Privacy Notice

1. Who is responsible for your information?

This notice covers AceLearningNow accounts, question practice, Notes, dashboards, Teams, Family & Study Groups, school workspaces and billing.

Service

AceLearningNow (ALN)

Legal operator

Korek Production F.Z.E

Business address

B.C. 1308559, Ajman Free Zone C1 Building, Ajman Free Zone, Ajman, United Arab Emirates

Registration

Ajman Free Zone Authority · Business licence no. 54975 · Registration no. 54975

Contact

help@acelearningnow.com

For direct accounts, Korek Production F.Z.E decides why and how personal information is used: this is called being a data controller. Korek Production F.Z.E also remains responsible for ALN’s own account security and business administration.

Where a school has a signed agreement with us for school-managed accounts, the school is the controller for those learning records and we process them only on its instructions. Teams that a teacher sets up without a school agreement are run by us as controller, like any other direct account.

Which laws apply: we are based in the Ajman Free Zone, which has no data protection law of its own, so we follow UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Because we offer ALN to learners in the United Kingdom and the European Union, the UK GDPR and the EU GDPR also apply to how we handle their information.

Data protection officer: we have not appointed a data protection officer, because our processing does not meet the legal tests that require one: we do not handle sensitive categories of data, and our learning records are limited and not processed on a large scale. We will review this as ALN grows. Privacy questions go to the contact above.

2. Information we use and where it comes from

• Accounts: your email address, the name you choose to show other people (your display name), a protected password hash, account creation and last login times, session identifiers, settings, access level and account status. Since 2 October 2026, signup asks for an email address, a password and a display name; ALN also gives each account an internal username that it does not show. Accounts created before then, and accounts created by a school, sign in with a username and may add an email for password recovery. Signup does not ask for your date of birth or real name: a first name or nickname is fine as a display name. We use your email to sign you in, to confirm it, to reset your password and to send messages about your account (security notices, and free-trial emails), never for marketing.
• Free trial: when you confirm your email, we record when your 7-day trial started and ends, and which trial emails we sent. To give one trial per person and email address, we also keep a scrambled (keyed hash) form of your email address, written in a standard form so that versions of one address that reach the same inbox match. It is not linked to your account and is kept after you delete it (see section 5).
• Learning: question and subject identifiers, the correct/incorrect results you record, attempt history and times, assignment timing records, question and note access counts, and Notes reading position, bookmarks and completion. Your dashboard uses these records to show activity and learning summaries.
• Groups and schools: group names, display names (or the usernames of older accounts), roles, memberships, assignments, completion records and activity messages. Groups are joined with a code from the owner; we store only a scrambled (hashed) form of each code. Teachers, school staff and group owners may supply this information. A school can create and manage a student account and issue a temporary password.
• Payments and access: selected products, subject or group scope, seat counts, Stripe customer/subscription/checkout identifiers, payment or subscription status, renewal dates, cancellation status and access-code or promotional grants. Stripe collects payment details and may collect billing contact and tax information at checkout. ALN’s application does not store full card numbers or security codes.
• Help and administration: information you choose to send in a support request or model-answer report, safety reports (who reported, a copy of the reported text, its author, the reason and any note, and the moderator’s decision), announcement acknowledgements and administrative audit records. Please avoid including sensitive personal information in free-text fields.
• Technical information: cookies and browser storage described in our Cookies policy, network addresses needed to deliver and secure requests, and error/security information. Account-linked page/API access logging can be enabled by the operator. Hosting systems may also keep request logs.

An email address, a password and a display name are needed to create a direct account. Payment information is needed only for a purchase. You can use public pages without an account; saved learning progress and membership features need an account. Optional browser preferences are your choice.

3. Why we use information

The following is the proposed UK GDPR basis for each purpose; other applicable laws may use different conditions. Reading this notice is not consent to every use of your information.

ALN has an optional usage log that can record which pages an account opens. It is switched off. We will update this notice before switching it on.

We do not rely on consent for the core learning service, so it works the same way whatever the age of digital consent is in your country. You can object to any use based on legitimate interests (see section 7).

Users in the UAE: UAE law has no general legitimate-interests basis. We process your information because it is needed to provide the service you asked for, to meet our legal obligations, or, for optional features, with your consent.

4. Who can see your information?

Your name and email: other people in your Teams, Family or Study Group, and staff of your school, see your display name (or the username of an older account), never your email address. A display name can be reported like other text people write; a moderator can replace it with a neutral one.

Teams: team owners and admins (usually teachers) can see each member’s display name, role, assignment progress and recent activity, and they manage assignments and the Team’s join code. Other members can see who is in the team, the shared assignments and changes to them, but not your individual progress, your plan or sponsorship, or who else joined, left or was removed. Detailed per-question attempt history is not exposed merely by Team membership. Some access-level and sponsorship information is also visible within the Team. Recording an attempt on an assigned question can update the assignment’s progress, including when you practise outside the assignment screen. Your progress in a Team is therefore visible to its teachers and managers.

Schools: authorised staff can manage the school roster, class membership and managed student accounts, including resets or disabling accounts. Class progress uses Teams. Ask your school for its own privacy notice and how it uses learning records.

Family & Study Groups: members can see the group’s roster (display names), roles and subscription status; the owner manages the join code and shared access. Family membership alone does not provide a parent dashboard showing your private attempt history or Notes progress. Separate Team membership can expose Team progress as described above.

