Skip to content

Legal

Privacy policy

Last updated 21 September 2026. This policy describes how AI for Global Goals LTD (“we”, “Leap”) collects and uses information when you use our website and app.

Notice version: leap-privacy-2026-09-21. Accepting adult Terms is separate from choosing optional analytics or advertising.

What we collect

When you create an account we store your name and email address. Password accounts use a hashed password; Google sign-in uses your Google identity and does not give Leap your Google password. We also keep your adult Terms version, acceptance time and account identity. When you add a child we store their first name, age and target schools. When you use the app we store practice answers, paper results and files you upload to build what we know about your child.

During onboarding we also ask some optional questions to personalise your child's prep plan: what you're already using, how involved you want to be, what you're most worried about, whether your child has a tutor (and which subjects), how confident you feel about your target school, how much time you have each week, and how you heard about Leap (including anything you type in an “other” box). None of these are required to use the app — skipping them just means we can't tailor recommendations as closely.

Depending on the features you use, we may also process:

  • Scanned papers & report photos— images you upload for scan-to-mark or teacher-note interpretation. These are stored in private object storage. Signed-in adults in the child's household can access them. A linked tutor can access an original file only for the exact child whose parent has switched on source sharing for that Tutor-child link.
  • Interview practice — microphone audio is sent for speech-to-text in real time. We do not keep the audio file; we keep the transcript text, AI interviewer turns, and any written feedback for that session.
  • Payment details — if you subscribe, card details are handled by Stripe. We store subscription status and Stripe customer / subscription identifiers, not full card numbers.

Children's data

Leap is designed for parents (and tutors they invite) preparing children for 11+. Accounts are held by adults. Child profiles contain first name, age, school targets, practice history, and any content the parent uploads. We do not use children's data for advertising, and we do not knowingly market to children.

We treat child learning data as sensitive in practice: household adults can access it, while each linked tutor receives only the optional access the parent grants for that exact child. Linking a tutor does not share activity, original uploads, Ask Leap access, or assignment rights by default. Deletion of a child profile removes that child's papers, interviews, scans, and progress from our systems (see below).

Legal basis for processing

We rely on a few different legal bases, depending on what the data is for:

  • Contract — information about the adult account and requested service, where necessary to perform our agreement with that adult. An adult’s contract is not automatically a lawful basis for all information about a child.
  • Consent — analytics (PostHog) and advertising measurement (Meta Conversions API) only run if you actively accept them. You can change your mind at any time.
  • Legitimate interests — fraud prevention, keeping the service secure, and delivering the child’s learning support requested by their responsible adult, subject to a separate assessment of necessity, the child’s interests and privacy safeguards. Operational records help us diagnose failures and measure the cost of requested work; this does not override optional analytics choices.

How we use it

We use your data to run the service: generating and scoring papers, marking scanned work, running interview practice, showing progress and next steps supported by the available evidence, and sending account-related email. If you join during early access, you land on an in-app waitlist after setup; we email you when your spot is approved — there is no separate waitlist confirmation email at signup. We do not sell your personal data, and we do not send marketing email — account-related email (password resets, early-access approval) isn't marketing. If we ever want to send you anything promotional, we'll ask for your separate opt-in first, not assume it from your account.

Uploads and AI processing

Before an upload, Leap shows its requirements, processing and current audience. Choosing “I acknowledge” confirms that you understand this notice. You must still have the right and authority to upload each file and let Leap process it for your request. With no linked tutor, the audience is the child's signed-in household adults. A linked tutor without the exact source grant cannot access the original. A tutor with that grant can access it only for that Tutor-child link; other tutors and siblings are excluded. Leap records the notice version, audience, actor and time. We reuse that acknowledgement for later uploads with the same notice and audience, including composer and phone QR capture, and ask again when either changes. We recheck source access when an object is read or an upload step resumes. Uploaded files are kept outside Leap's shared question pool. A configured processor may receive an upload when needed for the requested feature. Processor contract, training-use, transfer and retention terms are being reconciled; we do not state stronger guarantees here.

Ask Leap and Create may use the files, extracted text, your instructions and relevant learning context to produce a requested result. Private source-recovery work is visible only to the parent account that owns it unless a separate supported action shares derived work. Raw photos, PDFs and marked answers are not instructions to publish or grant another household access. Closing a conversation or archiving a Source is not the same as erasing its original files.

Phone QR links allow only the bounded capture action for that link. Keep them private. If an external AI connection is made available, it requires its own explicit scope and review. That provider handles its own conversation under its policies; accepting Leap’s Terms does not register or activate a connection or allow an external model to change your child’s records.

