Privacy Policy
Last updated: 10 October 2026
Who we are
Flow28 Ltd (company no. 17036844) provides Socratic Compass — Home, a GCSE tutoring product for UK families. ICO registration: ZC101012. Registered office: 20 Elmbridge Drive, Ruislip HA4 7UT. Contact: hello@socraticcompass.co.uk.
What this product does
A learner can try the real tutor for five questions in each subject, up to 20 in total, without an account. To keep going, the learner creates their own login (email and password, or Google) and asks a parent or guardian to approve their account and subscribe. A parent can also sign up first and invite their child by email. Try messages are checked for safety and are not attached to the learner account created later. The approval page shows the parent which subjects the learner tried and how many questions they asked, never the messages themselves. Parents have their own login and a dashboard showing activity, learning reports, alerts and billing. Parents never see chat transcripts. This is not live or emergency monitoring.
Data we process
We process parent or guardian email addresses and login details, the learner's email address and login details, learner nicknames, school year, subject and exam-board choices, tutoring session records and activity statistics (for example questions asked, days active and subjects studied), optional comments when a learner flags a tutor reply or a parent tells us why they did not subscribe, optional learner flags (reason, page address, account identifiers, and a screenshot of the screen when capture succeeds), safeguarding decision logs, billing status, and technical logs needed to run the service. If you accept analytics on a marketing page, we also process how you found that page and which marketing pages you visited. We do not ask for the child's legal name. We suggest a personal email for the learner rather than a school one, because school accounts often block outside email and close when the child leaves.
Why we process it
We process this data to provide tutoring, let parents and learners sign in on any device, take parent consent, show parents progress without transcripts, keep a safeguarding record, bill the household after the parent subscribes, and meet UK GDPR and child-safety duties. The legal bases are contract, legitimate interests in running a safe tutoring service, and consent where the parent approves a child account. A parent or guardian must approve every learner, including all learners under 13. Optional marketing analytics run only if you click Accept on the cookie banner. The tutor, try, and parent dashboard never send analytics to Google.
Where data is stored
The application and databases run on UK or EEA infrastructure. Tutoring inference uses Google Vertex AI in the EU. We do not send learner chat to a US consumer LLM API, and we do not sell learner chat to train commercial models. If you accept analytics on a marketing page, Google processes that visit data under its terms.
Who we share data with
We share data with processors who host the app and send email, and with our payment provider and our authentication provider. If you accept analytics on a marketing page, we use Google Analytics to count visits. That does not run on the tutor, and we do not use it for advertising. We share a safeguarding alert with the verified parent or guardian when automated checks flag a serious concern. During a try, before any parent is linked, a serious concern is flagged to Socratic Compass staff only. A learner can flag a tutor reply; that flag goes to Socratic Compass staff and does not automatically email the parent. We share data with police or child-protection services if the law requires it.
How long we keep it
Try messages are deleted within 48 hours; the safeguarding decision log for a try is kept without the message text. We keep account and tutoring records for as long as the household subscription is active, then for a limited period needed for billing disputes, safeguarding records, and legal hold. You can ask us to export or delete learner data using the contact email above.
Your rights
Under UK GDPR you can ask for access, correction, deletion, restriction, or portability, and you can object to processing based on legitimate interests. You can complain to the ICO (ico.org.uk). A parent or guardian exercises these rights for a child account.