This notice is written for website visitors, Account Owners, adult Students, and anyone acting on behalf of a child Student. A shorter, child-friendly version for children themselves is our separate Children's Privacy Notice. A separate notice covers teacher applicants and teachers: our Teacher & Applicant Privacy Notice.

1. Who we are

Shambits LTD ("ShamBits", "we", "us", "our"), company number 14700340, registered office 86-90 Paul Street, London, England, EC2A 4NE, United Kingdom, is the controller of the personal data described in this notice.

Contact us about privacy at: hello@shambits.com.

2. Scope of this notice

This notice explains how we collect and use personal data when you visit our website, register an Account, use ShamBits Academy as an Account Owner or adult Student, or interact with us as a parent/guardian managing a child's Student profile.

3. Information we collect

If you visit our website: we may collect information you submit through our contact form or newsletter sign-up (name, email, message, and — for the contact form only — your IP address).

If you register an Account: your name, email, phone number (optional), password, preferred language, country, and time zone.

If you subscribe: billing-related identifiers from our payment processor, Stripe (see clause 7) — we do not collect or store your card number.

If you create a Student profile (for yourself as an adult, or for a child): the Student's name, date of birth, gender, relationship to you, country, time zone, native language, learning goals and previous experience, any teacher-gender preference, and an optional photo. This information is provided by you, the Account Owner, when the profile is created.

As the Student uses the service, we additionally collect information generated by that use — this is separate from, and in addition to, the information you provided when creating the profile: live audio and video during lessons (not stored by us — see clause 8), lesson chat messages, lesson recordings where one is successfully created (clause 8), attendance and lesson-room activity, lesson scheduling, lesson reports written by the Teacher, and any private feedback or reviews submitted by you or the Teacher. We generate and collect this information ourselves as the service is delivered — it does not come from you filling in a form.

Automatically: limited technical information needed to operate the service securely — see our Cookie & Local Storage Notice for full detail on what is (and, mostly, is not) stored in your browser.

4. How we use your information, and our lawful basis

We use your information for the purposes below. Where relevant, we identify the lawful basis we rely on under UK GDPR.

5. Children's information

A child does not hold their own Account or login. Their parent or legal guardian sets up and manages their Student profile, and provides the initial profile information described in clause 3. As the child then uses the service, we separately collect the service-generated information also described in clause 3 (lesson recordings and chat, attendance, reports, feedback, and so on) — this comes from the child's own use of the platform, not from the parent filling in a form. See our Children's Privacy Notice for an explanation written for the child themselves, and our Safeguarding & Child Protection Policy for more detail on how we protect children specifically.

6. Teacher matching, including gender and age

We use information including a Student's age, course selection, language, and any teacher-gender preference or requirement recorded on their profile, together with a Teacher's own approved eligibility, to assign a suitable Teacher. This assignment process is carried out by us — it is not something you configure lesson-by-lesson, and we do not currently offer a tool to browse or select a specific Teacher yourself.

7. Subscriptions and payment (Stripe)

We use Stripe to process your subscription payments. Stripe collects and processes your card details directly through its own secure hosted checkout — we never see or store your full card number. We hold billing-related identifiers (such as your Stripe customer reference and subscription status) so that we can administer your subscription.

8. Video lessons and lesson recording (Agora)

Lessons take place over live video and audio, delivered using Agora, our video-infrastructure provider. Lessons are configured to be recorded as a standard part of the service — this is not an optional preference you can turn off for an individual lesson — for the purposes of safeguarding, quality assurance, and reviewing disputes or incidents.

Occasionally, a technical failure may mean a particular lesson is not successfully recorded, or that a recording stops partway through; we do not guarantee that a recording will always be produced. Where this happens, the lesson still goes ahead as normal.

Recordings that are successfully created are kept for up to 30 days, are only accessible to authorised ShamBits administrators for the purposes described above, and are permanently and physically deleted, not merely hidden, once that period ends.

We ask you to confirm you have seen and understood the in-lesson recording notice before a lesson begins. This is an acknowledgement that you understand recording is happening — it is not a consent choice you could decline while still taking the lesson, because recording is part of how the service itself is delivered.

9. Lesson chat

Text messages sent through in-lesson chat are stored so that we can review them if needed for safeguarding, quality, or dispute purposes, in the same way as a lesson recording.

10. Attendance and no-show information

We automatically record when a Student or Teacher joins and leaves a lesson, so that we can confirm attendance, detect no-shows, and resolve any dispute about whether a lesson took place.

11. Lesson reports, reviews, and feedback

After each lesson, the Teacher completes a short report which becomes visible to you (see our Student & Parent Terms). You and the Teacher may each separately submit private feedback about the lesson, which we use internally to monitor quality and safeguarding — this feedback is not published or made visible to other users.

