Privacy Policy
Last updated: 8 October 2026. This policy applies to www.knowitallninja.com, help.knowitallninja.com and the emails we send. It replaces all earlier versions.
Contents
- The short version
- Who we are and how to contact us
- Who this policy covers, and our role
- What we collect, why, and on what legal basis
- If you are a student
- Who we share data with
- Cookies and similar technologies
- How long we keep personal data
- Where data is kept and international transfers
- How we protect personal data
- Your rights
- Changes to this policy
1. The short version
KnowItAll Ninja is a revision and homework website for GCSE, BTEC, T Level and similar courses. Most of the people who use it are teachers, and students aged 14 to 18 whose school has bought a membership. This section is the summary; the rest of the policy has the detail.
- We only collect what the site needs to work. For a student that is a name, a login and a password, plus the progress, marks and points you earn as you learn.
- We never sell personal data and we never show adverts inside the courses.
- Your school controls student accounts. If a teacher created your account, your school decides who can see your progress and can correct or delete your details. We process that data on the school’s behalf.
- Teachers can see how their students are doing. That is the point of the site: marks, attempts, answers, time spent and tasks completed are visible to the teachers of your class.
- The leaderboard is optional. Schools can switch it off and students can leave it.
- Analytics and advertising cookies are off until you accept them. Only the cookies needed to log you in and keep your basket are set automatically.
- Payment card details never touch our servers. Stripe and PayPal handle them.
- You have rights over your data, including seeing it, correcting it and having it deleted. Section 11 explains how.
2. Who we are and how to contact us
The website is run by KnowItAll Ninja Limited, a company registered in England and Wales under company number 14339425. Our registered office is 14 Swords Drive, Crowthorne, England, RG45 6GS. VAT registration number GB382570091.
For anything to do with personal data, including exercising your rights, email [email protected], call +44 7442 389612, or write to the address above. We are a small company and do not have a statutory Data Protection Officer; privacy questions are handled by the company director.
3. Who this policy covers, and our role
Under UK data protection law (the UK GDPR and the Data Protection Act 2018) an organisation is either a “controller”, which decides why and how personal data is used, or a “processor”, which handles it on a controller’s instructions. We are both, depending on who you are.
| Who you are | Our role | What that means |
|---|---|---|
| A visitor to the website | Controller | We decide what is collected while you browse, and this policy tells you what that is. |
| A teacher or school staff member who registers, requests a free trial or buys a membership | Controller | We hold your account and order details to provide and bill the service. |
| A student on a school membership (account created by your school, or by you using a class join link or code) | Processor, for your school | Your school is the controller. It decides what is collected, can see and correct your details, and can delete your account. Each school signs a Data Processing Agreement with us; a copy is on our GDPR page. |
| A teacher account added to a school membership by the school | Processor for the school, controller for our own records | Your school manages your role and access. We keep the account itself and our correspondence with you. |
| A parent, guardian or adult learner who buys an individual subscription, and the student it is for | Controller | We hold the purchaser’s billing details and the learner’s account and progress. |
| A newsletter subscriber, or someone who contacts us | Controller | We hold your email address and messages for that purpose. |
Accounts for children must be created by, or at the direction of, a school, or by a parent or guardian. The site is designed for students aged 14 to 18 and we do not knowingly create accounts for younger children.
4. What we collect, why, and on what legal basis
The law requires a “legal basis” for each use of personal data. The ones we rely on are: performing a contract with you (or taking steps you ask for before one), our legitimate interests in running and improving the service (where these are not outweighed by your rights), a legal obligation, and your consent.
4.1 Visiting the website
When you load a page, our hosting provider and content delivery network record technical details: your IP address, browser and device type, the page requested, the referring page, and the date and time. These logs let us keep the site running, diagnose faults and defend it against attacks. They are kept for a short period and are not combined with your account.
Legal basis: legitimate interests (security and operation of the site).
4.2 Creating and using an account
To use the courses you need an account. We hold your first name, last name, email address (which is also the username for school accounts), a password stored as a secure salted hash, your role (student, teacher or school administrator), and the school, classes and membership you belong to. Teachers can create student accounts one at a time, by uploading a CSV file, or by sharing a class join link or code. Schools that prefer anonymity can use placeholder names.
As you use the site we record what you do in the courses so the site can work and your teachers can support you: lessons opened and completed, quiz attempts, the answers you gave, marks, tasks set and completed, time spent studying, points, levels and achievements. Students on a school membership cannot change their own name or email; their school does that for them.
