Privacy Policy

Last updated: 17 November 2025

Slay11Plus (“Slay11Plus”, “we”, “us”, “our”) is operated by Evgeny Bik, a sole trader based in the United Kingdom, doing business as Slay11Plus. We are committed to protecting your privacy and handling personal data in a clear, fair and lawful way.

This Privacy Policy explains what information we collect, how we use it, how we protect it, and the rights you have. We have written it in clear and accessible language so parents and guardians can easily understand how Slay11Plus works, especially where children’s data is involved.

By creating an account, using Slay11Plus, or allowing your child to use Slay11Plus, you agree to this Privacy Policy.

1. Who We Are (Data Controller)

Data Controller: Evgeny Bik Trading as Slay11Plus Address: 85 Great Portland Street, London, United Kingdom Email (for all privacy matters): evgeny@evgenybik.com

Slay11Plus does not appoint a Data Protection Officer because the business is operated by an individual sole trader, but all privacy enquiries should be directed to the email above.

2. What This Policy Covers

This Privacy Policy applies to:

  • Parent accounts
  • Children’s accounts created by parents
  • All writing submissions and assessments
  • Use of the Slay11Plus website/app
  • Communications between you and Slay11Plus

It does not apply to third-party websites or services you may visit through links.

3. Types of Accounts: Parents and Children

Parent Accounts

A parent (or other responsible adult) creates an account using an email address and password. All purchases are made by the parent account. Slay11Plus assumes parent accounts are created by adults. We do not verify age, but parents are fully responsible for managing and supervising child accounts.

Children’s Accounts

Parents may create one or more child accounts inside the app. For a child account:

  • The parent chooses a name (real or nickname)
  • The parent chooses a username
  • A password is automatically generated
  • No email address is collected
  • Children cannot create accounts themselves

Child accounts use credits from the parent account to submit writing for assessment.

4. The Personal Data We Collect

4.1 Data We Collect from Parents

  • Email address
  • Password (encrypted; not visible to us)
  • Payment information (handled securely by Stripe — we do not store card details)
  • Device and browser information
  • IP address
  • Activity logs and account interactions (e.g., purchases, assessments created, account changes)

4.2 Data We Collect from Children

  • The name or nickname the parent enters
  • The username created by the parent
  • Writing submissions
  • Assessment results
  • Account activity (e.g., submissions made)

We do not collect:

  • Age or date of birth
  • Email addresses
  • Special category data (e.g., health, religion, ethnicity)

4.3 Data We Collect Automatically

  • Session cookies (to keep you logged in)
  • Analytics data via Google Analytics (page views, device type, region — aggregated and anonymised)

5. What We Use Personal Data For

We process personal data to:

Provide the core service (legal basis: contract)

  • Create and manage parent and child accounts
  • Provide writing assessments
  • Deliver assessment results
  • Maintain account history and submissions
  • Allow parents to manage children’s accounts

Operate and improve the service (legal basis: legitimate interests)

  • Monitor usage
  • Prevent fraud and misuse
  • Improve the performance and reliability of the app
  • Analyse trends and user behaviour (anonymous/aggregated)

Process payments (legal basis: contract)

  • Purchases handled by Stripe

Communicate with you (legal basis: legitimate interests or consent)

  • Important service updates
  • Account notifications
  • In the future, optional marketing emails (parents may opt out at any time)

Customer support (legal basis: legitimate interests)

Legal compliance (legal basis: legal obligation)

  • Maintaining certain logs for fraud prevention and compliance

6. How We Use AI (OpenAI)

Slay11Plus uses OpenAI to generate AI writing assessments.

When your child submits writing:

  • We send only the writing text itself to OpenAI
  • No names, usernames, account IDs, or any identifying information are sent
  • OpenAI does not use the writing for training its models (data retention is disabled)

This means writing submissions are processed in a pseudonymised and minimal-data way.

