Legal
Privacy policy
Notice version: leap-privacy-2026-11-04. Accepting adult Terms is separate from choosing optional analytics or advertising.
What we collect
When you create an account we store your name and email address. Password accounts use a hashed password; Google sign-in uses your Google identity and does not give Leap your Google password. We also keep your adult Terms version, acceptance time and account identity. When you add a child we store their first name, age and target schools. When you use the app we store practice answers, paper results and files you upload to build what we know about your child.
During onboarding we also ask some optional questions to personalise your child's prep plan: what you're already using, how involved you want to be, what you're most worried about, whether your child has a tutor (and which subjects), how confident you feel about your target school, how much time you have each week, and how you heard about Leap (including anything you type in an “other” box). None of these are required to use the app — skipping them just means we can't tailor recommendations as closely.
Depending on the features you use, we may also process:
- Scanned papers & report photos — images you upload for scan-to-mark or teacher-note interpretation. These are stored in private object storage. Signed-in adults in the child's household can access them. A linked tutor can access an original file only for the exact child whose parent has switched on source sharing for that Tutor-child link.
- Interview practice — microphone audio is sent for speech-to-text in real time. We do not keep the audio file; we keep the transcript text, AI interviewer turns, and any written feedback for that session.
- Payment details — if you subscribe, card details are handled by Stripe. We store subscription status and Stripe customer / subscription identifiers, not full card numbers.
Children's data
Leap is designed for parents (and tutors they invite) preparing children for 11+. Accounts are held by adults. Child profiles contain first name, age, school targets, practice history, and any content the parent uploads. We do not use children's data for advertising, and we do not knowingly market to children.
We treat child learning data as sensitive in practice: household adults can access it, while each linked tutor receives only the optional access the parent grants for that exact child. Linking a tutor does not share activity, original uploads, Ask Leap access, or assignment rights by default. Deletion of a child profile removes that child's papers, interviews, scans, and progress from our systems (see below).
Legal basis for processing
We rely on a few different legal bases, depending on what the data is for:
- Contract — information about the adult account and requested service, where necessary to perform our agreement with that adult. An adult’s contract is not automatically a lawful basis for all information about a child.
- Consent — analytics (PostHog) and advertising measurement (Meta Conversions API and Google Ads conversion import) only run if you actively accept them; school bundle news emails go only to an adult who opts in for that school, and Leap updates only to an adult who opts in to them. You can change your mind at any time.
- Legitimate interests — fraud prevention, keeping the service secure, and delivering the child’s learning support requested by their responsible adult, subject to a separate assessment of necessity, the child’s interests and privacy safeguards. Operational records help us diagnose failures and measure the cost of requested work; this does not override optional analytics choices. Usage counts (below) count how often signed-out visitors open the home page and sign-up form, so we can fix where people drop off; you can turn them off.
How we use it
We use your data to run the service: generating and scoring papers, marking scanned work, running interview practice, showing progress and next steps supported by the available evidence, and sending account-related email. When you finish setting up, we check whether your child can open practice papers today. If one of your target schools has papers ready, or you haven't chosen a school yet, your account opens straight away. Otherwise you join a waitlist while we prepare your school, and we email you as soon as its papers are ready. We count your household's use of Ask Leap messages, new practice questions, scan pages, spoken interviews and papers made for each child against your plan, so we can show your allowance and stop at its limit. We keep a record of any free trial your household has already had. We do not sell your personal data. Account-related email (password resets, early-access approval) isn't marketing. We send promotional email only with your separate opt-in, never assumed from your account, a target school or a purchase. When you create an account, an optional, unticked box lets you ask for Leap updates, new practice and offers. In Settings, each adult can turn those on or off, and choose news and offers about a particular school's bundle and, separately, invitations to take Leap Starting Point checks. Each choice is separate. We record the wording you agreed to, when and where. You can withdraw in Settings or with the unsubscribe link in any such email; account email is unaffected.