Students, teachers and administrators can sign in with a school Microsoft or Google account instead of a password (single sign-on). When you do, we receive your name and email address from that provider and hold no password for you. Microsoft and Google act as independent providers for the sign-in itself, and their own privacy policies apply to it. A student’s school controls whether single sign-on is used for its accounts.
Legal basis: performing our contract with you or your school; for school-created student accounts we act on the school’s instructions.
4.3 Progress tracking and the leaderboard
Teachers of a class can see each student’s progress, marks, attempts, submitted answers, study time and task results, individually and as class-wide insights. This information is not visible to other students or to other schools.
Each class has an optional leaderboard showing students’ display names and points to their classmates. Schools can disable it for a class, and where it is enabled a student can leave and rejoin it at any time from the leaderboard page. Profile pictures cannot be uploaded; the profile icon only shows the level reached.
Students with their own subscription also appear on a public leaderboard as “Hidden student”, showing only their XP, unless they choose to join, which shows their first name and last initial. Anyone can leave, or stay off it completely, at any time.
Legal basis: performing our contract with the school or subscriber; the leaderboard runs on the school’s settings and the student’s choice.
4.4 Buying a membership, subscription or resources
At checkout we collect the purchaser’s name, email address, school or organisation name, billing address, phone number if given, and, for schools paying by invoice, a purchase order number. We record what was bought, the price, VAT and the order history. Schools can also download a basket as a PDF quote to raise a purchase order.
Card payments are taken by Stripe, and PayPal payments by PayPal. Card numbers go directly to them and never pass through our systems; we receive a confirmation and a reference. Invoices are created in our accounting software, Xero, through an automated connection (Zapier), and the invoice number is stored against your order.
Legal basis: performing the contract; keeping accounting and VAT records is a legal obligation.
4.5 Free trials
Teachers can request a free trial membership by giving their name, school email address, school and the number of students. We check that the email address belongs to a school before approving the trial. Approved and declined requests are kept with our order records so we can honour the one-trial-per-school rule and answer questions about a request.
Legal basis: steps taken at your request before a contract, and our legitimate interest in preventing misuse of the trial.
4.6 Emails we send
We send service emails that are part of providing the site: account and password emails, class invitations, trial approval or decline, order confirmations, invoices, renewal reminders for a membership that is about to expire, and a follow-up after purchase to check everything is working. Some of these are automated.
We also send a small number of marketing emails to the teachers and purchasers we work with: an invitation to review us on EdTech Impact or Trustpilot, a reminder if a basket is left unfinished, and occasional information about related courses or resources that other teachers at your school might use. Every marketing email has an unsubscribe link, and you can also ask us to stop at any time. We do not send marketing emails to students.
Our fortnightly newsletter is separate and only goes to people who have signed up for it. It is sent through Kit (formerly ConvertKit) and every issue has an unsubscribe link.
Legal basis: service emails, performing the contract; marketing to existing customers, legitimate interests with the right to opt out; the newsletter, your consent.
4.7 Contacting us and support
You can contact us by email, through the contact form, or through our help centre at help.knowitallninja.com. We keep your message, your contact details and our reply so we can deal with your query and refer back to it if you contact us again. The contact form is protected by Google reCAPTCHA, which analyses browser behaviour to block automated spam.
Legal basis: legitimate interests (answering your query and running a support service), or performing the contract where the query is about your membership.
4.8 Analytics and improving the site
We use two kinds of analytics.
- Product analytics for logged-in users. Our own instance of PostHog, hosted in the European Union, records which lessons, quizzes and features are used and for how long. It is identified by account number, class and role only, never by name or email, and session recording is switched off. Teachers see some of this as study time in their class insights, and it is what tells us which lessons need improving. Requests are routed through our own domain so the data goes only to us.
- Website analytics and advertising measurement. If you accept analytics or advertising cookies we use Google Analytics 4, Google Ads conversion tracking and the Meta Pixel to understand how visitors find the public pages of the site and whether our advertising to teachers works. These tools set cookies and receive your IP address and pages viewed. They are not loaded until you accept them in the cookie banner, and you can change your choice at any time (see section 7). Cloudflare Web Analytics, which does not use cookies or identify you, runs on every page. When you buy from us or start a free trial, our server sends a record of it (what was ordered, the amount and the order number) directly to Google Analytics, so that our sales figures are accurate. If you have accepted analytics cookies, the record is linked to your existing Google Analytics cookie; if you have not, it uses no cookies and contains nothing that identifies you.
Legal basis: product analytics, legitimate interests in operating and improving the service; cookie-based analytics and advertising, your consent; sales and trial records sent from our server, your consent where they are linked to your analytics cookie, otherwise legitimate interests in measuring our sales accurately (they contain nothing that identifies you).
