Privacy Policy
Last updated: September 2026
This explains what we collect, why we are allowed to, who else touches it, how long we keep it and what you can do about any of it. It is written to be read rather than to be defensible, and where something is a judgement call we have said so.
Who is responsible for your data
Teach me AI is the data controller for the information described here. You can reach us about anything on this page at hello@teachmeai.co.uk.
We are not required to appoint a Data Protection Officer, because we do not carry out large-scale monitoring or process special category data. The address above reaches the person who is accountable for it.
What we collect, why, and what allows us to
Under UK GDPR every use of your data needs a lawful basis. Here is each one we rely on, and what it covers.
| What | Why | Lawful basis |
|---|---|---|
| Your name and email address | To create your account, sign you in, and send you things about it | Performance of a contract |
| Your placement answers, the AI tools you tell us you use, quiz attempts and progress | To build your learning path, mark your work and issue certificates | Performance of a contract |
| Notes, and practice you write in the Lab | To store them for you, and to generate written feedback on Pro | Performance of a contract |
| Membership and payment status | To give you access to what you have paid for | Performance of a contract; legal obligation for tax records |
| Product usage events (that a lesson was completed, for example) | To see which parts of Teach me AI work and which do not | Legitimate interests — improving the service. These records hold identifiers and outcomes, never anything you have written. |
| The weekly briefing and reminder emails | To tell you what changed and nudge you back to your path | Legitimate interests, with a one-click unsubscribe in every message and a permanent off switch in your account |
| Change-alert sign-ups (no account needed) | To email you when a fact you follow about an AI tool changes | Consent — confirmed by clicking a link, withdrawable from any email |
We do not sell your data, we do not share it for advertising, and we do not use anything you write to train AI models.
Who else processes it
These are the services Teach me AI runs on. Each processes data under its own terms.
- Vercel — hosting. Handles every request you make to the site.
- Neon — the database, hosted in the EU, where everything described above is stored.
- Stripe — payments. Stripe takes your card details directly; we never see or store them. We hold only your plan and its status.
- Resend — email delivery.
- Anthropic — AI in two places. When you submit practice in the Lab (a Pro feature), the text you wrote is sent to Anthropic’s API to generate feedback on it. When you ask a question in Ask, your question is sent to Anthropic’s API, with passages from this site, to write the answer. Nothing else about you is sent with it. Anthropic does not train models on data submitted through their API. If you would rather no text of yours left Teach me AI, don’t use either; everything else works without them.
- Google — site analytics, and only if you agreed to it. It is off until you do, and it is configured so that nothing it collects is used for advertising or personalisation. See the cookies section below.
- Your phone or browser’s push service (Apple, Google, Mozilla or Microsoft, depending on your device) — only if you turn on app notifications. It carries each notification to your device, encrypted so the push service can’t read it. We store the device’s push address and keys, which browser it is, and when we last sent to it. Turning notifications off, signing out on that device, or deleting your account removes them; a device we haven’t reached in six months is removed automatically.
If you use the contact form
We receive your name, email address, the topic you pick and your message, as an email to our own inbox, and we send you a short receipt. We use them only to reply to you. Nothing is added to a mailing list, and the emails are deleted once the conversation’s done, or after two years at the latest.
Where your data goes
Our database is in the EU. Some of the providers above are based in the United States or process data there, so some transfers leave the UK. Those are covered by the UK International Data Transfer Addendum or equivalent safeguards in each provider’s terms — the mechanism UK law provides for exactly this.
