Privacy Notice
How we look after your family's information
BrightSteps exists to give parents an honest picture of where their child stands in GCSE Maths. That only works if you can trust us with the information involved — so this notice explains, in plain English, exactly what we collect, why, and what your rights are.
Who we are
BrightSteps is run by Rayyan Akram, trading as BrightSteps, a sole trader based in the United Kingdom. For data protection purposes, Rayyan Akram is the "data controller" — the person responsible for deciding how and why your information is used.
Contact for anything in this notice:
- Email: rayyanakram01@gmail.com
- WhatsApp: +44 7507 629090
What we collect
We deliberately collect as little as the product needs. When your child takes a BrightSteps diagnostic, we collect:
| Information | Where it comes from |
|---|---|
| Your child's first name | Entered by you when setting up the test |
| Your name and email address | Entered by you when setting up the test |
| Diagnostic answers and results — the questions answered, the answers given, and the strengths and gaps our analysis identifies | Generated when your child completes the test |
| Messages you send us | WhatsApp or email, when you contact us about a report or consultation |
| Basic technical information — such as browser type, needed to make the site work | Collected automatically by our hosting providers |
We do not collect your child's surname, date of birth, school, or any contact details for your child. We never ask your child to communicate with us directly.
Why we use it
- To deliver what you've asked for — running the diagnostic, generating the Snapshot and (if purchased) the Full Report and Learning Roadmap. Legal basis: performing our contract with you.
- To respond to you — answering messages, arranging consultations, taking payment. Legal basis: performing our contract with you, or taking steps you've asked for before entering one.
- To improve the product — reviewing anonymised patterns in results to make the diagnostic more accurate. Legal basis: our legitimate interest in building a better product, done in a way that doesn't identify your child.
- To send you marketing — only if you have clearly agreed to it, and you can opt out at any time. Legal basis: your consent.
We do not sell your information, share it with advertisers, or use it for advertising of any kind.
Children's information
The diagnostic is about your child, so their first name and performance data are at the heart of what we hold — and we treat that with particular care. BrightSteps is designed to be set up and managed by a parent or guardian: you enter the details, you receive the results, and all communication is with you, not your child.
A note on how the diagnostic works, because we think it matters: no AI makes decisions about your child inside the diagnostic. Every finding in a BrightSteps report is matched against documented evidence from real GCSE examiner reports by a rules-based system we built by hand. There is no automated decision-making that produces legal or similarly significant effects about you or your child.
Where it's stored and who helps us
Your information is stored and processed by a small number of service providers who act on our instructions:
- Supabase — the secure database where diagnostic submissions and results are held
- Lovable — hosts the diagnostic application
- Netlify — hosts this website
- Meta (WhatsApp) — carries the messages you send us
- Google — our email and internal document storage
Some of these providers store information outside the UK. Where that happens, transfers are protected by legally recognised safeguards such as the UK's international data transfer agreements and standard contractual clauses.
Your child's results are also saved in your own browser on the device used for the test, so the report can be shown to you again on that device. Clearing your browser data removes that local copy.
How long we keep it
We keep diagnostic submissions and results for 12 months after your last activity with us, after which they are deleted. If you ask us to delete your family's information sooner, we will — see your rights below.
Your rights
Under UK data protection law, you can ask us to:
- Show you the information we hold about you and your child ("subject access")
- Correct anything that's wrong
- Delete your family's information
- Limit or object to how we use it
- Give you a copy of your information in a portable format
- Withdraw consent at any time, where consent is what we rely on
To use any of these rights, message us on WhatsApp or email rayyanakram01@gmail.com. We'll respond within one month.
If you're unhappy with how we've handled your information, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office: ico.org.uk or 0303 123 1113. We'd appreciate the chance to put things right first, but you don't have to come to us before going to them.
Cookies and local storage
This site does not use advertising or tracking cookies. The diagnostic application uses your browser's local storage for one purpose: keeping your child's test session and results available on your device. Our hosting providers may set strictly necessary cookies needed for the site to function.
Changes to this notice
If we change how we handle your information, we'll update this page and the date at the top. If a change is significant — for example, a new purpose for using your child's data — we'll tell you directly before it takes effect.