ALN and service providers: authorised operators access information for support, security and administration. Hosting, backup and other contracted providers may process information needed to operate the service. Stripe handles payments under its Privacy Policy, with responsibilities depending on the activity. It does not need your learning history to take a payment.

ALN serves its fonts from its own servers, so no font provider receives your connection details.

We may disclose information where the law requires it or where necessary to investigate abuse or protect rights, applying the relevant safeguards.

Our commitments:

• We do not sell learner data.
• There is no third-party advertising at launch. If we ever introduce adverts for Free accounts, we will update this notice first, and they will not be personalised using your learning history.
• We send account and billing messages only where they are needed to run your account. Any marketing messages will be optional and will need your separate choice.
• Some learning content, such as model answers and notes, is prepared with AI assistance and then checked. The app does not send your attempts, answers or other identifiable learner information to an external AI service.

5. How long information is kept

Account and learning records are kept while the account exists. The table below sets out the retention periods we propose; until automatic cleanup is in place, inactive accounts are not yet deleted automatically. Deleting an account removes its live learning records, its linked records and any legacy practice files held for it outside the database. Some group activity messages, administrative audit text or provider event identifiers can remain and may still refer to the account. Deletion in ALN does not itself erase Stripe’s records, copies held by a school or browser storage on your devices.

We keep information only as long as it is needed for its purpose, then delete it or make it no longer identify you.

6. Where information is processed and how it is protected

Passwords are stored as hashes. The application uses access checks, revocable sessions and request-forgery protection; its production configuration requires secure cookies. Access and recovery arrangements also depend on the deployed hosting and operating procedures.

You give your information directly to us, a company based in the United Arab Emirates. Where it goes after that:

• Our servers are run by Netcup in Germany, in the European Union. The UK recognises the EU as giving adequate protection. Encrypted backups are kept with Cloudflare R2, also in the European Union.
• Our team accesses the servers from the UAE. Neither the UK nor the EU has recognised the UAE as giving adequate protection, so this access is protected by contract terms with our hosting provider and by our own security measures.
• Cloudflare (United States) delivers and protects the website traffic, and Stripe (United States and elsewhere) takes payments. Both are certified under the EU–US Data Privacy Framework and its UK extension.
• Account emails we send (confirmation links, password resets, security notices, free-trial emails) go through Zoho ZeptoMail, in its United States data centre, under the standard contractual clauses in Zoho’s data processing agreement. Messages to help@acelearningnow.com are forwarded by Cloudflare to our company mailbox, hosted by Google Workspace (Google is certified under the EU–US Data Privacy Framework and its UK extension).

For UAE users, these transfers rely on the protection in the destination country, on contracts requiring equivalent protection, or on the transfer being needed to provide the service you asked for. You can ask us for a copy of the safeguards we rely on.

7. Your choices, rights and complaints

Depending on the law and the processing, you can ask to access and correct your information, delete it, restrict its use, object to uses based on legitimate interests, or receive a portable copy of information you provided. You can withdraw consent at any time without affecting the lawfulness of earlier consent-based use. These rights have conditions and exceptions.

Use Settings for available account controls, password changes and account deletion. The current deletion flow asks for your password and confirmation. It can require you to stop renewing subscriptions first, transfer school ownership, or close/transfer an owned Family group. Deleting an owner’s account can also delete their ordinary Teams and assignments. If that flow cannot meet your request, contact the operator; these product steps do not remove your legal rights.

There is no general self-service personal-data export button at present. Request access or an export through the contact above. We may ask for proportionate evidence to protect you from someone impersonating you; never send your password or full card details. Under UK GDPR, requests are normally answered within one month, subject to lawful extensions or exceptions. For school-controlled data, contact your school or ask ALN to help direct the request.

Complaints: you can complain to us at the contact above. We acknowledge a privacy complaint within 30 days and tell you the outcome without undue delay. You can also complain to a regulator at any time:

• in the UK, the Information Commission (formerly the Information Commissioner’s Office);
• in the EU, the data protection authority where you live or work (list of EU authorities);
• in the UAE, the UAE Data Office, now part of the Federal Authority for Artificial Intelligence and Data.

8. Children and automated learning summaries

ALN is intended for school-age learners aged 13 or older. You must be 13 or older to create your own account, and only adults can buy plans. We do not offer accounts for children under 13, including accounts created by a school; school staff confirm each student is at least 13. Choose a display name that avoids your full name, school name or contact details; a first name or nickname is fine. The young learner explanation describes sharing in simpler language. Children have their own privacy rights; adult involvement should reflect their age, understanding and applicable law.

ALN calculates streaks, completion, weak-topic summaries and access limits from activity, settings and plan records. These help organise practice; they are not official exam grades or school admission decisions. No solely automated decision with a legal or similarly significant effect was identified in the reviewed learning features. Contact the operator if you think a record or access decision is wrong.

At signup we record your confirmation that you are at least 13, and before each purchase the buyer’s confirmation that they are at least 18 and authorised to pay. These are self-declarations, not age verification. If we learn that an account belongs to a child under 13, for example because they, a parent or a teacher tells us, we delete the account and its learning records promptly. Send the account’s email address or username to the contact above.

We have assessed the risks to children of how ALN uses their information (a data protection impact assessment) against the UK’s Age Appropriate Design Code, and we review it every year or whenever we add a feature that uses learners’ information in a new way.

9. Changes to this notice

The effective date and version of this notice are shown at the top of the page. Material changes should be brought to users’ attention before a new use begins. Where a new use needs consent, we will ask separately.