1. Introduction

E & M Engineering Consulting Ltd (trading as "f(x) Scotland"), registered in Scotland (company number [your number]), operates the f(x) Scotland maths tutoring service ("Service"). We are committed to protecting your personal data and respecting your privacy in accordance with UK data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our AI-powered maths tutoring platform.

2. Data Controller

E & M Engineering Consulting Ltd is the data controller responsible for your personal data. Our registered office is located in Scotland, United Kingdom.

3. Information We Collect

3.1 Information You Provide

• Account Information: Username, email address, and password (encrypted)
• Payment Information: Processed securely by Stripe (we do not store full card details)
• Educational Content: Your questions, conversations with the AI tutor, and topic selections
• School Information: If applicable, your school name and affiliation

3.2 Information We Collect Automatically

• Usage Data: How you interact with our Service, including features used and time spent
• Technical Data: IP address, browser type, device information, and cookies
• Subscription Data: Subscription status, payment history, and billing information

4. Legal Basis for Processing

Under UK GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: To provide our tutoring services as agreed when you sign up
• Legitimate Interests: To improve our Service, prevent fraud, and ensure security
• Legal Obligations: To comply with UK tax and accounting requirements
• Consent: For marketing communications (which you can opt out of at any time)

5. How We Use Your Information

We use your personal data to:

• Provide and maintain our AI tutoring Service
• Process your subscription payments and manage your account
• Personalize your learning experience and improve our AI responses
• Communicate with you about your account, updates, and support
• Analyse usage patterns to improve our Service
• Comply with legal obligations and protect our legal rights
• Prevent fraud and ensure the security of our platform

6. Data Sharing and Third Parties

We share your data only with trusted third-party service providers:

6.1 Service Providers

• OpenAI: To power our AI tutoring functionality (see section 7 below)
• Stripe: For secure payment processing
• Cloud Hosting: For secure data storage and service delivery

6.2 Legal Requirements

We may disclose your information if required by law, court order, or to protect our rights and safety.

6.3 No Data Sales

We never sell your personal data to third parties.

7. AI Processing and OpenAI

Our Service uses OpenAI's GPT technology to provide tutoring responses. When you ask a question, your message is sent to OpenAI's API for processing. OpenAI's data usage policies apply:

• OpenAI may use API data to improve their models unless you opt out
• OpenAI retains API data for 30 days for abuse monitoring
• We do not send personally identifiable information to OpenAI beyond necessary context

For more information, see OpenAI's Privacy Policy.

8. Data Retention

We retain your personal data for as long as necessary:

• Active Accounts: Data retained while your account is active
• Deleted Accounts: Most data deleted within 30 days; some data retained for legal/accounting purposes for up to 7 years
• Conversation History: Retained for the duration of your subscription to provide continuity

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for marketing at any time

To exercise any of these rights, contact us at admin@emengineering.co.uk

10. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption of passwords and sensitive data
• Secure HTTPS connections
• Regular security assessments and updates
• Access controls and authentication
• Secure payment processing via PCI-compliant Stripe

11. Children's Privacy

Our Service is designed for students aged 15 and above (typically National 5 level). We comply with UK regulations regarding children's data. For users under 16, we recommend parental awareness and involvement in account creation.

12. International Data Transfers

Your data may be processed outside the UK (e.g., by OpenAI in the USA). We ensure appropriate safeguards are in place through:

• Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO)
• Adequacy decisions where applicable
• Service provider certifications and security measures

13. Cookies

We use essential cookies to operate our Service (e.g., session management, authentication). We do not use tracking or advertising cookies. By using our Service, you consent to essential cookie usage.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through our Service. The "Last Updated" date at the top indicates the most recent revision.

15. Complaints and ICO

If you have concerns about how we handle your data, please contact us first. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

16. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us: