For grown-ups
Privacy notice
Effective: 19 October 2026
This notice explains what personal data KS2 Mastery keeps, why, for how long, and the choices you have. It is written for parents, carers and other adults who hold a KS2 Mastery account. The first section is for children.
For children: the short version
- A grown-up sets up KS2 Mastery for you. You do not need your own email address.
- We keep the name your grown-up gives you, your year group, and how your practice is going, so the app can pick the right questions next time.
- We also keep what you type in your answers. Please do not type your address, phone number, school or other private details.
- We never show you adverts and we never sell anything about you.
- If you are worried about anything, tell your grown-up. They can delete your profile, or ask us to delete everything we keep about you.
- If you are unhappy about how we use information about you, tell your grown-up. They can email us and we will look into it.
Who we are
KS2 Mastery is made by EUGNEL LTD. We are the controller of the personal data described here.
See our Company information page.
We are registered with the Information Commission (ICO), registration number ZC277339.
Privacy questions and requests: hello@eugnel.com.
Who uses KS2 Mastery
KS2 Mastery helps children in Key Stage 2 (about 7 to 11 years old) practise spelling, grammar, punctuation and reading. Only adults create accounts. An adult adds one or more learner profiles and lets the child practise under that account. Children do not sign in with their own account.
Anyone can try the demo without signing in. The demo creates a temporary account with no email address, called 'Demo Visitor', and a sample learner. It stops working after 24 hours and is then deleted by our routine clean-up.
What we keep, why, and for how long
We collect only what KS2 Mastery needs to work and to stay secure. The table lists each kind of data.
| What | Why | Lawful basis | How long |
|---|---|---|---|
| Adult account: email address and display name | To create your account, let you sign in and contact you about it | Contract (providing the service you asked for) | Until the account is deleted |
| Password (stored only as a salted hash; we never keep the password itself) | To check your password when you sign in with email | Contract | Until the account is deleted or you stop using email sign-in |
| Sign-in provider and your user ID with Google, Facebook, X or Apple, and the email address the provider shares (X shares none) | To let you sign in with that provider. We do not keep your profile picture or the provider's access tokens | Contract | Until the account is deleted |
| Learner profile: the name or nickname you enter, year group, avatar colour, practice goal and daily minutes | To show the right learner and set practice to the right level | Contract with the adult who holds the account | Until you remove the learner or the account is deleted (see the note below the table about staff records) |
| Practice and progress: answers the child gives (including typed sentences and Writing Try paragraphs), scores, which questions are secure, rewards and in-app creatures | To run practice, choose the next questions, show progress to the adult and keep rewards | Contract with the adult who holds the account | Progress is kept until you reset it, remove the learner or the account is deleted. Finished practice sessions are removed after 30 days, the recent-activity feed after 7 days, and the event history is cut to about the latest 200 events per learner. Quality-check snapshots of spelling progress that staff take are not removed with the learner; we delete them when you ask or when we delete the account |
| Sign-in sessions | To keep you signed in | Legitimate interests (security and running the service) | 30 days, or until you sign out; demo sessions 24 hours |
| Security records: a scrambled (hashed) form of the email address or network address used, request counts, and records of recent changes | To stop password guessing and abuse, and to make sure a change is not applied twice | Legitimate interests (security) | Request counts and most change records 24 hours; records of refused administrator access 14 days; records of administrator actions 365 days |
| Error reports: the type of error, the first line of its message, where in the code it happened, the page, your browser type and, if you are signed in, your account ID | To find and fix faults | Legitimate interests (keeping the service working) | Each error summary is kept while we need it to track that fault; we keep only the latest 20 occurrences of each error |
| Support records: notes we write when you contact us or when we look into a problem with an account | To help you and keep a record of what we did | Legitimate interests (supporting users) | While the account exists; they are not removed automatically when you remove a learner, and we delete them when you ask or when we delete the account |
Our clean-up runs once a day and works in batches, so data can stay a short time after the periods above.
Removing a learner deletes their profile and practice data, unless another adult account is also linked to that learner. A few staff records that mention a learner (quality-check snapshots of spelling progress and support records) are not removed automatically; we delete them when you ask us or when we delete the account.
We do not collect a child's date of birth, school, photo, location or contact details. Please do not type personal details into answers or learner names; a nickname is fine.
Children's data
- There is no advertising, and we do not sell or share personal data for marketing.
- We use a learner's answers only to run their practice: to choose the next questions, track what is secure and show progress to the adult. We do not use them to build marketing profiles or make decisions with legal or similarly significant effects.
- Learner data is visible only to the adults linked to that learner and to authorised EUGNEL staff who run and support the service.
- Location, camera and microphone are switched off for the site.
- We have written KS2 Mastery with the ICO's Age Appropriate Design Code (the Children's code) in mind. Tell us at hello@eugnel.com if you think we have fallen short.
Services we use
These companies process data for us or when you choose to use them:
- Cloudflare: hosts the site and runs our servers, database, file storage, error logs and, when switched on, a check that you are not a robot at sign-in (which sees your network address). Cloudflare runs a worldwide network.
- Google Fonts: supplies the site's fonts. Your browser connects to Google, which receives your network address. No account or learner data is sent.
- OpenAI and Google (Gemini): turn spelling words and example sentences into spoken audio. They receive only that text, never names, answers or account details.
- Google, Meta (Facebook), X and Apple: only if you choose to sign in with them. They confirm who you are under their own privacy policies.
Some of these companies process data outside the UK, mainly in the United States. Where they do, the transfer is protected by safeguards that UK law recognises, such as the UK Extension to the EU-US Data Privacy Framework or the ICO's International Data Transfer Agreement or Addendum, as each company sets out in its own terms.
We do not sell personal data.
Your rights and choices
You can ask for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, object to our use of it, or ask for it in a format you can take elsewhere. A child can make these requests too, or an adult can make them on the child's behalf.
- In the app you can edit or remove a learner, reset a learner's progress and export the copy of a learner's data held in your browser. For a full copy of everything we hold, email us.
- To delete your whole account, or for any other request, email hello@eugnel.com from the email address on the account (or tell us which sign-in you use). We reply within one month.
Complaints
You have the right to make a complaint to us first (the controller) under section 164A of the Data Protection Act 2018. Email hello@eugnel.com. We will acknowledge your complaint within 30 days of receiving it, take appropriate steps to respond without undue delay (including looking into it and telling you about progress), and tell you the outcome.
You also have the right to make a complaint to the Information Commission (ICO) under section 165 of the Data Protection Act 2018. You can do that at ico.org.uk.
Changes to this notice
We post any change here with a new effective date. If a change matters to how we use your data, we tell you in the app before it takes effect.
Contact
Help with KS2 Mastery: ks2mastery@eugnel.uk. Privacy questions and requests: hello@eugnel.com. EUGNEL LTD. See our Company information page.