How long we keep it
Your learning record — progress, certificates and assessments — is kept while your account exists, because it is the thing you signed up for. Deleting your account removes it. Other data expires on a schedule, which a job runs nightly:
| What | Kept for | Why that long |
|---|---|---|
| App notification devices nobody has reached in six months | 180 days | A device that hasn't taken a notification in six months has almost always been replaced, reset or had the app removed. The push service stops telling us after a while, so the row would otherwise sit there indefinitely. |
| Lesson-update notices | 180 days | They drive the app's "What's changed" list and its notifications. Six months covers anyone catching up after a long break; older than that, the changelog is the record. |
| Used and expired password reset tokens | 7 days | They are valid for one hour and single-use, so a week is already generous. Keeping them longer serves nothing and leaves a table of rows tying addresses to account activity. |
| Product analytics events | 1.1 year | They exist to show funnel and retention trends, which needs a year plus room to compare against the same month last year. Beyond that they are a personal-data liability holding no answer anyone is asking. |
| Lab submissions and the coach's feedback | 24 hours | Free-text work a member wrote in the Lab, plus a model's response to it — the most sensitive thing stored here. The Lab promises that prompts are deleted after 24 hours: long enough to read the feedback back and copy anything worth keeping, and no longer. |
| Contact form messages | 1 year | A message holds a name, an address and whatever the person wrote. A year covers a follow-up to an earlier conversation; after that the exchange lives in the mailbox it was answered from, and the copy here is only a liability. |
| Superseded quiz attempts | 2 years | Only attempts superseded by a later one on the same quiz. The most recent attempt is what proves a lesson was completed and is never removed by age, so a certificate earned in 2026 still has its evidence in 2031. |
| Unsubscribed change-alert addresses | 180 days | An address that unsubscribed is kept briefly as a suppression record, so a re-import cannot start mailing it again, then removed. Keeping it forever would mean holding an email address for someone who explicitly asked not to be contacted. |
| Never-confirmed change-alert sign-ups | 30 days | Double opt-in means an address that was never confirmed has no consent behind it. After a month the confirmation is not coming, and an unconfirmed address is one nobody agreed to give us. |
One exception we cannot shorten: after you delete your account, Stripe keeps transaction records, and UK tax law requires financial records to be held for six years. That is a legal obligation, and it is one of the limited grounds on which data survives an erasure request.
Your rights, and how to use them now
You do not have to ask us for any of these, and you do not have to wait. From your account you can:
- Get a copy of everything we hold (Articles 15 and 20) — a JSON file of your answers, notes, submissions, progress and activity, downloadable immediately.
- Correct it (Article 16) — change your name or email address yourself.
- Delete it (Article 17) — removes your account and everything attached, cancels any membership, and happens straight away rather than within thirty days.
- Object to marketing email (Article 21) — one click in any email we send, no sign-in needed.
For restriction of processing (Article 18), or anything the buttons do not cover, email hello@teachmeai.co.uk and we will respond within one month, which is the deadline the law sets.
Automated decisions
The placement check scores your answers automatically and uses the result to order your learning path. It decides what we suggest you study first — nothing more. It has no legal or similarly significant effect on you, you can retake it whenever you like, and you can ignore the path entirely and study in any order you want.
Cookies
One cookie is strictly necessary: tmai_session, which keeps you signed in. It is set because you asked for a service that needs it, so it does not require your permission. Your light or dark theme choice and your answer to the question below are stored in your own browser and never sent to us.
Beyond that we use Google Analytics to see which parts of Teach me AI people actually use — which lessons get finished, where people stop, what the search and Ask get asked for. It sets cookies, which is why you were asked, and it is switched off until you say yes. Until then it receives a count of the page with no identifier attached to it, and if you say no it stays off. Declining changes nothing about how the site works for you, and you can change your mind by clearing this site’s data in your browser, which brings the question back.
There is still no advertising, no cross-site tracking and nothing sold or shared with anyone for their own purposes. Google is a processor here and is instructed not to use what it sees for advertising: advertising signals, personalisation and ad storage are all disabled at the tag.
Security
Passwords are hashed with bcrypt and never stored or recoverable in plain text. Everything travels over HTTPS. Sign-in attempts are rate-limited against brute force, and resetting your password signs out every device. Administrative access to Teach me AI is limited to account-level information — plan, progress counts, activity dates — and deliberately cannot reach the answers, notes or practice work of any individual member.
If something goes wrong
If a breach happens that is likely to put your rights at risk, we will tell the UK regulator (the Information Commission, formerly the Information Commissioner’s Office) within 72 hours and tell you without undue delay.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commission (formerly the ICO) at any time, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes
If we change how we use your data in a way that affects you, we will say so here and email you before it takes effect rather than quietly updating the date at the top.
