Privacy Policy

Who we are

Edlune is a study and revision platform operated from the United Kingdom. For the purposes of the UK GDPR and the Data Protection Act 2018, Edlune is the data controller responsible for your personal data. You can reach our data protection contact at legal@edlune.com.

At a glance

• We only collect what we need to run Edlune and improve your learning experience.
• We never sell your personal data.
• You can request a copy of your data or delete your account at any time.
• You have rights under the UK GDPR, and you can complain to the Information Commissioner’s Office (ICO).

Information we collect

• Account: name (if provided), email address, password hash, and role (e.g. student).
• Study content: notes, flashcards, practice attempts, scores, progress, and preferences.
• Usage data: device and browser information, approximate location derived from your IP address, app events, and diagnostics.
• Payments: handled entirely by our payment processor. We do not store card numbers or full payment details.
• Support communications: messages you send us and our responses.

How we use your data & our lawful bases

Under Article 6 of the UK GDPR, we rely on the following lawful bases:

• Performance of a contract: to provide Edlune, create your account, save your progress, and process subscriptions.
• Legitimate interests: to personalise study workflows, improve reliability and security, prevent abuse, and understand aggregate usage — balanced against your rights.
• Consent: for optional communications and non-essential cookies, which you can withdraw at any time.
• Legal obligation: to comply with applicable laws and respond to lawful requests.

We do not carry out automated decision-making that produces legal or similarly significant effects on you.

Children & young people

Edlune is intended for secondary school and college students. You must be at least 13 to create your own account. Children under 13 may only use Edlune through a school or institution that has obtained any necessary consent. We do not knowingly collect personal data from children under 13 without such consent. We design our service with the ICO’s Age Appropriate Design Code in mind. If you are a parent or guardian with a concern about a child’s data, please contact legal@edlune.com.

Sharing & processors

We share data with trusted service providers (for example hosting, email delivery, payments, and analytics) strictly to operate Edlune. They act as our processors under written data processing terms and on a need-to-know basis. We do not sell personal data. We may disclose data where required by law or to protect the rights, safety, and security of our users and the platform.

International transfers

Edlune is operated from the United Kingdom. Some of our processors may handle data in the EEA, the United States, or other countries. Where we transfer personal data outside the UK, we use appropriate safeguards, such as UK adequacy regulations or the UK International Data Transfer Agreement (or Standard Contractual Clauses with the UK Addendum).

Data retention

We keep personal data only as long as necessary to provide Edlune and meet our legal obligations. You can delete your account at any time in settings; associated study content is removed within a reasonable processing window unless we are legally required to retain it.

Cookies & similar technologies

We use essential cookies to keep you signed in and make the site work. We may use analytics to understand aggregate usage. Where required, we ask for your consent before setting non-essential cookies, and you can manage preferences through your browser settings.

How we protect your data

We use technical and organisational measures including encryption in transit, hashed passwords, and access controls to protect your data. No system is perfectly secure, but we work continuously to safeguard your information and will notify you and ICO of a reportable personal data breach where required by law.

Your rights

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete your data in certain circumstances.
• Restriction: ask us to limit how we use your data.
• Portability: receive certain data in a portable format.
• Object: object to processing based on our legitimate interests.
• Withdraw consent: where we rely on consent, withdraw it at any time.

To exercise any of these rights, email legal@edlune.com. We will respond within one month. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, although we’d appreciate the chance to resolve your concern first.

Changes to this policy

If we make material changes, we’ll notify you (for example by email or in-app notice). Continued use of Edlune after changes take effect constitutes acceptance of the updated policy.