans and their topics. The suggestions go back into the form they came from, and nothing is saved until the person asking saves it.

Whoever sets a piece of work can ask AI to draft practice questions with worked answers. That sends OpenAI the linked lesson's title, content and specification topics, the work's title, and the level, difficulty and number of questions chosen — nothing about the learner. The questions go into the work's instructions and the answers into a box only the person who set the work can see; nothing is set until they set it.

When a guardian has "Let AltEd draft from your records" on, what their child logs on their own page — the words they type and, if they add one, a photo of their work — is sent to OpenAI straight away, without anyone pressing a button, with the child's first name and the titles of the topics still to do in the plans that reach them. The reading is shown only to the guardian, who decides what goes into the log and which topics are ticked; it is never shown to the child, and nothing is sent while the switch is off. An adult recording progress can also ask for a reading, which sends their notes, a photo they choose, the learner's first name and the topic titles of their own plans for that learner.

A provider's home page lists learners who may need attention — sessions missed, work overdue, marks falling, a message left unread — worked out by AltEd without AI. Asking AI to explain and order them sends OpenAI those warnings (learners' first names, work titles, a family's name, and the counts and percentages involved), and only warnings about families who have "Let your learners' tutors use AI too" on.

Messages can use AI too, and the family's switches decide here as well: a family on "Let AltEd draft from your records", and a tutor only when that family has "Let your learners' tutors use AI too" on. Drafting a reply sends OpenAI the last twelve messages the two of them wrote in that one conversation with when each was sent, the other person's name, whether the writer is the family or the tutor, and any note the writer adds; the draft goes into the writer's reply box and nothing is sent until they press Send. "What needs a reply?" sends the other person's name and up to three unread messages from each of the twenty most recent unread conversations the family has allowed, and only labels them — nothing is stored or marked read.

A tutor or co-op can have their own advertising read into classes. That sends OpenAI the pictures they add — up to three — and anything they type alongside them; nothing about a learner or a family, and nothing already held by AltEd. What comes back is a proposal on screen: the classes, their courses, their prices and their times, every field editable, and nothing is created until they press the button.

Signed in, you can describe the class you're looking for in your own words on Find a class. When you press the button, AltEd sends OpenAI only the words you typed and the subjects of the classes currently listed in the public directory — nothing about your account or your learners. What comes back only fills in the directory's filters for you to check before searching, and names — in AltEd's own words — anything the filters can't cover.

When Find a class has few classes for a search, anyone — signed in or not — can press Search the wider web. AltEd sends Serper, a web-search service, the words and the place you searched for (or that you want online lessons), and sends OpenAI what the search returns — each page's title, address and the search engine's short extract — with the same words, so it can tell tutors and classes from everything else and put them in order. Nothing about you or your account is sent to either. The answer is kept for a week, so the same search from anyone else is answered without being sent again. The words and place are also kept — with nothing about who searched — as one of the searches AltEd's own look for tutors repeats (see Tutors found on the web).

Anyone planning a course on Courses & lessons can ask AI to propose one. When they press the button, AltEd sends OpenAI the level, the number and length of lessons they asked for, the chosen specification's title, level and subject and its topics' codes, titles and place in the outline, and any syllabus or notes they paste in. No learner's details are sent. The proposal goes back to them to change, and no course is created until they create it.

One other feature can reach OpenAI: when you build a timetable from your curriculum plans, you can ask for help deciding how much of the week each subject should get. That sends the subject names, the hours involved and, when you combine timetables, their names — never a learner's work, marks or attendance — and only when you tick the box on that screen. It is separate from the setting above, because it is asked for once rather than switched on.

Two more reach OpenAI only when you press their button, each time, and are charged in AI credits. When you import your own curriculum — or add to a plan from an updated copy of it — AltEd sends OpenAI the text of the document you upload, or the photos or scanned pages you add (written out first, then read like a document), to find its subjects, weeks and topics; adding to a plan sends only that, with the name of the plan's subject. Your file and photos are never kept — only the file's name, on your AI credits history and AltEd's own record of what AI costs: an import keeps the document's text only while it is open and deletes it once the plans are built or the import is cancelled, and an update keeps nothing but the topics you choose to add. When you add a specification the catalogue doesn't have, AltEd sends OpenAI the board's own published document — nothing about you or a learner.

When you switch it on and then press the button to draft a summary, we send a condensed description of what you have recorded for that learner and period to OpenAI, which operates the language model that writes the draft. That description contains: the learner's first name and age (not their date of birth), the period covered, the number of days and hours logged and how they were categorised, the subjects studied with counts of work set, completed and marked and any averages, the titles, dates, kinds and descriptions of portfolio evidence, and how many providers taught them and how many sessions they delivered (not the providers' names).

