MindBlaze helps children aged 9–11 prepare for the 11+ exam, and helps their parents understand how preparation is going. Because our product involves children's data, we hold ourselves to a higher standard than a typical app — and this policy is written in plain English so you can actually read it.
MIND BLAZE UK LIMITED is a company registered in England and Wales, company number 17362263, registered office: 12 Westmoreland Gardens, Peterborough, PE1 5HU. We are the "data controller" for the personal data described in this policy. Contact us about anything in this policy at hello@mindblaze.uk.
We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator.
We designed the children's app to need as little personal data as possible:
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing the apps: running practice sessions, tracking progress, generating parent reports | Performance of a contract (with the parent); the parent provides and consents to the child's data as the holder of parental responsibility |
| Taking payments and delivering purchases | Performance of a contract; legal obligation (tax and accounting records) |
| Transactional email (receipts, progress round-ups, download links) | Performance of a contract |
| Newsletter and marketing email | Consent — only if you opt in, withdrawable any time |
| Security, fraud prevention, debugging | Legitimate interests (keeping the service safe and working) |
| Advertising our service to prospective customers (e.g. measuring whether our adverts work) | Consent via cookie banner where required — see section 7 |
We follow the ICO's Age Appropriate Design Code in how we build for children: minimal data collection, no advertising inside the children's app, no behavioural profiling for marketing, and no design tricks that pressure children to share more.
Honesty matters to us, so here is exactly how our AI reports work. When a report is generated for you, we send your child's first name, their scores and answer patterns to Anthropic (the AI company behind Claude) via their API, which writes the report text. We do not send email addresses, pairing codes or account details. Under Anthropic's commercial API terms, data sent this way is not used to train their AI models. Reports are generated on our servers — your child's data is never exposed to the AI service directly from their device.
We never sell personal data. We never share it with advertisers or data brokers. We use a small number of service providers ("processors") to run MindBlaze, each bound by contract to protect your data:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database and authentication — where account and progress data lives | EU (Ireland region) |
| Stripe | Payment processing — card details go directly to Stripe, never to us | UK/EU/US (with appropriate safeguards) |
| Resend | Sending our emails | US/EU (with appropriate safeguards) |
| Anthropic | Generating the text of progress reports (section 4) | US (with appropriate safeguards) |
| Netlify | Hosting our websites | US/EU (with appropriate safeguards) |
Where a provider processes data outside the UK, we rely on UK adequacy decisions or standard contractual clauses with the UK addendum. We may also disclose data if the law requires it, or as part of a business sale (in which case this policy would still protect it).
The apps themselves use only strictly-necessary storage (login sessions and locally saved progress). Our marketing website may use analytics and advertising measurement tools (such as the Meta Pixel) to understand whether our advertising works — these run only with your consent where consent is required, and never inside the children's app. You can manage preferences via the cookie notice on the site.
Data is encrypted in transit (HTTPS everywhere) and at rest. Access to children's data is restricted at the database level so that each parent can only ever access their own children's records, and children's devices can only write data through a validated, server-controlled channel. We follow the principle of least access internally, and we keep security under continuous review. No system is perfectly secure, but if a breach ever affects your data we will notify you and the ICO as the law requires.
Under UK data protection law you can ask us to: access the data we hold about you or your child; correct it; delete it; restrict or object to how we use it; export it in a portable format; and withdraw any consent you've given. Exercise any of these by emailing hello@mindblaze.uk — we'll respond within one month. You also have the right to complain to the ICO at ico.org.uk, though we'd appreciate the chance to sort things out first.
If you're a child using MindBlaze: the app only knows the name you typed and how you're getting on with your practice. It shares that with your parent so they can help you. It never shows you adverts and never asks for your email. If anything about the app worries you, tell your parent or carer.
If we make significant changes we'll tell account holders by email and update the date at the top. Minor clarifications may be made without notice.