Skip to main content
Skip to main content
10 days until SATs 2026 — every day of practice counts. Start free today →
SATs Arcade logo
Log inStart Free →

Privacy Policy

Last updated: 2 March 2026

SATs Arcade is committed to protecting your privacy and the privacy of your children. This policy explains what data we collect, why we collect it, and how you can control it. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Jump to section

1. Who We Are

SATs Arcade ("we", "us", "our") is the data controller responsible for your personal data. We operate the website satsarcade.co.uk and the SATs Arcade application, a KS2 SATs preparation platform for Year 6 children.

If you have any questions about this privacy policy or how we handle your data, please contact us.

Note for parents: Only adults (18 or over) may create SATs Arcade accounts. Children use the service through a profile created by a parent or teacher on their behalf. We do not knowingly allow children to register accounts directly.

2. Data We Collect

We collect the following categories of personal data:

Account data

When you register, we collect your display name, email address, hashed password, and account role (parent or teacher). For school accounts, we also collect school name and contact details.

Child profile data

When you create a child profile we collect the child's first name (or nickname) and year group. We do not ask for the child's date of birth, address, or any other identifying information.

Practice and progress data

We record every question a child answers, whether it was correct, how long they took, their XP, streaks, and overall performance across subjects and topics. This is the core of the service.

Payment and billing data

When you subscribe, payment is processed by our payment provider (Stripe). We store your subscription plan, status, and invoice records. We do not store your card number — your payment provider handles that.

Usage and attribution data

When you first visit our site, we capture the page you landed on and any UTM marketing parameters in the URL (e.g. utm_source, utm_medium, utm_campaign). We also capture your browser's referrer header. This is used to understand how users discover SATs Arcade.

Technical data

Our servers log standard web server information including your IP address and browser type. We use session tokens stored in your browser's local storage to keep you logged in.

3. How We Use Your Data

  • Providing the service: Authenticating your account, serving practice questions, tracking progress, generating reports.
  • Subscription management: Processing payments, managing your plan, sending billing receipts.
  • Service communications: Sending you important information about your account or subscription (e.g. payment failures, plan changes). We will not send marketing emails without your explicit consent.
  • Improving SATs Arcade: Understanding which topics pupils find hardest, identifying bugs, and improving our question bank and adaptive algorithm.
  • Marketing attribution: Understanding which channels (e.g. Google, social media, word of mouth) bring new users to SATs Arcade, so we can invest our marketing budget sensibly.
  • Safety and fraud prevention: Protecting the platform from abuse.

5. Children's Data

Protecting children's privacy is a priority for us. Our service is designed for Year 6 pupils (typically aged 10–11), and we take the following steps to safeguard their data:

  • Only adults (parents or teachers) may create accounts. Children cannot register themselves.
  • We collect only the minimum data needed for a child profile: a first name or nickname, and year group.
  • Practice and progress data is linked to the child's profile and is only visible to the registered parent or teacher, and to school staff if the school has a licence.
  • We do not display children's real names publicly on leaderboards — only display names chosen by the parent.
  • We do not serve targeted advertising to children or use their data for any commercial profiling.
  • If you believe a child has registered an account without parental consent, pleasecontact us and we will delete the account promptly.

6. Data Sharing

We do not sell your data. We share it only in the following limited circumstances:

  • Payment processors: When you subscribe, your payment data is processed by Stripe. Stripe's privacy policy applies to payment processing.
  • Hosting and infrastructure: Our servers and databases are hosted with reputable cloud providers. These providers process data on our behalf under data processing agreements.
  • School staff: If your child is in a class linked to a school licence, the teacher and school admin can see your child's progress data within SATs Arcade. This is the intended function of the school plan.
  • Legal obligations: We may disclose data if required by law, court order, or to protect the safety of our users.

We do not share your data with advertisers, data brokers, or any third party for marketing purposes.

7. Schools & Data Processing Agreements

When a school signs up for SATs Arcade, the school acts as the data controller for its pupils' data, and SATs Arcade acts as a data processor on the school's behalf. This relationship is governed by a Data Processing Agreement (DPA) which we enter into with every school customer.

Schools are responsible for obtaining any necessary consents from parents before enrolling pupils on the platform. If you are a school and have questions about our DPA, please contact us.

8. Data Retention

  • Active accounts: We keep your data for as long as you have an account with us.
  • Deleted accounts: When you delete your account, we delete your personal data within 30 days. Anonymised, aggregated statistics may be retained.
  • Financial records: Invoice and payment records are retained for 6 years to comply with UK tax law.
  • Backups: Data may persist in encrypted backups for up to 90 days after deletion before being permanently purged.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access: You can request a copy of all personal data we hold about you and your child.
Right to rectification: You can ask us to correct inaccurate or incomplete data.
Right to erasure: You can ask us to delete your data ("right to be forgotten"). Some exceptions apply (e.g. legal obligations).
Right to restriction: You can ask us to limit how we use your data in certain circumstances.
Right to data portability: You can ask for your data in a machine-readable format.
Right to object: You can object to processing based on our legitimate interests.
Right to withdraw consent: Where processing is based on consent (e.g. marketing emails), you can withdraw it at any time.

To exercise any of these rights, contact us. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

10. Security

We take reasonable technical and organisational measures to protect your data, including:

  • All data transmitted between your browser and our servers is encrypted using HTTPS (TLS).
  • Passwords are hashed using bcrypt — we never store plain-text passwords.
  • Access to personal data is restricted to authorised personnel only.
  • Our databases are not publicly accessible.

No system is 100% secure. If you believe your account has been compromised, please contact us immediately.

11. Cookies & Local Storage

We use browser local storage (not traditional cookies) to keep you logged in and to save your accessibility preferences (such as dark mode and font size). We do not use third-party advertising cookies. For full details, see our Cookie Policy.

12. Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will notify you by email or by displaying a prominent notice in the app. The "last updated" date at the top of this page will always reflect the most recent revision.

13. Contact Us

If you have any questions, requests, or concerns about this policy or your data:

SATs Arcade

Contact form

If you are not satisfied with our response, you have the right to complain to the ICO at ico.org.uk/make-a-complaint.