Draft — pending legal review. This page is an early-draft policy prepared during the SEAG Quest pilot. It will be replaced with a solicitor-reviewed version before any paid launch. Nothing on this page constitutes a contract.

Privacy Policy

Last updated: 5 October 2026

Who we are

SEAG Quest is an educational web app for Northern Irish children preparing for the SEAG transfer test. The data controller is Padraic Little, an independent developer (sole trader) based in Northern Ireland, referred to in this policy as "we", "us", or "our". A postal address is available on written request. For questions, contact us at hello@seagquest.com or via the contact page.

Data we collect

Account data: parent's email address (for sign-in and account recovery).
Child profile: chosen hero name, avatar emoji, year group (P6/P7), saga theme.
Practice data: questions attempted, answers given, time spent, accuracy by topic, achievements unlocked.
Device data: minimal technical logs needed to operate the service (e.g. browser type, error reports).

We do not collect: child's real name, school, home address, phone number, or any biometric data. We do not run advertising and do not sell or rent personal data.

How we use your data

To provide the practice experience (saving progress, unlocking achievements, generating reports).
To show parents the dashboard, weak topics, and printable progress reports.
To generate AI-tutor explanations for incorrect answers (see "AI" below).
To respond to support requests.

AI tutor explanations

The AI tutor is off by default and must be switched on by a parent in the Parent Console. While it is off, no request of any kind is made to the AI provider. Once enabled, when a child taps "Explain this answer", the question text and the correct/typed answer are sent to a third-party large-language-model provider via Google's Gemini API. We do not include the child's name, hero name, or any other identifier in that request. The provider's terms apply to that interaction. We log only an aggregate count for cost control.

Where data is stored and who processes it

Practice and account data are stored on secure cloud infrastructure (Supabase, EU region).

Supabase (EU) — database, authentication and storage.
Google (Gemini API) — AI tutor explanations, only when a parent has enabled the tutor and the child taps the button. Processing may take place outside the UK/EU under Google's data processing terms and the applicable UK/EU transfer safeguards.
Lovable — application hosting (on Cloudflare infrastructure) and transactional email, sent from notify.seagquest.com (account emails and our internal signup/report alerts).

We retain data for as long as your account is active. Pilot data is deleted 30 days after the pilot ends unless you ask us to keep the account open.

Question reports and appeals

When a child reports a question or uses the "I think I was right!" appeal, we store the question, the answer given, the chosen reason and any free-text note, and send an alert email to the operator so it can be reviewed by a person. The note field asks children not to include their name; any personal detail typed there is removed when the report is closed.

Your rights

As a parent, you can at any time:

Export your child's full progress data (Parent Console → Export).
Reset progress — clear all quiz history, XP and streaks while keeping the account and child profile intact (Parent Console → Reset All Progress).
Delete account permanently — remove your account, your child's profile, all progress, your parent email and any custom packs. Self-serve in the app: Profile → Delete account permanently. There is no recovery. You can also email hello@seagquest.com if you'd rather we do it for you.

UK GDPR rights apply, including the right to object, the right to rectification, and the right to lodge a complaint with the Information Commissioner's Office (ICO).

Children's data

The service is designed to be set up by a parent or guardian on behalf of a child. We treat all profile data as belonging to a child and apply heightened protection: no advertising, no third-party tracking pixels, no social sharing of progress without explicit action, and parent-only access to the parent dashboard via PIN.

Data Protection & Children's Code compliance summary

This section summarises how SEAG Quest meets UK GDPR and the ICO's Age Appropriate Design Code (the Children's Code). It is maintained alongside our Data Protection Impact Assessment.

Lawful basis: legitimate interests (delivering the practice service the parent has requested), supported in every case by explicit parental consent captured at sign-up. The account holder is always the parent or guardian; children do not create accounts.
Data minimisation: we collect only a parent email, a made-up hero name and avatar, year group, and question-level progress. No child real name, age, school, photo, location or contact details are collected at any point.
Local storage architecture: preferences (theme, sound, reader/dyslexia mode) and in-progress quiz state stay in the browser's local storage on the child's device and are never uploaded. Only the progress needed for the map and parent reports is stored on our servers.
High privacy by default: no advertising, no third-party analytics or tracking pixels, no profiling for marketing, no geolocation, and no public sharing of a child's progress.
Parental control and transparency: the PIN-protected, server-verified Parent Console provides export, progress reset and permanent account deletion.
Retention: data is held only while the account is active and is erased on deletion.
Processors: EU-hosted cloud infrastructure and the AI tutor provider, which receives only sanitised question and answer text, on a direct tap by the user.

A plain-English version of this summary is on the data & AI page.

Changes to this policy

We will update this page when material changes are made and notify account holders by email where appropriate.

See also: Terms of Service · Cookie Policy · Contact