12. Communications

We use your contact details to send you service communications (account, billing, lesson, safeguarding-related) and, where you have opted in, marketing communications such as our newsletter, which you can unsubscribe from at any time using the link in any newsletter email.

13. Support

If you contact us for support, we use the information you provide to respond to and resolve your query, and we may keep a record of the interaction for quality and training purposes.

14. Security and audit information

We keep records of certain account and security-relevant activity (such as sign-ins and administrative actions taken on your Account) to help us maintain the security and integrity of the platform and investigate any suspected misuse.

15. Service providers who process data on our behalf

We share personal data with the following service providers, who act as our processors and handle your data only under contractual terms with us, for the purposes described in this notice:

• Stripe — payment processing.
• Agora — live video/audio delivery, in-lesson chat transport, and lesson recording capture.
• Amazon Web Services (AWS) — our infrastructure provider, including database hosting (RDS), file storage (S3), and email delivery (SES), all within AWS's UK (London) region for our core infrastructure.
• Wise (or an equivalent bank-transfer channel) — used to send payments to teachers; this does not involve your (a Student's or Account Owner's) personal data.

We do not sell your personal data, and we do not use it for third-party advertising. A Teacher's access to Student personal data in order to deliver lessons is described separately in clause 17 below, not listed here as a service provider — we have not yet reached a final internal view on how to characterise a Teacher's role for data-protection purposes (for example, as a processor, a joint controller, or an independent controller in their own right for certain purposes), and it would be premature to label every Teacher a processor before that assessment is complete for a given country. See our internal country-review process for how this is being worked through.

16. Separate disclosures — legal and regulatory bodies

Separately from the service providers listed in clause 15, we may need to disclose personal data to a professional adviser, regulator, law enforcement body, or court, where we are legally required to do so or it is necessary to protect someone's safety, comply with a court order, or establish, exercise, or defend legal claims. A body we disclose to in these circumstances is not our service provider and does not process your data under a contract with us — it receives it under its own legal powers or our own legal obligation to disclose.

17. Teachers, including those based outside the United Kingdom

A Teacher assigned to a Student can see the information necessary to deliver that Student's lessons — for example, name, age, course, and schedule, and (for lessons they teach) lesson chat and lesson-room content. Teachers do not have access to lesson recordings — recording playback is restricted to authorised ShamBits administrators only (see clause 8).

Teachers may be based in different countries. Where a Teacher is based outside the United Kingdom, this means their access to a Student's personal data may involve an international transfer of that data. We do not allow a Teacher based outside the United Kingdom to access live student data until we have completed our own internal country-level review for the country concerned and put in place the safeguard we consider appropriate — which may include entering into a UK International Data Transfer Agreement with that Teacher, or confirming another lawful transfer mechanism. If we have not yet completed that review for a given country, teachers resident there do not receive live student assignments.

18. International transfers more broadly

Our core infrastructure (database, file storage, email) is hosted in the United Kingdom. Stripe and Agora are both global businesses that may process data outside the United Kingdom as part of providing their service to us. Each publishes its own data processing terms describing the safeguards it applies to international processing. We have not independently re-verified the specific processing locations or transfer safeguards each currently relies on for our account, and we do not represent that we have done so; we rely on their published data processing terms and will review this position as part of our ongoing supplier due diligence.

19. How long we keep your information

We keep personal data only for as long as necessary for the purposes described in this notice, in line with our internal data retention schedule. Some retention periods are already fixed: lesson recordings that are successfully created are kept for up to 30 days. Other categories are retained for periods set out in our internal retention schedule, some of which are settled ShamBits policy and some of which remain under review; details are available on request.

20. Your rights

Depending on the lawful basis that applies, you may have the right to ask us to: give you access to your personal data; correct it; erase it; restrict how we use it; object to certain uses; move it to another provider (portability); and withdraw consent, where consent is the basis we rely on (for example, marketing).

21. How to exercise your rights

We currently handle these requests with the help of our team, rather than through a fully automated self-service tool. To make a request, contact us at hello@shambits.com, telling us what you'd like and enough information for us to verify you're entitled to make the request. If you're asking on behalf of a child, please tell us this and confirm your relationship to them. We aim to respond within one calendar month, subject to any extension the law allows for complex or numerous requests.

22. Complaining to the ICO

If you're unhappy with how we've handled your personal data, please contact us first so we can try to put things right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

23. Changes to this notice

We may update this notice from time to time. Where a change is significant, we will take reasonable steps to let you know (for example, by email or an in-app notice). The version and date at the top of this notice tell you when it was last updated.