Uploads and AI processing
Before an upload, Leap shows its requirements, processing and current audience. Choosing “I acknowledge” confirms that you understand this notice. You must still have the right and authority to upload each file and let Leap process it for your request. With no linked tutor, the audience is the child's signed-in household adults. A linked tutor without the exact source grant cannot access the original. A tutor with that grant can access it only for that Tutor-child link; other tutors and siblings are excluded. Leap records the notice version, audience, actor and time. We reuse that acknowledgement for later uploads with the same notice and audience, including composer and phone QR capture, and ask again when either changes. We recheck source access when an object is read or an upload step resumes. Uploaded files are kept outside Leap's shared question pool. A configured processor may receive an upload when needed for the requested feature. Processor contract, training-use, transfer and retention terms are being reconciled; we do not state stronger guarantees here.
Ask Leap and Create may use the files, extracted text, your instructions and relevant learning context to produce a requested result. Private source-recovery work is visible only to the parent account that owns it unless a separate supported action shares derived work. Raw photos, PDFs and marked answers are not instructions to publish or grant another household access. Closing a conversation or archiving a Source is not the same as erasing its original files.
Phone QR links allow only the bounded capture action for that link. Keep them private. If an external AI connection is made available, it requires its own explicit scope and review. That provider handles its own conversation under its policies; accepting Leap’s Terms does not register or activate a connection or allow an external model to change your child’s records.
Leap in ChatGPT
Leap 11+ in ChatGPT is an optional ChatGPT plugin. It answers questions about 11+ schools, their exam formats, Leap’s public practice shelves and 11+ question types. It needs no Leap account and never reads or changes a Leap account, child profile or household.
When ChatGPT uses the plugin, Leap receives what the question needs: the school, area, entry year or question type that ChatGPT sends. ChatGPT also sends an anonymised ChatGPT user identifier, a conversation identifier, your language, an approximate location and browser details, and the request comes from an IP address. We use the anonymised user identifier and the IP address only to limit how many requests one person can make. Each becomes a keyed code that is held in memory for one minute and then deleted, and the key changes whenever the server restarts. We do not use the conversation identifier, language, location or browser details. We do not store or log the question, these identifiers or the answer. For each request we record only which tool ran and whether it worked, with no request details, kept only as long as our hosting provider keeps application logs.
The plugin returns public school information and Leap’s public practice catalogue, never a child’s data. The answer becomes part of your ChatGPT conversation, which OpenAI handles under its own privacy policy; Leap does not control that conversation. Like every request to Leap, plugin requests pass through our hosting provider, Vercel (see who processes data). You can stop using the plugin at any time by disconnecting it in ChatGPT’s settings. Questions about the plugin: hello@leap11plus.com.
Cookies & analytics
Essential storage keeps your sign-in, family mode and PIN boundary working, and remembers your cookie choice and whether you collapsed the side menu. Optional analytics and advertising start off. “Use essential cookies only” declines both; the service still works. Usage counts set no cookie and have their own off switch.
Pages load their typefaces from Google Fonts, and the catchment map loads map tiles from OpenStreetMap. These are not cookies we set and they are not controlled by the banner: your browser contacts those services directly, which gives them your IP address and browser details.
If you accept analytics or advertising, we also set a first-party leap_acq cookie that remembers which ad or campaign brought you to Leap, so we can measure whether our advertising is working.
When you create an account, we record which link or ad brought you to Leap (for example, an Instagram ad), so we can tell which of our ads work. It comes from the link's campaign tags and is sent with the sign-up, not stored in a cookie, and we don't share it with advertisers.
With your consent (you'll see a banner on your first visit), we also use:
- PostHog — consented product analytics using reviewed categories and bounded counts. We do not use PostHog session recording, automatic click capture, person profiles or identify calls. We do not send names, email addresses, raw account or child record IDs, prompts, answers, notes, uploaded content, raw URLs or referrers. Private work routes suppress browser analytics. Optional onboarding free text and campaign names are not sent to PostHog.