7. Legal Bases for Processing

Under UK GDPR, we rely on the following legal bases:

  • Contract: To provide the Slay11Plus service, including AI assessments and account management.
  • Legitimate Interests: Analytics, fraud prevention, service improvement, security.
  • Consent: For optional marketing communications (if introduced).
  • Legal Obligation: To comply with financial and regulatory record-keeping.

8. Children’s Privacy & Parent Responsibilities

Slay11Plus is designed for children aged 10–11, but parents may create accounts for children of any age.

We follow the principles of the ICO Children’s Code by:

  • Collecting the minimum necessary data
  • Not collecting email addresses for children
  • Not collecting dates of birth
  • Not showing advertising
  • Not profiling children
  • Giving parents full oversight and control
  • Not allowing children to create accounts independently
  • Not sending any identifiable child data to AI providers

Parent Responsibilities

Because we do not verify age:

  • Parents are responsible for creating and supervising child accounts
  • Parents control and may delete child accounts and their data
  • Parents must ensure children use the service appropriately

9. Sharing Your Data with Third Parties

We share personal data only with trusted service providers essential to running Slay11Plus:

  • Stripe – payment processing (we never see your card details)
  • OpenAI – AI writing assessments (only writing text is sent, no metadata)
  • Supabase – database and account storage
  • AWS / Google Cloud Platform – cloud hosting and infrastructure
  • Google Analytics – aggregated analytics
  • Loops.so – email delivery

These providers act as data processors under UK GDPR and may store or process data outside the UK.

We do not sell or rent personal data.

10. International Transfers

Some of our processors store or process data in the United States and other countries.

To safeguard international transfers, we rely on the approved transfer mechanisms used by our processors, which include:

  • Standard Contractual Clauses (SCCs)
  • The UK Addendum
  • Regional privacy frameworks where available

We ensure all providers offer adequate protection for personal data.

11. How Long We Keep Data (Retention)

  • Parent and child account data: Kept for as long as the account is active.
  • Writing submissions and assessments: Kept until deleted by the parent or until the parent deletes the child’s account.
  • Analytics data: Kept in aggregated form only.
  • Activity logs: Retained for 2 years after account closure for fraud prevention and compliance.

When an account is deleted

  • All personal data is deleted immediately, except:

    • Activity logs, kept for 2 years

  • Writing submissions linked to a deleted child account are permanently removed and unrecoverable.

12. Your Rights Under UK GDPR

You (or the parent acting on behalf of a child) have the right to:

  • Access your personal data
  • Rectify inaccurate or incomplete data
  • Erase your data (“right to be forgotten”)
  • Restrict processing
  • Object to certain processing
  • Data portability
  • Withdraw consent (for marketing or optional features, if applicable)

You can exercise these rights by emailing: 📧 evgeny@evgenybik.com

We will respond within one month.

13. Security Measures

We use a range of technical and organisational measures to protect your data:

  • Encrypted connections (HTTPS/TLS)
  • Encryption at rest where supported by our providers
  • Strict access controls
  • Secure cloud infrastructure
  • Regular system monitoring
  • Data minimisation practices
  • No collection of unnecessary child data

14. Cookies & Analytics

Slay11Plus uses:

  • Essential cookies (for login sessions)
  • Google Analytics to understand usage patterns

We do not use advertising cookies or behavioural tracking.

Analytics data is aggregated and not used to identify individual users.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle personal data, please contact:

Evgeny Bik Email: evgeny@evgenybik.com Address: 85 Great Portland Street, London

16. Complaints and Your Right to Contact the ICO

If you are unhappy with how your data has been handled, you can contact:

Information Commissioner’s Office (ICO) Website: https://ico.org.uk Telephone: 0303 123 1113

We would appreciate the chance to resolve your concerns before you approach the ICO.

17. Changes to This Privacy Policy

We may update this policy from time to time. If we make significant changes, we will notify parent account holders by email or through the app.

Last updated: November 17, 2025