Privacy Policy

Last updated: [date to be set when published]

1. Who this policy covers, and who is responsible for what

EchoAural ([legal entity name to be confirmed — sole trader or registered company], "EchoAural", "we", "us") provides an online listening-skills practice platform for GCSE/iGCSE Music (Cambridge 0410) to schools and teachers ("Schools").

EchoAural is sold to Schools and individual teachers, not directly to parents or students. This means, under UK data protection law:

• For a teacher's own account details (their name, email address, and login) — EchoAural is the data controller.
• For student data that a teacher enters or that a student generates while using the platform (a student's name, class, and their answers, scores, and progress) — the School is the data controller, and EchoAural acts as a data processor, processing that data only on the School's instructions and for the purpose of providing the service.

If you are a parent, guardian, or student with a question about how your (or your child's) data is used, your first point of contact should be the School, since they control that data. EchoAural will always assist a School in responding to such requests.

2. What data we collect

From teachers

• Name, email address, and school name
• A securely hashed password (we never store your actual password — it is hashed using bcrypt before storage, and we cannot see or recover it)
• Class and student records you create (student names, usernames)
• Usage of the platform (which classes/sessions you create, when you log in)

From students (entered by their teacher/School, or generated by the student's own use of the platform)

• First name and/or a class-assigned username (Schools decide what identifying information to give us — we do not require a student's full legal name)
• A securely hashed password, where a student has their own login
• Answers submitted, scores, and progress data across the platform's practice modules, Live Sessions, and homework tasks

Automatically, from anyone using the site

• Standard web server logs (IP address, browser type, page requested, timestamp) — used only for security, diagnosing faults, and keeping the service running, never for tracking or advertising
• A functional session cookie, used only to keep you logged in — we do not use advertising or third-party tracking cookies

3. Why we process this data

• To provide the service a School has subscribed to — delivering practice questions, tracking progress, running Live Sessions, marking homework, and showing teachers their class's progress.
• To operate teacher accounts — signing you in, remembering your settings, and sending you service-related emails (for example, account setup or a security alert).
• To keep the service secure and working — diagnosing errors, preventing abuse, and improving reliability.

Our legal basis for processing a teacher's own account data is performance of the contract we have with the School/teacher, and our legitimate interest in running and securing the service. For student data, the lawful basis is determined by the School as data controller, and EchoAural processes that data strictly under the School's instructions and the contract between EchoAural and the School.

4. Who else sees this data

We use a small number of other companies to run the service ("sub-processors"). We do not sell data to anyone, and we do not use it for advertising.

• Render — our cloud hosting provider, which hosts our application and database.
• Resend — our transactional email provider, used only to send account-related emails (for example, a teacher's account setup email).

[To be confirmed: the physical region(s) in which Render hosts our infrastructure, and whether that involves any transfer of data outside the UK/EEA — if so, this section needs to describe the safeguard used, e.g. Standard Contractual Clauses.]

5. How long we keep data

• While a School's subscription is active, we retain their data for as long as needed to provide the service.
• If a subscription is not renewed, we retain the School's data for 90 days after expiry, during which the School can renew and resume with everything intact. We will email the School's teacher(s) during this window to let them know the account has lapsed.
• If the subscription has not been renewed after 90 days, all associated data (teacher and student records, progress history) is permanently deleted.
• A School may request earlier deletion of their data at any time by contacting us (see section 8).

6. Keeping data secure

Passwords are never stored in plain text — they are hashed using bcrypt, an industry-standard one-way hashing algorithm, before being saved. Data is stored in a managed PostgreSQL database hosted by Render. Access to production systems is restricted to EchoAural's own operator(s).

7. Your rights

Under UK GDPR, you have the right to request access to, correction of, or deletion of your personal data, and to object to or restrict certain processing. Where EchoAural is the data controller (teacher account data), you can exercise these rights by contacting us directly (section 8). Where a School is the data controller (student data), please contact the School first; EchoAural will assist the School in fulfilling the request.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), if you believe your data has been mishandled.

8. Contact us

For any question about this policy or your data, email james@echoaural.com.

9. Changes to this policy

We may update this policy from time to time — for example, if we start using a new service provider or change how we handle data. We'll update the "last updated" date above when we do, and for any significant change, we'll notify Schools directly.