Privacy Notice

Your family's trust matters to us, so we keep this plain and honest. Quest11 is built for children, and we treat their information with the care it deserves. This notice explains what we collect, why, and the control you always have.

Who we are

Quest11 is a service of Capitalizt Ltd ("we", "us"), the data controller. Company No. 16890768, registered office 128 City Road, London EC1V 2NX, United Kingdom. We are registered with the UK Information Commissioner's Office (ICO) under reference CSN0682390. We provide adaptive 11+ exam preparation for children, sold to and managed by their parents or guardians. You can reach us any time at hello@quest11.co.uk. We process personal data in line with UK GDPR and the ICO Age-Appropriate Design Code, known as the Children's Code.

What we collect

From the parent or guardian: your name, email address, a contact phone number, and your account password (kept only as a secure one-way hash). About the child, entered by you: their first name or a display name, their school year group, an optional exam date, and any accessibility preferences you set. As your child learns, we record their activity and progress, such as questions attempted, answers, timings and mastery, so we can personalise their practice and show you how they are getting on. Payments, where they apply, are handled by Stripe. We never see or store your card numbers.

Why we use it, and our lawful bases

We use your information to provide and personalise the service, to show you your child's progress, to keep accounts secure, and to improve Quest11. Our lawful bases under UK GDPR are: performance of our contract with you, to deliver the service you signed up for; your consent, for optional marketing emails, which you can withdraw at any time; and our legitimate interests, for keeping the service secure and making it better, balanced carefully against your rights and your child's.

Children's data and the Children's Code

Accounts are always held by a parent or guardian, who is 18 or over and who consents to the processing of their child's data on the child's behalf. Children do not create their own accounts. A child signs in with a short login code and a PIN that the parent creates, with no email address and no personal details required from the child. We collect the minimum we need, and we use a child's data only to personalise their learning and report progress to you. A child's learning session carries no advertising and no tracking of any kind, and we never sell data. Advertising measurement, using a Meta pixel, runs only on our parent facing marketing pages and never touches a child's account or activity. There are no exploitative engagement mechanics, no guilt-inducing pressure, loot boxes or public leaderboards aimed at children. A child can only ever see their own activity and never interacts with other users. High-privacy settings are the default.

Cookies

Inside the learning app we use only strictly necessary cookies: a Supabase auth session cookie to keep you signed in, a q11_preview cookie for the pre-launch tester gate, and a q11_cookie_ack value in your browser that remembers you have seen our cookie notice. Separately, our public marketing pages, such as our homepage and readiness check page, use a Meta advertising pixel so we can measure how well our adverts work and reach parents who may be interested. This measurement covers parent facing marketing pages only. It never runs inside a child's learning session, and children have no account and are never tracked. You can decline the advertising pixel in the cookie banner. See our full Cookie Notice for details.

Who we share it with

We do not sell your data. We use a small set of trusted processors under data-processing agreements, and only so they can help us run the service: Supabase (database and authentication, hosted in the EU, London region), Vercel (application hosting), Stripe (payments), and Resend (transactional and notification email). Where any provider processes data outside the UK, we rely on appropriate safeguards such as UK-approved standard contractual clauses, so your data stays protected.

How we keep it safe

Access is protected by database row-level security, so a parent can only ever see their own child's data and a child only their own. Passwords and PINs are stored only as secure hashes, and data is encrypted in transit and at rest. Parents confirm their email address before the account is activated.

How long we keep it

We keep your account and your child's learning data while your account is active. If you close your account, we delete your data within 30 days. If an account has been inactive for 24 months, we will contact you and then delete the data. You can delete a child's progress, or your whole account, at any time from the Privacy & your data page.

Your rights

Under UK GDPR you have the right to access your data, to rectify anything inaccurate, to erase it, to portability (a copy you can take elsewhere), to restrict or object to certain processing, and to withdraw consent at any time. The easiest way to exercise most of these is the in-app Privacy & your data page, where you can download your data, manage marketing emails, and permanently delete your account. For anything else, email hello@quest11.co.uk and we will respond within one month.

Complaints

We would always rather hear from you first so we can put things right. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

Contact

Capitalizt Ltd, 128 City Road, London EC1V 2NX · hello@quest11.co.uk