Privacy Policy

1. Introduction

This Privacy Policy explains how Lurn Ltd (“we”, “us”) processes personal data when you use VocabPath. We are the data controller for that processing. Our contact details are at the top of this page. Privacy questions: privacy@vocabpath.com.

This notice is written for the UK GDPR and the Data Protection Act 2018. If you are in the EEA, similar rights usually apply.

2. What we collect

• Account and profile data — name or display name, email address, password (hashed), exam track, study preferences, and setup answers you provide.
• Learning activity — progress, practice results, streaks, and similar product usage needed to deliver the Service.
• Billing data — subscription status, Stripe customer/subscription IDs, and limited payment metadata. Card details are handled by Stripe; we do not store full card numbers.
• Communications — emails you send us, and support messages.
• Technical data — IP address (sometimes hashed), device/browser type, approximate location derived from IP, referrer, and diagnostic logs.
• Cookies and similar technologies — see section 8 and our Cookie settings.

3. How we use data

• To create and manage your account and provide learning features.
• To process subscriptions, trials, invoices, and cancellations.
• To send service messages (security, billing, material changes to terms).
• To send marketing only where you have opted in (you can withdraw anytime).
• To keep the Service secure, prevent abuse, and fix bugs.
• To understand product usage in aggregate and improve VocabPath.
• To meet legal, tax, and accounting obligations.

4. Legal bases (UK GDPR)

• Contract — providing the Service you signed up for, including paid subscriptions.
• Legitimate interests — securing the Service, improving features, and basic analytics balanced against your rights.
• Consent — optional marketing emails and non-essential cookies where required.
• Legal obligation — keeping records where the law requires it.

5. Sharing and processors

We use service providers who process data on our instructions, including:

• Stripe — payment processing (Stripe Privacy Policy).
• Hosting and database providers — to run the website and store account data.
• Email delivery — transactional and (if opted in) marketing messages.
• Analytics — only if enabled and, where required, after cookie consent.

We do not sell your personal data. We may disclose data if required by law or to protect rights and safety.

6. International transfers

Some providers may process data outside the UK. Where that happens, we use appropriate safeguards such as UK adequacy regulations or standard contractual clauses.

7. Retention

• Account and learning data: while your account is active, then deleted or anonymised within a reasonable period after closure unless we must keep it longer.
• Billing records: typically kept for up to 6 years for tax and accounting.
• Support emails: kept as long as needed to resolve your request and for a short follow-up period.

8. Cookies

We use essential cookies for sign-in and security. Non-essential cookies (for example analytics) are used only with your consent where UK law requires it. Manage choices anytime on our Cookie settings page.

9. Your rights

Under UK GDPR you can usually request access, correction, deletion, restriction, objection, and data portability, and withdraw consent where we rely on it. Email privacy@vocabpath.com. You can also complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.

10. Children

VocabPath may be used by learners preparing for school exams. If you are under 13 (or under the digital consent age where you live), please use the Service with a parent or guardian. Parents can contact us to review or delete a child’s data.

11. Security

We use appropriate technical and organisational measures (for example encrypted transport, access controls, and hashed passwords). No online service is perfectly secure.

12. Changes

We may update this Policy. We will post the new version here and change the “Last updated” date. Material changes may also be notified by email or in-product notice.