Privacy Policy
Twinoaks is the controller of personal data processed through ChemOrchard. Contact: bjedug14@gmail.com. We follow the UK GDPR and the Data Protection Act 2018.
1. What we collect
| Data | Why | Lawful basis | Kept for |
|---|---|---|---|
| Visiting the free pages: no account, no analytics, no tracking. | — | — | — |
| Technical logs from our host (IP address, browser, time, page) | Security, preventing abuse | Legitimate interests | Up to 30 days |
| Teacher account: name, email, school (optional), password (stored only as a salted hash), plan and access dates, when you accepted the terms | Providing the subscription | Contract | While the account is open; deleted when you delete it (billing records see below) |
| Class codes: the code and the class name the teacher types | Letting a class open the material | Contract (with the teacher) | Until the teacher deletes the code or the account |
| Login sessions (random token, stored hashed) and sign-in attempts (IP address or email, time) | Keeping you logged in, stopping password guessing | Contract / legitimate interests | Sessions up to 30 days; attempts 24 hours |
| Payment records (amount, date, invoice; no full card numbers) | Accounting and tax | Legal obligation | 6 years |
| Emails you send us | Answering you | Legitimate interests | 2 years |
2. Students and children
Students use the site without accounts: they type their teacher's class code and get a session that lasts 8 hours. We do not ask for, or knowingly collect, data about children. Teachers should name classes by group (for example "10B"), never with pupils' names. Progress in the question bank and some tools is saved only in the student's own browser (local storage) and never sent to us. We do not profile, advertise to, or share data about anyone.
3. Who else is involved
- Cloudflare — hosting and security (processor).
- Payment provider named at checkout — takes payments (its own controller for payment data).
- Google Fonts and jsDelivr — deliver fonts and some program libraries; your browser contacts them and they see your IP address. They set no cookies for us.
Some of these providers process data outside the UK; they do so under UK adequacy regulations or the UK International Data Transfer Addendum.
4. Your rights
You can ask for a copy of your data, its correction or deletion, to restrict or object to its use, and to receive it in a portable format. Write to bjedug14@gmail.com; we answer within one month. You can also complain to the Information Commissioner's Office (ico.org.uk) or your local data protection authority.
5. Security
Encrypted connections (HTTPS) only, passwords stored hashed, access to data limited to the people who run the service.
Last updated 15 November 2026.