Privacy Policy
Last updated: 22 October 2026
1. Who we are
Smarty is an online learning tool for children, operated by Antonio Beneton Junior, a sole trader based in Walsall, United Kingdom, trading as LearnSphere Academy.
We are the data controller for the personal data described in this policy.
We are registered with the Information Commissioner's Office (ICO) as a data controller, registration number ZC278357. You can check this on the ICO public register at ico.org.uk/ESDWebPages/Search.
Email us at privacy@learnsphereacademy.co.uk. Our postal address is LearnSphere Academy, The Walsall Hub, 1902 Green Lane, Walsall, WS2 8HE.
We are not a school. Smarty is a software product. We do not employ teachers, we are not registered with Ofsted or the Department for Education, we do not award qualifications, and we do not provide statutory education. Using Smarty does not discharge any legal duty a parent, carer or local authority has for a child's education.
2. What we collect
When a parent signs up: name, email address, and a password, which is stored hashed — we never see it.
When a parent creates a student account: the child's first name or nickname, their year group, and a managed account address we generate in the form name@student.learnsphereacademy.co.uk. We do not ask for a child's full name, date of birth, home address, school or photograph.
When a child uses Smarty: the messages they send and Smarty's replies; which lessons and subjects they open; how long a session lasts; and any work they upload for marking.
If they use the microphone: a recording of what they say is sent to our AI provider to be turned into text. We keep the text, as part of the lesson, and how long the recording was. We do not keep the recording itself.
If you turn on notifications: the technical address your browser gives us for sending them, linked to your account.
Automatically: the basic technical data needed to serve the site — IP address, browser type, and pages visited.
Older records. Before this version of the site, we ran a waiting list that collected email addresses only. Those records still exist and are covered by this policy. The form is no longer on the site.
We do not collect special category data — health, ethnicity, religion and so on — and we ask families not to enter it.
3. Children's data and parental consent
An account for a child under 13 must be created by a parent or carer, who gives consent on the child's behalf. A child cannot create their own account. Children aged 13 and over may create their own account with their own email address.
A parent can see their child's lesson history and reports at any time from the parent dashboard, and can ask us to delete the child's account and everything in it.
We do not serve advertising to children, we do not sell or share personal data for advertising, and we do not build advertising profiles of children.
4. How we use the data
- To provide the tutoring itself — a child's messages are sent to our AI provider so Smarty can reply.
- To produce the summary a parent sees after a session.
- To keep the service working, secure, and within usage limits.
- To detect signs that a child may be at risk (see section 6).
- To contact a parent about their account — sign-up confirmation, password resets, and service notices.
Our lawful bases are performance of a contract (providing the service), legitimate interests (keeping the service secure and working), consent (where a parent has given it for a child's account), and legal obligation where one applies.
5. Who else processes the data
A small number of providers process data on our behalf:
| Provider | What they process | Where |
|---|---|---|
| Database and account storage provider | Accounts, lesson history, reports | EU (Stockholm) |
| Website hosting provider | Hosting and delivery of the website | EU and global edge network |
| AI model provider | Messages to and from the tutor; safety checks; speech to text; spoken voice | United States |
| Email delivery provider | Account emails (confirmation, password reset) | EU (Ireland) |
| Presentation provider | Lesson content sent to create slides when asked | United States |
| Email and office provider | Email sent to our privacy address | Global, including the United States |
We will give you the names of these providers on request — write to privacy@learnsphereacademy.co.uk.
Transfers outside the UK are made under the UK International Data Transfer Addendum or equivalent safeguards.
We do not sell personal data, and we do not share it with advertising networks.
6. Safety and safeguarding
This section matters more than the rest. Please read it.
What Smarty does. Smarty checks every message a child sends for signs of distress. When it finds them, it stops the lesson, shows the child crisis support contacts — Childline and the Samaritans — straight away, and records that a flag occurred: the category and the time. We do not store the text of the message that triggered it.
What Smarty does not do. It is software, not a person reading messages as they are sent. It will not catch everything. We are not a crisis service and we cannot respond in an emergency. We are not a school, so the statutory role of Designated Safeguarding Lead does not apply to us. Our safeguarding lead, who is DBS checked, receives an email alert when a flag is raised and reviews it as soon as they can — but not around the clock, and not in an emergency.
If your child is at risk right now, call 999, or Childline on 0800 1111. Do not rely on Smarty.
7. Where data is stored
Account data, lesson history and reports are stored in the European Union, in Stockholm. Messages are processed by our AI provider in the United States and are not used to train their models.
8. How long we keep it
- Account and lesson data: while the account is open, and for 30 days after deletion is requested, then permanently erased.
- Safety flags: 12 months. A pattern over time is what makes a flag meaningful, which is the argument for keeping them longer than the lesson data they came from.
- Technical logs: 30 days.
9. Your rights
Under UK GDPR you can ask us for a copy of the data we hold about you, to correct it, to delete it, to restrict or object to how we use it, or to move it elsewhere. A parent can exercise these rights for their child.
Email the address in section 1 and we will respond within one month.
If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
10. Cookies and local storage
We use only the storage needed to keep you signed in and to remember your settings. We do not use advertising or tracking cookies on any page a child can reach, and there is no advertising pixel anywhere on the site.
11. Changes to this policy
If we change this policy in a way that materially affects you, we will email the parent account holder before it takes effect.