- PostHog — how an event is labelled. Events the page sends carry an identifier that lives only in browser memory and changes when capture stops; it is not your account identity. A short fixed list of milestones is different. Our server confirms whether a milestone has happened — joining the waitlist, access being approved, adding a first child, setting a first target school, starting or finishing a baseline, opening a first paper, sitting a first paper, having a first scanned paper marked, creating a first pack, adding a second child, choosing a next learning stage such as SATs, KS3 or GCSE, completing checkout, and a trial starting or ending — and labels it with a pseudonym worked out from your account using a key only we hold. Where the milestone is about a particular child, a separate keyed child reference is included. A milestone can also carry how long after sign-up it happened, in broad bands such as “1 to 7 days”, and a broad household group worked out from your saved details, such as Year 5, Year 6 with an independent-school target, or an exam within two weeks. PostHog receives the pseudonym, never the account or child record it came from, and cannot reverse it. Our server also records billing steps: a free trial starting, the end-of-trial offer being shown, a trial ending without an upgrade, a plan allowance being used up (which allowance, the plan and the same broad household group), and an upgrade. Each is handed once to your browser, which sends it the same way as other events and only with analytics consent. It carries no account, household or child reference. It is still information about you and your child, so we treat it as personal data rather than anonymous data.
- Meta Conversions API — if you accept advertising cookies, a completed signup or a paid bundle order (with its amount) may be reported to Meta to measure advertising. This can include a one-way hash of the adult’s email, IP address, browser user agent and advertising click identifiers. It does not send child data, private work URLs or content. The browser Meta Pixel is disabled because it cannot be isolated from later private navigation.
- Google Ads conversion import — if you accept advertising cookies before signing up or starting checkout and arrived from a Google ad, a completed signup or bundle purchase may be reported to Google Ads to measure advertising. Google fetches it from our server with the ad click identifier, signup or purchase time and an opaque reference. A purchase includes the total paid; a signup has no monetary value. We keep the click identifier for up to 90 days. Accepting advertising cookies after signup does not report that earlier signup. It does not include your name, email, payment details, child data or private pages. No Google advertising script runs on Leap pages.
Neither receives optional measurement events before you actively accept its purpose in the banner. Declining only turns these off — the site otherwise works exactly the same.
You can change your cookie choices at any time: . Withdrawing analytics consent stops further product-analytics capture in that browser; withdrawing advertising consent stops further Meta measurement events, clears Meta cookies we set, and stops Google Ads click identifiers being kept for later sign-ups or checkouts. Saving that choice while signed in also removes the Google click identifiers saved to your account and stops conversions not yet sent. Changing your mind later does not restore removed identifiers. Conversions already sent to Google are not recalled. Analytics withdrawal also clears its pending memory queue and anonymous identity. Events already delivered from the browser carry only that memory-held identifier, so we cannot find them again from your Leap account for individual erasure. Server-confirmed milestones can be found: their pseudonym is worked out from your account with a key we hold, so we can recompute it and ask PostHog to delete those events. Provider retention and deletion settings require separate verification.
Usage counts
So we can see where people drop off before they sign up, Leap adds one to a weekly total each time a visitor who is not signed in reaches one of two steps: opening the home page and opening the sign-up form. Once you are signed in, nothing is counted: any request carrying a Leap session is ignored, and we never look up an account for these totals. The totals keep only the week, the step and the count. They do not keep who reached a step, an IP address or device details, and nothing links one step to another. We never use them to single out or act on anyone. Leap counts these itself: no cookie is set, nothing is stored on your device, the request carries no page address, and no analytics or advertising company receives the counts. Like any request to Leap, it passes through our hosting provider, Vercel (see who processes data). Nothing is counted in the child area.
Our team sees totals for completed weeks only. Once a week ends, a week’s total under 10 is deleted rather than kept, so only totals of 10 or more are stored or shown.
This runs unless you turn it off. It uses the statistics exception in the Privacy and Electronic Communications Regulations as amended by the Data (Use and Access) Act 2025, and our legitimate interest in improving Leap. Turning it off stops counting in this browser straight away and is remembered in your cookie choice: . You can also switch “Usage counts” off in . We also treat a browser Global Privacy Control signal as turning it off. If you chose “Use essential cookies only” before 29 September 2026, usage counts stay off for you until you change your choice.
Who processes data for Leap
These companies process data for Leap so we can run the service. For each one we say what they do, what data they get and where it is processed. For locations awaiting verification, we say “see our processor's terms”. Contract, retention and deletion terms are still being reconciled, so this list does not make broader guarantees.
- OpenAI — AI models that generate questions and papers, mark answers, write feedback and reports, and run Ask Leap.
Data: Prompts and responses for those tasks. These can include a child’s name, age, answers and marks, and photos of homework or reports.
Where: See our processor’s terms. - Anthropic — AI models for some of the same tasks, and a fallback when the main model is unavailable.
Data: The same kind of content as OpenAI, for the tasks sent to it.
Where: See our processor’s terms. - Google Gemini — Reads scanned papers, answer sheets, school-report photos and homework photos, and sorts work for marking.
Data: Images of the child’s written work and school reports.
Where: See our processor’s terms. - LangSmith (LangChain) — Engineering traces of AI requests and responses, used to find and fix errors, when tracing is switched on.
Data: AI prompts and responses, with names and contacts pseudonymised: child and parent names become labels such as “Child A”, account IDs become coded references, and emails, phone numbers, addresses, postcodes and dates of birth are removed. No images or files are sent.
Where: EU (eu.api.smith.langchain.com). - Deepgram — Turns the child’s spoken interview-practice answers into text.
Data: One audio recording per spoken answer. Every request opts the audio out of Deepgram’s model-improvement programme. We keep the transcript, not the audio. Deepgram also times the synthetic narration of explainer videos; that audio is a generated voice, not the child’s.
Where: See our processor’s terms. - ElevenLabs — Reads interviewer questions and some explainer scripts aloud.
Data: The text of the interviewer’s lines, which can refer to what the child said, and explainer narration.
Where: See our processor’s terms. - Stripe — Payment processing when you upgrade or subscribe. No card is taken until you choose Leap Plus.
Data: Parent email, the customer record and subscription status. Stripe handles card details; we do not store full card numbers.
Where: See our processor’s terms. - Resend — Sends account email: invites, password resets, waitlist status and tutor report sharing.
Data: Your name and email address. Some emails name a child or include feedback about the child’s work.
Where: See our processor’s terms. - Postmark — Receives emails you forward to your child’s Leap address and passes them to Leap.
Data: The forwarded email and its attachments, such as teacher or tutor messages about the child.
Where: See our processor’s terms. - PostHog — Product analytics, with session recording disabled, only after analytics consent in Leap.
Data: Pseudonymous events: the type of page, a fixed list of event names and keyed account and child references. No names, emails, answers or uploads, and nothing from the child area.
Where: EU (eu.i.posthog.com). - Neon — The main application database.
Data: All account, household and learning records.
Where: London, UK (AWS eu-west-2). - Vercel — Hosts the website and app, stores private uploads and generated files (Vercel Blob), and can render explainer videos (Vercel Sandbox). Vercel Web Analytics counts visits to public pages only (the page path, referrer, UTM tags, country and device type), sets no cookies, never receives signed-in pages, and turns off with Usage counts.
Data: All requests to the app, uploaded scans and photos, and explainer scene data.
Where: App functions run in London (lhr1). For storage and other services: see our processor’s terms. - Google sign-in — “Sign in with Google”, if you choose it.
Data: The sign-in handshake only. Google sends your identity to Leap; Leap sends no child data to Google.