Nothing is sent in the background, on a schedule, or without somebody pressing the button. We do not use your records to train any model, and you can see the exact list of facts a summary was written from underneath the draft itself.

A summary is a draft belonging to you. AltEd does not store it, file it, or send it to anybody — including your local authority. Switching either setting off in Settings stops that use immediately, and nothing else in AltEd depends on them.

A wider-web search on Find a class shows what a public search engine returns for it: a page's title and address and the engine's short extract, with a link to the page, marked as found on the web, not on AltEd and not checked by us. What a search returned is kept for a week and then deleted.

AltEd also looks for tutors, tuition centres, co-ops and clubs on the web itself, so that families can find more of them. It searches for common subjects in UK towns and for what families have searched for on Find a class — a wider-web search sets it reading the first few sites it found straight away, and tells the family it is adding them — and reads the public pages of the sites it finds — only pages anyone can open, never behind a login, and never a site whose robots.txt asks crawlers not to (AltEd's crawler is called AltEdBot). From what a provider says about themselves there, AltEd prepares a draft listing: their name, what they teach, where and how, their classes, times and prices, a few pictures from their site (kept with the address they came from), and the contact email address and phone number the site publishes. The reading is done by a model from OpenAI; nothing about any family or learner is involved. A draft is seen only by AltEd's administrators, and nobody is emailed or told anything when one is made. An administrator checks each one — and may ask the model to read the site again for something it missed — before publishing it. A published listing appears on Find a class marked “Not yet claimed” (taken from the provider's own website and not yet confirmed by them), never with their contact details, and a family's question about it comes to AltEd rather than to the provider.

If a draft or a listing is about you: AltEd relies on its legitimate interest in helping families find education providers and in inviting providers to join. We tell you when we first get in touch — an email from AltEd to the address your website publishes, saying what we found and where, linking to this policy, and carrying a “Don't contact me again” link that takes the listing down, stops us reading your site and stops every further email — and, on the same page, lets you delete the listing and everything we hold about it yourself, keeping only your website's address so it is never read again. If families have asked about the listing, the invitation says how many and about which class, never who asked or what they wrote. You can also ask us at any time to show you what we hold, correct it, or delete it and never read your site again — contact us, or add AltEdBot to your site's robots.txt. If a page about you appears in a wider-web search and you would rather it didn't, contact us and we will stop showing it.

If you claim the listing: the invitation's link asks for the email address you want to use, and we send it a sign-in link. Following it confirms the address is yours; the listing then becomes your AltEd account, that address becomes your sign-in, and everything in this policy about providers applies to you. We keep a record of each invitation we send and of the claim.

We share data only with the processors needed to run the service:

• Stripe — to process card payments between families and providers.
• Brevo — to deliver sign-in links and codes, and the emails the service sends.
• Your browser's notification service (Google, Apple, Mozilla or Microsoft) — only if you turn on notifications on a device, to carry them to it, encrypted so that only your device can read them. See On your device below.
• Serper — to run a wider-web search when somebody asks for one on Find a class, with only the words and place searched for.
• OpenAI — when a guardian switches on AI drafting (for themselves, or for their learners' tutors) and somebody presses the button, and when you ask for help laying out a timetable. See the section below.
• Our hosting provider — to run the application and store its database securely.
• Google (Google Tag Manager and Google Analytics) — to count visits to AltEd's public pages, only when you agree to analytics cookies. See Cookies and analytics below.
• PostHog, in the EU — to report errors on AltEd's pages and servers so we can fix them, and, only when you agree, to record how pages are used. See Cookies and analytics below.

Within the product itself, information is shared only as the service is designed to share it: a provider you work with sees the students, sessions and ledger entries that involve them, and nothing else.

AltEd uses cookies it needs to work — the one that keeps you signed in, and the ones that protect sign-in — and these need no permission. It sets no others unless you agree.

On AltEd's public pages — the home page, features, pricing, guides, Find a class, providers' public pages and the like — we ask whether we may count visits. If you say yes, Google Tag Manager loads Google Analytics, which sets cookies (named _ga) and sends Google the page you are on, the page you came from, your browser and device type and a rough location worked out from your internet address, so we can see which pages are useful. Advertising and ad personalisation are switched off. If you say no, or don't answer, nothing from Google loads at all, and a browser sending Global Privacy Control is treated as no without being asked.

Google Analytics never runs inside AltEd: not in your account, not on a learner's own page or shared link, and not on the sign-in pages. Moving from a public page into any of them reloads the page without it.

