ByteSizeNotes

PRIVACY NOTICE

Private by default.

What ByteSizeNotes collects, why it is needed, who receives it and the choices available to students and families.

Version 17 September 2026 · local draft

The short version

  • Four IGCSE sample lessons can be viewed without an account; other released lessons require Pro or eligible verified school access.
  • Accounts store only what is needed for sign-in, progress and requested features.
  • No public profiles, student messaging, behavioural advertising or location tracking.
  • Student information is not sold.
  • Longer practice answers may be sent to Cloudflare AI for formative rubric feedback only when the account has AI-marking access. ByteSizeNotes does not include the student’s name or email and does not save the submitted answer text to the account database.

1. Who is responsible

The data controller is Stavros Vorkas, Cyprus, operating ByteSizeNotes. Privacy requests: contact@bytesizenotes.com. Safety reports: safety@bytesizenotes.com.

ByteSizeNotes is an independent education service, not a social network.

2. Information used

  • Account: email, display name, role, broad age band, policy acceptances and secure sign-in/session records. The exact verified email domain determines whether an eligible school-access rule applies. An exact date of birth is not requested.
  • Learning: selected course, lesson progress, completed practice, estimated scores, usage limits and revision priorities.
  • Practice answers: answer text is processed to return immediate scoring feedback only when the account has marking access. Exact-answer tasks are checked by ByteSizeNotes. For longer answers, the question, approved scoring criteria and answer text may be sent to Cloudflare AI without the student’s name, email or account ID. ByteSizeNotes does not save submitted answer text to the account database. A local draft may remain on the device until cleared.
  • Future billing: plan, subscription state, provider references and receipts. Stripe receives payment-card details; ByteSizeNotes does not receive full card numbers.
  • Security and contact: limited request/audit records and messages deliberately sent to contact, privacy, billing or safety addresses.

Do not put passwords, addresses, health information or another person’s private information into a practice answer.

3. Purposes and legal bases

Provide accounts and learning featuresNecessary to perform the requested service or take steps requested before an account contract
Future subscriptions and receiptsContract and applicable accounting/legal duties
Keep the service secure and respond to supportLegitimate interests in operating a safe, reliable learning service
Respond to privacy or safety mattersLegal duties, legitimate interests and protection of vital interests where relevant

Optional marketing and advertising tracking are not active. If introduced, they will have a separate choice where the law requires one.

4. Services receiving information

  • OpenAI Sites and Cloudflare: website delivery, account database, security and hosting infrastructure.
  • Cloudflare Workers AI: transient processing of longer practice answers against ByteSizeNotes scoring criteria. The request does not include the student’s name, email or account ID. Provider-side prompt logging must remain disabled.
  • Resend: magic sign-in links and other transactional email.
  • Cloudflare Email Routing and Google/Gmail: messages sent to ByteSizeNotes contact or safety addresses.
  • Stripe: payment and subscription processing only when payments are enabled.

No advertising or optional analytics provider is active. The complete one-page record is in Data & services.

Some providers may process information outside Cyprus or the European Economic Area. Where GDPR applies, ByteSizeNotes will use an applicable transfer mechanism and provider safeguards. Information may also be disclosed where required by law or necessary to protect someone from serious harm.

5. How long information is kept

Practice answer textProcessed for the response; not stored in the account database
Magic sign-in links15 minutes, then expired and purged
Signed-in sessionsSchool-access sessions up to 14 days; other sessions up to 30 days; all end on sign-out/account deletion
Account and progressWhile the account is active, then erased or anonymised after valid deletion
Local drafts and settingsUntil cleared by the user or browser
Security/audit recordsNormally up to 12 months, longer only for an active incident or legal need
BackupsRolling expiry, currently planned at 35 days after deletion
Billing/tax recordsOnly for the period required by applicable law

6. Your choices and rights

  • Download account data from the account page.
  • Ask for access, correction, deletion, restriction or portability.
  • Object to processing based on legitimate interests.
  • Withdraw consent where consent is the legal basis; this does not affect earlier lawful processing.
  • Complain to the Cyprus Commissioner for Personal Data Protection or another competent supervisory authority.

Requests can be made at contact@bytesizenotes.com. ByteSizeNotes may ask for proportionate identity verification and normally responds within one month. Children keep their own privacy rights even where an adult helped with an account.

7. Children, schools and automated decisions

Student accounts are available to learners aged 14 or over. Access to the student trial is by invitation. Eligible individuals using a verified @englishschool.ac.cy address may receive school access from ByteSizeNotes; this does not claim a school partnership or a school-controlled deployment. Any formal deployment would require responsibilities to be agreed in writing.

Practice tools give formative feedback. Longer answers may use Cloudflare AI to estimate which approved rubric points are present only when the account has AI-marking access; ByteSizeNotes validates the evidence and calculates the score. The estimate can be wrong, can be compared with the scoring guide and does not make a legal or similarly significant decision about a student. Profiling and automated high-impact decisions are not used.

8. Security and changes

Controls include short-lived browser-bound sign-in links, secure cookies, origin checks, rate limits, restricted administration, audit records, encrypted provider connections, account export and verified deletion. Eligible school accounts are limited to two active sessions and a later sign-in removes the oldest session. ByteSizeNotes does not use hardware fingerprinting or location tracking. No online service is risk-free.

Necessary cookies and device storage are explained in Cookies & storage. Material privacy changes will be clearly versioned and renewed agreement requested where required.