4.9 Reviews and social media
We display reviews from EdTech Impact on the site through their widget, and we may invite customers to review us on EdTech Impact or Trustpilot. If you leave a review, the platform’s own privacy policy applies to it. Links to our Facebook, Instagram and YouTube pages are ordinary links; nothing is sent to those companies unless you click through.
4.10 What we do not do
- We do not sell or rent personal data to anyone.
- We do not show advertising inside the courses or target students with advertising.
- We do not use geolocation, and we do not ask for or store profile photos.
- We do not make automated decisions with legal or similarly significant effects. Free trial requests are checked by a person.
- We do not collect special category data (such as health or ethnicity) and ask you not to send it to us.
5. If you are a student
This section is written for you. If your teacher set up your account, your school is in charge of your data and we look after it for them. Here is what that means in practice.
- Your teachers can see your marks, your answers, how long you spend studying and which tasks you have done. Other students cannot, except for your display name and points on the class leaderboard if your school has it switched on, and your first name, last initial and XP if you join the public leaderboard.
- If you want to leave the leaderboard, use the link on the leaderboard page. You can rejoin later.
- If your name or email address is wrong, ask your teacher: they can change it. You can change your password yourself.
- If you want your account deleted, ask your teacher or your school’s data protection lead. If you pay for your own subscription, email us instead.
- We do not show you adverts, sell your data or share it with anyone outside your school and the companies that help us run the site (section 6).
- When you have finished with the site, your account is deleted around three months after your school’s membership ends (section 8).
6. Who we share data with
We share personal data only with the people and companies below, and only for the purposes described. Each company that processes data for us is bound by a contract that meets UK GDPR requirements.
Your school. Teachers and administrators on your school’s membership can see and manage the accounts and progress of students in their classes.
Service providers (processors). These companies process data on our behalf:
| Provider | What it does for us | Where data is processed |
|---|---|---|
| Kinsta | Hosts the website and its database, and keeps backups | Belgium (EU), on Google Cloud |
| Cloudflare | Content delivery, security screening, bot protection and cookie-free web analytics | Global network; logs in the EU and US |
| PostHog | Product analytics for logged-in users (pseudonymous) | European Union |
| Google (Workspace) | Sends the site’s emails and hosts our support mailbox | EU and US |
| Google (Analytics, Ads, reCAPTCHA, Fonts) | Website analytics and advertising measurement, only with your consent; anonymous sales and trial records from our server; spam protection on forms; font files | EU and US |
| Meta Platforms | Meta Pixel for advertising measurement, only with your consent | EU and US |
| Stripe | Card payments and card subscriptions | EU, UK and US |
| PayPal | PayPal payments and PayPal subscriptions | EU and US |
| Zapier and Xero | Create invoices from orders and store our accounting records | US (Zapier); Xero, UK and international |
| Help Scout | Support inbox and help centre | US |
| Kit (ConvertKit) | Sends the newsletter to subscribers | US |
| EdTech Impact | Displays reviews on the site through an embedded widget | UK |
| CookieYes | Shows the cookie banner and records your cookie choices | EU |
| Font Awesome and jsDelivr | Serve icon fonts and small script libraries; they receive your IP address when files are fetched | Global content delivery networks |
| Vimeo and YouTube | Host videos embedded on some pages, loaded with privacy settings that limit tracking | EU and US |
Others. We will disclose personal data where the law requires it, for example to HMRC or a court, or to protect the rights and safety of users. If the business is sold or restructured, data may transfer to the new owner under this policy.
7. Cookies and similar technologies
Cookies are small files stored in your browser. Some are essential for the site to work; the rest are only set if you agree to them in the cookie banner. You can change your choice at any time by clicking the cookie icon in the corner of any page, or “Cookie settings” in the footer, and you can also delete cookies through your browser settings.
| Category | Examples | Purpose and lifetime |
|---|---|---|
| Strictly necessary (always on) | wordpress_logged_in_*, wordpress_sec_*, wp-settings-*, woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*, kian_cart_count, cookieyes-consent, __cf_bm, cf_clearance | Keep you logged in, remember your basket, remember your cookie choices, and let Cloudflare tell people from bots. Session cookies expire when you close the browser; login cookies last up to 14 days if you tick “Remember me”; the consent cookie lasts 12 months. |
| Strictly necessary (order attribution) | sbjs_* | Set by WooCommerce to record which page or link brought you to the site so that we know where orders come from. First-party only; lasts up to 6 months. |
| Functional | Browser storage key kian-theme (dark or light mode) | Remember your display preference on this device. |
| Analytics (with consent) | _ga, _ga_*; PostHog (ph_*) for logged-in users | Google Analytics measures visits to the public pages. PostHog product analytics for logged-in users uses a pseudonymous identifier and browser storage rather than a tracking cookie. _ga lasts up to 2 years. |
| Advertising (with consent) | _gcl_au, _fbp, Google Ads and DoubleClick cookies | Measure whether our advertising to teachers led to a trial or purchase, and allow Google and Meta to show relevant adverts on their platforms. Up to 3 months (_gcl_au, _fbp) or as set by Google. |
Embedded videos from Vimeo and YouTube, and the EdTech Impact reviews widget, may set their own cookies when they load. We use Vimeo’s “do not track” embed option and only embed videos on a small number of pages.
