The short version (please read this first)
We wrote this so a 15-year-old can understand it, because most of the people who use Levo are students.
- We only collect what we need to run Levo for you — your account details, what you're revising, and how you're doing. Nothing more.
- We never sell your data. Not to anyone, ever.
- We don't track you around the internet or show you targeted ads. Especially not if you're under 18.
- Your revision progress is yours. Ask us any time for a copy of it, or to delete your account entirely.
- If a parent pays for your subscription, they can see your progress on a parent dashboard. We tell you here so there are no surprises.
- Your payment card details never touch Levo. They go straight to our payment provider, who handles all of that securely.
The rest of this policy explains all of that in full. If anything is unclear, email us at info@levolearning.co.uk and we'll explain it plainly.
1. Who we are and how to contact us
Levo ("Levo", "we", "us", "our") is a revision platform operated by LEVO Learning Ltd, a company registered in England and Wales (company number 15457991), registered office 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF.
For anything to do with your personal data — questions, requests, or complaints — contact us at:
- Email: info@levolearning.co.uk
- Post: Data Protection, LEVO Learning Ltd, 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF
We are the data controller for the personal data described in this policy. That means we decide what data is collected and why, and we are responsible for looking after it.
We are registered with the UK's Information Commissioner's Office (ICO), the data protection regulator.
2. Who this policy is for
This policy covers everyone whose data we hold: students who use Levo to revise, and parents or guardians who pay for or oversee a student's subscription.
Because Levo is built for GCSE and A-Level students, we design the whole service on the assumption that our users may be children (under 18). We apply the UK's Age Appropriate Design Code (the "Children's Code") standards to everyone by default — high privacy settings, minimal data collection, and no behavioural profiling — rather than only to users we know are underage. It's simpler, safer, and it's the standard we think every student deserves.
A note on age: Levo is intended for students aged 13 and over. If you are under 13, please do not create an account — ask a parent or guardian to set one up and manage it for you. If we learn we are holding data for a child under 13 without the right parental involvement, we will delete it.
3. The personal data we collect
We group the data we collect into the categories below. We do not collect special category data (such as data about health, ethnicity, religion, or biometrics), and we ask you not to send it to us.
| Category | What it includes |
|---|---|
| Identity data | First name, username, and (if you tell us) your age band or school year. |
| Contact data | Email address. Postal address only if a parent provides one for billing. |
| Account data | Login credentials (handled by our authentication provider — we never see your password in plain text), settings, and preferences. |
| Subscription & transaction data | Which plan you're on, subject selections, renewal dates, and a record that a payment was made. We do not store your card number (see section 6). |
| Learning & progress data | The heart of the service: subjects and topics you study, your answers, your Step 1 → Step 3 recall scores, accuracy over time, streaks, targets, and time spent. This is what lets Levo track your progress and schedule your revision. |
| Technical & device data | IP address, browser and device type, and similar information collected automatically to keep the service secure and working. |
| Usage data | How you move through the platform — which features you use — so we can improve it. |
| Marketing & communications data | Your preferences for receiving emails from us, and whether you've opted in or out. |
If you contact our support team, we also keep a record of that correspondence so we can help you.
4. How we collect your data
We collect data in three ways:
- Directly from you — when you create an account, choose subjects, use the platform, subscribe, or contact us.
- Automatically — as you use Levo, through cookies and similar technologies (see our separate Cookie Policy) and through your learning activity.
- From a small number of trusted providers — our authentication provider, our payment provider, and our analytics provider may pass us limited data needed to run the service (for example, confirmation that a payment succeeded).
5. Why we use your data, and our lawful bases
Data protection law requires us to have a valid "lawful basis" for everything we do with your data. Here's exactly what we do and why.
| What we do | Data used | Lawful basis |
|---|---|---|
| Create and run your account; deliver the revision method; track and save your progress | Identity, Account, Learning & progress | Performance of a contract with you (or with the parent who subscribed on your behalf) |
| Take and manage your subscription payments | Subscription & transaction | Performance of a contract and legal obligation (we must keep financial records) |
| Keep the platform secure, prevent fraud and abuse, and fix problems | Technical, Usage, Account | Legitimate interests — running a safe, working service (we've weighed this against your rights) |
| Understand how the platform is used so we can improve it | Usage, Technical (aggregated / de-identified wherever possible) | Legitimate interests — improving the product |
| Show a parent/guardian a dashboard of their child's progress | Learning & progress | Performance of a contract with the paying parent; disclosed to the student here for transparency |
| Send you service messages (receipts, password resets, important notices) | Contact | Performance of a contract / legal obligation |
| Send you marketing about Levo (only if you've opted in) | Contact, Marketing | Consent — which you can withdraw at any time |
We do not:
- Sell or rent your personal data to anyone.
- Show you behaviourally targeted advertising, or build advertising profiles — this is a firm rule for all users and an absolute one for anyone under 18.
- Use "nudge" techniques designed to get children to weaken their privacy or hand over more data than they need to.