Cookies & analytics

Essential storage keeps your sign-in, family mode and PIN boundary working and remembers your cookie choice. Optional analytics and advertising start off. “Use essential cookies only” declines both; the service still works.

If you accept analytics or advertising, we also set a first-party leap_acq cookie that remembers which ad or campaign brought you to Leap, so we can measure whether our advertising is working.

With your consent (you'll see a banner on your first visit), we also use:

  • PostHog — consented product analytics using reviewed categories and bounded counts. We do not use PostHog session recording, automatic click capture, person profiles or identify calls. We do not send names, email addresses, raw account or child record IDs, prompts, answers, notes, uploaded content, raw URLs or referrers. Private work routes suppress browser analytics. Optional onboarding free text and campaign names are not sent to PostHog.
  • PostHog — how an event is labelled. Events the page sends carry an identifier that lives only in browser memory and changes when capture stops; it is not your account identity. A short fixed list of milestones is different. Our server confirms whether a milestone has happened — joining the waitlist, access being approved, adding a first child, setting a first target school, starting or finishing a baseline, sitting a first paper, creating a first pack, completing checkout, and a trial starting or ending — and labels it with a pseudonym worked out from your account using a key only we hold. Where the milestone is about a particular child, a separate keyed child reference is included. PostHog receives the pseudonym, never the account or child record it came from, and cannot reverse it. It is still information about you and your child, so we treat it as personal data rather than anonymous data.
  • Meta Conversions API — if you accept advertising cookies, a completed signup may be reported to Meta to measure advertising. This can include a one-way hash of the adult’s email, IP address, browser user agent and advertising click identifiers. It does not send child data, private work URLs or content. The browser Meta Pixel is disabled because it cannot be isolated from later private navigation.

Neither receives optional measurement events before you actively accept its purpose in the banner. Declining only turns these off — the site otherwise works exactly the same.

You can change your cookie choices at any time: . Withdrawing analytics consent stops further product-analytics capture in that browser; withdrawing advertising consent stops further Meta measurement events and clears Meta cookies we set. Analytics withdrawal also clears its pending memory queue and anonymous identity. Events already delivered from the browser carry only that memory-held identifier, so we cannot find them again from your Leap account for individual erasure. Server-confirmed milestones can be found: their pseudonym is worked out from your account with a key we hold, so we can recompute it and ask PostHog to delete those events. Provider retention and deletion settings require separate verification.

Who we share it with

Leap is configured to use processors in the following service categories. Their contract terms, locations, retention and deletion behaviour remain under active reconciliation, so this list does not make broader guarantees:

  • Neon — configured primary application database.
  • Vercel — application hosting, Vercel Blob for uploaded scan / report images, and storage of generated files. The separate Vercel Web Analytics client is disabled.
  • Anthropic / OpenAI — large language models used to generate questions, feedback, interview turns, and similar product features.
  • Google (Gemini) — optical character recognition for scanned papers and uploaded report images.
  • Deepgram — configured speech-to-text processing for interview practice.
  • ElevenLabs — text-to-speech for interviewer voices and some generated explainer audio.
  • Stripe — payment processing when you subscribe.
  • Resend — transactional email (confirmations, password resets, waitlist status).
  • PostHog — configured product analytics, with session recording disabled, only after analytics consent in Leap.
  • Meta Platforms Ireland Ltd — advertising measurement via Meta Conversions API for signup measurement, only with advertising consent.

Some configured providers may process data outside the UK. We assess the applicable transfer mechanism and provider terms before relying on a provider; this notice does not claim that every configured route has completed that review.

How long we keep it

Retention depends on the record and why it is held. Account and learning data may remain while an account is active. Uploads, scans, provider copies, audit records and backups can follow different periods. We assess each erasure request against systems we control and any legal or security need to retain a record.

Provider-specific retention and deletion behaviour, including database backups and AI-provider logs, remain part of our active vendor reconciliation. We will not describe them as settled until configuration and contract evidence is current.

Your rights & deletion

Under UK GDPR you have the right to access the personal data we hold on you, have it corrected if it's wrong, have it deleted, restrict or object to how we use it, and receive a copy in a portable format.

In the product today you can:

  • Delete a child profile from Settings — this removes that child's practice history, exam papers, interview sessions, scanned work (and their images), teacher-note uploads tied to the child, and related progress data.
  • Change cookie preferences at any time via .

Whole-account deletion is available in adult Settings with a seven-day cancellation period before the erasure worker runs. For a request that cannot be completed there, or to exercise another right, email hello@leap11plus.com. We aim to respond within one month, or explain any lawful extension. If you're not satisfied with how we've handled a request, you can complain to the Information Commissioner's Office (ico.org.uk).

Contact

AI for Global Goals LTD · hello@leap11plus.com