Privacy Policy

Who we are

Nuliko is operated by Nuliko Ltd, a company registered in England and Wales.

• Company number: 17401531
• Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
• Contact: hello@nuliko.com

What this policy covers

This policy explains what personal data we collect when you use Nuliko, why we collect it, how we use it, who we share it with, and your rights. It covers data about parents/guardians (account holders) and children (whose learning activity is managed through a parent account).

Data we collect about parents

• Email address — to create your account, verify your identity, and send service emails (verification codes, password resets).
• Password — stored securely using bcrypt hashing. We never store or see your actual password.
• Payment information — processed by Stripe. Card details never touch our servers. We store only a reference to the transaction.
• Support correspondence — if you email us, we keep the conversation to help you.

Data we collect about children

Children do not create accounts or log in directly. A parent creates and manages child profiles.

• First name or nickname — so the parent can identify the child in their dashboard. We do not require a surname.
• Age and year group — to personalise learning content to the correct level.
• Learner context — optional free-text fields (schooling, skills, interests) the parent provides to improve personalisation.
• Photos of handwritten work — uploaded by the parent for AI assessment. Stored in a private storage bucket.
• AI-generated feedback and scores — produced by processing the child's submitted work.
• Learning progress history — session records, scores over time, strand mastery levels, XP.

Why we collect this data (lawful basis)

For children's data specifically, the parent provides consent on their child's behalf as the account holder and data subject representative.

How AI is used

Nuliko uses Anthropic's Claude API to:

• Generate personalised learning guides, passages, and maths problems
• Read handwriting from uploaded photos (OCR)
• Assess submitted work and provide feedback
• Generate progress summaries

Important: Anthropic does not use data submitted via its commercial API to train its models. Photos and text are processed to generate a response and are not retained by Anthropic for training purposes. See How Nuliko Uses AI for more detail.

Third parties we share data with

We do not sell data to anyone. We do not share children's data with advertisers.

International transfers

Some processors (Anthropic, Vercel) may process data in the United States. Where this occurs, appropriate safeguards are in place (Standard Contractual Clauses or equivalent). Supabase hosts our database in the EU.

How long we keep data

• Active accounts: data is kept for as long as the account is active.
• Inactive accounts: if no login or session activity for 2 years, we will notify the parent and then delete the account and all associated data.
• Deleted accounts: all data is permanently removed within 30 days of a deletion request.
• Uploaded photos: kept for the lifetime of the child profile (deleted when the profile or account is deleted).
• Payment records: kept for 7 years as required by UK tax law.
• Verification/reset codes: expire after 15 minutes and are cleaned up regularly.

Your rights

Under UK GDPR, you have the right to:

• Access — request a copy of all data we hold about you and your child.
• Correction — ask us to correct inaccurate data.
• Deletion — ask us to delete your account and all associated data.
• Data portability — receive your data in a structured, common format.
• Object — object to processing based on legitimate interest.
• Withdraw consent — withdraw consent for marketing at any time.

To exercise any of these rights, email hello@nuliko.com. We aim to respond within 30 days.

Children's data — additional protections

We recognise that children's data deserves extra care. We follow the ICO's Age Appropriate Design Code:

• Children cannot create accounts — only parents can.
• We collect the minimum data needed (first name, age, submitted work).
• Default settings are privacy-protective (no public sharing, no leaderboards visible to children).
• We do not use children's data for advertising or profiling.
• Parents have full control to view, edit, and delete their child's data at any time.

See also: Children's Privacy (plain language)

Cookies & Analytics

We use strictly necessary cookies (login session) which are always on. With your consent, we also use Google Analytics (GA4) to understand how the site is used so we can improve it. Analytics cookies are off by default and only load if you click "Accept analytics" on our cookie banner. You can change your choice any time via "Cookie Settings" in the footer. We never send children's names, writing content, or personal identifiers to Google Analytics. See our Cookie Policy for details.

Complaints

If you are not happy with how we handle your data, please contact us first at hello@nuliko.com. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.

Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify you by email. The "Last updated" date at the top of this page shows when it was last revised.