Automated decisions: Levo uses spaced-repetition scheduling to decide when to bring a topic back to you. This is a teaching tool to help you remember — it is not a decision that has legal or similarly significant effects about you (it doesn't grade you, place you, or assess your ability for any outside purpose). It simply organises your revision.
6. Payments — how we keep your card safe
Your payment card details never reach Levo's systems. We use Stripe as our payment processor and secure checkout provider. Your card data goes directly to Stripe; we receive subscription, payment status and limited transaction information needed to provide and manage your plan.
This means:
- We are never storing, processing, or transmitting your raw card number.
- Our payment provider is responsible for the security standards (PCI-DSS) around your card data.
- Your parent (if they're the one paying) deals with the same secure checkout.
7. Who we share your data with
We keep the list of people who touch your data deliberately short. We share it only with:
- Service providers ("processors") who help us run Levo, each under a written contract that binds them to protect your data and use it only for us. These cover our cloud hosting and database, authentication, payments, email delivery, and analytics. We will provide the current list of named providers on request.
- Professional advisers (lawyers, accountants, auditors) where genuinely needed.
- Regulators or authorities where the law requires it.
- A buyer or successor if Levo is ever restructured, sold, or merged — in which case your data stays protected under the same terms.
We never allow these providers to use your data for their own purposes. And to repeat, because it matters: we never sell your data.
8. Sending data outside the UK
Some of our providers may process data outside the UK. Where that happens, we make sure it's protected by a legal safeguard recognised under UK data protection law — such as an adequacy decision, the UK–US Data Bridge, or an International Data Transfer Agreement (IDTA) / Standard Contractual Clauses. You can ask us for details of the safeguard used for any specific transfer.
9. How long we keep your data
We keep your data only as long as we need it:
- Your account and learning data: for as long as your account is active, plus a short period afterwards in case you come back. When your account is closed, we delete or anonymise this data.
- Financial records: we're legally required to keep basic transaction records for 6 years for tax purposes.
- Anonymised/aggregated data (which can no longer identify you): we may keep indefinitely to understand and improve how Levo works.
You can ask us to delete your data sooner — see your rights below.
10. How we protect your data
We take security seriously — it's a core design principle, not an afterthought:
- Encryption of your data in transit (HTTPS everywhere) and at rest.
- Managed authentication — we use a specialist provider and never build our own password storage.
- Least data, least access — we collect the minimum we need and limit who can see it, so you only ever access your own data.
- Regular backups so your progress isn't lost.
- Monitoring for problems, and a plan to respond fast if something goes wrong.
If a data breach ever occurs that risks your rights, we will report it to the ICO within 72 hours where the law requires, and tell you if you're likely to be seriously affected.
11. Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you.
- Correct it if it's wrong or incomplete.
- Delete it ("right to erasure").
- Restrict or object to how we use it.
- Port it — get a copy in a portable format, or have it sent elsewhere.
- Withdraw consent at any time, where we relied on consent (for example, marketing).
- Complain to the ICO (ico.org.uk, helpline 0303 123 1113) — though we'd appreciate the chance to put things right first.
To exercise any of these, email us at info@levolearning.co.uk and we'll respond within one month. Exercising your rights is always free.
12. Students, parents and guardians
Levo is used by students, and often paid for by a parent or guardian. Here's how that works for your data:
- If you're a student: the data rights above are yours. You can ask us to access, provide a copy of, or delete your data regardless of who pays.
- If you're a parent/guardian who subscribes for a child: you enter the paid contract with us, and you can see your child's progress through a parent dashboard. We disclose the existence of that dashboard to the student, so they know what a parent can see.
- For younger users: where a child is below the age of digital consent, we route account setup and any consent-based processing through the parent or guardian.
Levo is a closed platform: there are no public profiles, no leaderboards, no chat, no messaging, and no way for users to contact each other. This is a deliberate safeguarding choice.
13. Cookies
We use a small number of cookies to keep Levo working and keep it secure. We don't use advertising or analytics-tracking cookies, so there's no consent banner to click through. Full details, and how to control them, are in our separate Cookie Policy.
14. Changes to this policy
We'll update this policy from time to time as Levo grows. When we make a significant change, we'll update the date at the top and, where appropriate, tell you by email or through the platform. The current version always lives at levolearning.co.uk/privacy.
15. Glossary
- Data controller — the organisation that decides how and why your data is used. That's Levo.
- Processor — a company that handles data on Levo's behalf, under contract (e.g. our hosting or email provider).
- Performance of a contract — using your data because it's necessary to deliver the service you (or your parent) signed up for.
- Legitimate interests — using your data for a good reason of our own (like security or improving the product), but only after checking it doesn't override your rights.
- Consent — you've actively agreed. You can take it back any time.
- Special category data — especially sensitive data (health, ethnicity, religion, biometrics). We don't collect it.
Levo is not affiliated with, endorsed by, or connected to any examination board. Subject and exam-board names are used only to describe the curriculum our content covers.