8. How long we keep personal data
| Data | How long |
|---|---|
| Student accounts and progress on a school membership | For the life of the membership plus a three-month grace period. About three months after a membership expires, its classes and rosters are removed and student accounts that are not on any live membership are deleted, along with their progress. Renewing within the grace period keeps everything. |
| Student accounts on an individual subscription | While the subscription is active, then deleted about three months after it ends. |
| Teacher and purchaser accounts | While your school has a live membership or you have an active relationship with us. Accounts that have had no live membership and no activity are deleted in our monthly clean-up. |
| Orders, invoices, purchase orders and payment references | Six years after the end of the financial year they relate to, as required for tax and accounting. |
| Free trial requests | Kept with our order records so that we can apply the one-trial-per-school rule. |
| Support conversations and contact form messages | Up to two years after the conversation ends, so we can refer back if you contact us again. |
| Newsletter subscription | Until you unsubscribe. Unsubscribed addresses are kept on a suppression list so we do not email you again. |
| Server and security logs | Typically 30 days or less. |
| Product analytics (PostHog) | Event data is kept for one year and is not linked to your name. |
| Google Analytics | User-level data is kept for 14 months; aggregated reports are kept indefinitely. |
| Backups | Daily backups are kept for 30 days on the hosting platform and 30 days off-site, then overwritten. Deleted data may persist in a backup until then. |
9. Where data is kept and international transfers
The website and its database are hosted in Belgium, within the European Union, which the UK recognises as providing adequate protection. Some of the providers in section 6 are in the United States. Where that is the case we rely on the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) where the provider is certified, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You can ask us for details of the safeguard that applies to a particular provider.
10. How we protect personal data
- All traffic to the site is encrypted (HTTPS), and the site sits behind Cloudflare, which filters attacks and abusive traffic.
- Passwords are stored as salted hashes and are never visible to us. Failed logins and form submissions are rate-limited and protected against bots.
- Access to the database and administration area is limited to the company director and our hosting provider, using unique, strong credentials.
- Teachers can only see students in their own school and classes. The site’s public interfaces do not list users, and student names are never shown to other schools.
- Automated daily backups are encrypted and held by our hosting provider.
- If a personal data breach occurs that is likely to put people at risk: where we are the controller, we will inform affected individuals and, where required, the Information Commissioner’s Office without undue delay and within 72 hours of becoming aware. Where we process data for a school, we will inform the school without undue delay (our target is 24 hours) so that it can meet its own obligations.
11. Your rights
Under the UK GDPR you have the right to:
- Access a copy of the personal data we hold about you.
- Rectification of anything that is wrong or incomplete.
- Erasure of your data where we no longer need it, or you withdraw consent, or you object and we have no overriding reason to keep it. Some records, such as invoices, must be kept by law.
- Restriction of processing while a dispute about accuracy or use is resolved.
- Portability: to receive data you gave us in a machine-readable format.
- Object to processing based on legitimate interests, including direct marketing, which we will always stop.
- Withdraw consent at any time where we rely on it (cookies, the newsletter), without affecting what was done before.
To exercise any of these rights, email [email protected]. We will respond within one month. We may need to confirm who you are first. There is no fee unless a request is clearly unfounded or excessive.
Students on school memberships: because your school is the controller, please make your request to your school (your teacher or the school’s data protection lead). Teachers can correct and delete student accounts directly in their class settings, and we will help the school with anything they cannot do themselves. If you contact us directly we will pass your request to your school.
Complaints. If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, helpline 0303 123 1113, www.ico.org.uk.
12. Changes to this policy
We review this policy at least once a year and whenever we change how the site works. The current version, with its date, is always at www.knowitallninja.com/privacy-policy. If a change materially affects how we use your data we will tell schools and account holders by email. Our terms and conditions are at www.knowitallninja.com/terms-of-service. Our Data Processing Agreement for schools, Data Protection Impact Assessment and Children’s Code statement are on our GDPR page at www.knowitallninja.com/gdpr.