Where: See our processor’s terms. - Google Fonts — Serves the typefaces the website and app use.
Data: Your browser requests the fonts directly from Google, which receives your IP address and browser details. This happens on every page, including the child area, and before any cookie choice. No account or child data is sent.
Where: See our processor’s terms. - OpenStreetMap — Map tiles for the school catchment map.
Data: Your IP address, browser details and the map area shown, which is centred on the postcode you enter.
Where: See our processor’s terms. - postcodes.io — Turns a postcode you enter into a location to find nearby schools.
Data: The postcode you type. Nothing else.
Where: See our processor’s terms. - OpenRouter — An optional AI ranking step for search results and suggestions. Switched off today.
Data: When switched on: your search text and the titles, schools, scores and due dates of matching results. No images or files.
Where: See our processor’s terms. - E2B — Runs every Ask Leap turn on a private temporary computer kept for one adult and one child. Between turns the computer is paused, not deleted, so the next turn starts quickly. It is deleted within about a day (at most 25 hours) of starting.
Data: Your message and the learning context Ask Leap needs for that turn: target schools, recent results, answers and marks, saved practice, and any photo or file you attach. A paused computer can keep that household’s recent Ask Leap working files, including attached photos, until it is deleted. In the text we send, we replace the child’s name and your name with labels such as “Child A” and put the names back only in what Leap shows you. We do not send your email. Photos and files are sent as they are, so a name written on them can still reach E2B.
Where: United States (E2B is a US company; its computers run on Google Cloud). We have a data processing agreement with E2B. - Meta Platforms Ireland — Measures whether our advertising leads to sign-ups and bundle purchases, only with advertising consent.
Data: A completed signup (by email or Google) or a paid bundle order and its amount, with a one-way hash of the adult’s email, plus the IP address, browser user agent and advertising click identifiers, which are not hashed. Never child data. The browser Meta Pixel is disabled.
Where: See our processor’s terms. - Google Ads — Measures whether our Google ads lead to sign-ups and bundle purchases, only with advertising consent.
Data: The Google click identifier from the ad you clicked, plus the signup or purchase time and an opaque reference. A purchase includes the total paid in pounds; a signup is recorded with no monetary value. No name, email, payment details or child data. No Google advertising script runs on Leap pages.
Where: See our processor’s terms.
Some configured providers may process data outside the UK. We assess the applicable transfer mechanism and provider terms before relying on a provider; this notice does not claim that every configured route has completed that review.
How long we keep it
Retention depends on the record and why it is held. Account and learning data may remain while an account is active. Uploads, scans, provider copies, audit records and backups can follow different periods. We assess each erasure request against systems we control and any legal or security need to retain a record.
Diagnostic copies of AI requests and responses (text only, never image files) are deleted automatically after 14 days.
Ask Leap's temporary computers (E2B) can keep a household's recent Ask Leap working files, including attached photos, between turns. Each computer is deleted within about a day (at most 25 hours) of starting; the conversation itself stays in Leap.
Provider-specific retention and deletion behaviour, including database backups and AI-provider logs, remain part of our active vendor reconciliation. We will not describe them as settled until configuration and contract evidence is current.
Your rights & deletion
Under UK GDPR you have the right to access the personal data we hold on you, have it corrected if it's wrong, have it deleted, restrict or object to how we use it, and receive a copy in a portable format.
In the product today you can:
- Delete a child profile from Settings — this removes that child's practice history, exam papers, interview sessions, scanned work (and their images), teacher-note uploads tied to the child, and related progress data.
- Change cookie preferences at any time via .
Whole-account deletion is available in adult Settings with a seven-day cancellation period before the erasure worker runs. For a request that cannot be completed there, or to exercise another right, email hello@leap11plus.com. We aim to respond within one month, or explain any lawful extension. If you're not satisfied with how we've handled a request, you can complain to the Information Commissioner's Office (ico.org.uk).
Contact
AI for Global Goals LTD · hello@leap11plus.com