If you say yes, PostHog also records how pages are used — where people click and how far they scroll, as a replay we can watch — on the public pages and, for a parent, guardian or tutor who is signed in, inside their account. Everything on the page you read or type is hidden in the recording and pictures are left out, so a replay shows the layout and the clicks, not names or what was written. It isn't linked to your name or email address. It never records a learner's own page or shared link, the sign-in pages, or AltEd's administration.

Whatever you answer, when something goes wrong on a page or on our servers, AltEd sends PostHog an error report: what failed, the page's address with its private parts removed (a learner's shared-link code, anything after a question mark), and your browser and device type. It isn't linked to your account. We rely on our legitimate interest in keeping AltEd working for this.

PostHog stores nothing on your device — no cookie and no local storage — so each visit is anonymous, and saying no needs nothing cleared.

So that we can see which pages lead people to join, two more things are counted for a visitor who said yes. On the public pages: pressing a link to sign in or to your account (with the words on the link and whether it sat in the header, the footer or the page), asking a tutor about a class or asking us to find one, searching the wider web from Find a class, and printing from the free record builder — never what you typed. And when you create an account in the same browser, AltEd's server tells Google Analytics that the visit led to an account, and how you signed up (an email link, a password, or Google, Apple or Microsoft), using the same analytics cookie — never your name, your email address or anything else about the account. Without the analytics cookie, nothing is sent.

Your answer is kept in your browser. To change it, choose Cookie settings at the foot of any public page, or Account & security in Settings when you are signed in; saying no removes the analytics cookies from AltEd and stops any recording.

So that AltEd works without a connection, your browser keeps copies of the pages you open while signed in, and of the main pages of your own menu — with the pictures on them and the lists they show — and of AltEd's own files. It brings them up to date when it can, and deletes a copy of any page you can no longer open. They stay on that device, in that browser, and are never sent anywhere. Signing out deletes them, and so do deleting your account, coming back to the sign-in page after your sign-in has ended, and a different person signing in on the same browser. You can see how many there are, and delete them, in Settings › This device.

Changes you make with no connection — a tick, a log line, an event, a note's words, a message — are kept in the same place until AltEd can be reached, then sent and deleted from the device. Signing out deletes any still waiting, after AltEd has told you how many. Each change sent from a screen that works offline carries a random id; when AltEd makes the change it keeps the id with its answer for a week, so that a change sent twice is only made once. A change is only ever sent for the person who made it — under anyone else's sign-in it is refused.

If you turn on Notifications on this device, your browser gives AltEd an address at its maker's notification service (Google, Apple, Mozilla or Microsoft, depending on the browser) and the name of the browser and system ("Chrome on Android"). AltEd sends the notifications that ring your bell there, encrypted so that only your device can read them. On the lock screen they say only that there is something new in AltEd, unless you turn on Show details on the lock screen for that device — then they say who and what, such as a learner's name or a message's first words, to anyone who can see it. The address is deleted when you turn them off, when the device stops accepting them, or with your account; signing out on that device turns them off.

Nothing is kept for a learner's shared link, for AltEd's administrators, or while an administrator is viewing AltEd as someone else.

Access to your data is scoped to your account and role, transmitted over encrypted connections, and protected by industry-standard safeguards. No system is perfectly secure, but we treat the fact that this service holds information about children as a reason to hold ourselves to a higher bar, not a footnote.

Under UK data-protection law you can request access to, correction of, or deletion of personal data, object to certain processing, and complain to the Information Commissioner's Office (ico.org.uk). Guardians exercise these rights on behalf of the children whose profiles they manage. To make a request, contact us using the details below.

We keep your data for as long as your account is active. When you close your account we delete or anonymise your personal data — including student profiles — except where we must keep records (for example, payment records) to meet legal obligations.

A class request is deleted a year after it was sent, or sooner if you ask us to. One sent while you were signed in also goes when your account does.

When you reach something your plan doesn't include — another subject, the education record, more AI credits — we note which one and the day, so we can see which limits get in people's way and shape our plans around them. It is kept in AltEd, never shared, deleted after 13 months, and goes when your account does.

When a report or a screened message is closed with no action, the copy of the words kept with it is deleted after 90 days; the fact that it happened stays. A report that led to action — a message removed, a warning or a restriction — keeps its copy of the words for two years after the decision. Anything about a child's safety, anything marked urgent, and anything that led to a suspension keeps its words for six years, the UK's general limitation period; for six years after the latest of these, an account that has them is not erased (it stays closed and hidden), and it is erased as usual after that. The fact that a report was made and what was decided stays for as long as the account does.

Questions about this policy or your data? Email us at info@alted.ac.