Privacy Policy

Last updated: 17 October 2026

The short version

  • We collect what we need to run Root: your email, name, study sessions, and basic usage data.
  • We never see your card details — Stripe handles all payments.
  • Your tutoring conversations, test papers and revision are processed by our AI provider, OpenAI, to generate replies. Anthropic's Claude reads your tutoring chats to work out how to teach you better (and is a backup if OpenAI is unavailable). Neither uses them to train AI models, and neither do we.
  • Everything you talk to inside Root is an AI, not a person, and everything it produces is AI-generated. Nobody at Root reads your messages in real time.
  • Your account and study data is stored in the European Union (Ireland). Some of our providers are in the United States, and we use approved legal safeguards for those transfers.
  • We don't sell your data. Ever.
  • Analytics are cookieless. One optional ad-measurement cookie exists — it's off unless you opt in via the cookie banner, and we never use it for profiling or personalised ads.
  • When you visit, we note how you found Root — for example “Google search” or “ChatGPT” — and if you sign up, we keep it with your account, plus the Root page you arrived on and your country. It is never shared with advertisers, and your browser's Global Privacy Control switch turns it off.
  • You can download or delete everything we hold on you, anytime, from Settings.
  • Root is for users aged 13 and over. If you're under 18, we apply extra privacy protections, and a parent or guardian can manage your data and must consent to a paid plan.
  • Please don't share sensitive personal details (about yourself or others) with the AI — Root doesn't need them.

The full policy below is the legally binding version. If anything below contradicts the summary, the full policy wins.

1. Who we are

This Privacy Policy explains how Root (“Root,” “we,” “us,” or “our”) collects, uses, and protects personal information when you use the website at roottutor.com and the related services (the “Service”).

Root is operated by Root Tutor AI Ltd, a company registered in England and Wales and the data controller for your personal information. For any privacy question, contact us at privacy@roottutor.com.

Root is offered to students worldwide — including the United Kingdom, the European Economic Area, the United States, Hong Kong, Australia, and elsewhere. Because we are a UK company, the UK GDPR applies to everything we do with your information, and we apply its standard of protection to every user, wherever you live. On top of that baseline, we comply with the privacy laws of the place you use Root from — including the EU GDPR (EEA), the Personal Data (Privacy) Ordinance (Hong Kong), the Privacy Act 1988 and Australian Privacy Principles (Australia), and applicable US federal and state privacy laws. Where this Policy mentions “GDPR” without saying which, we mean both the UK and EU versions, and we hold ourselves to whichever rule gives you the stronger protection.

2. What we collect

We collect different kinds of information depending on how you interact with the Service.

2.1 Account information

When you create an account, we collect:

  • Your email address and display name (received from Google when you sign in with Google, or entered directly).
  • Your Google account identifier (a unique ID provided by Google for OAuth sign-in — not your password).
  • A profile photo if your Google account has one. This is optional and only used inside Root.

2.2 Onboarding information

During onboarding you may tell us your year level, the subjects you study, and your goals. This is used to personalise the tutoring experience.

2.3 Usage information

When you use the Service we collect the content you create and the way you interact with Root, including:

  • Study sessions and chat messages exchanged in Tutor.
  • Test papers you generate, your answers, and the feedback Root provides.
  • Revision activity, flashcards, progress data, streaks, topics studied and the time at which you studied them. We use this study activity (which topics, how recently, your accuracy on revision walkthroughs) to schedule personalised study and streak reminder emails.
  • Files or images you upload (for example, a worksheet you have a question about, or notes and past papers you add to a study unit). When you add files to a unit, Root reads them once to build a short topic summary it keeps as study context for that unit.
  • Notes you save in a unit — notes you write yourself, messages or suggestions you save from the tutor, and the short summaries Root generates of a study session or a completed unit.
  • Aggregate usage signals such as feature interactions, button clicks, and time spent on the Service.

2.4 Billing information

Payments are processed by Stripe. We do not see, store, or have access to your full payment card number. We receive a Stripe customer ID, the last four digits and brand of the card, your billing country, your subscription tier, and the status of your subscription (active, past due, cancelled, etc.).

2.5 Technical information

Automatically collected when you use the Service:

  • IP address (used for rate-limiting and anti-abuse).
  • Browser type and version, operating system, device type, and screen size.
  • Referring URL and pages viewed within the Service.
  • Approximate location derived from IP address (country / region only).
  • Cookies and similar technologies (see Section 7).

2.6 How you found Root

To know which places actually bring students to Root, we record how each new account found us. While you browse Root without an account, your browser keeps a small note in its own local storage (not a cookie). It holds only:

  • The website that sent you — the site name only (for example google.com or chatgpt.com), never the full address of the page you were on or what you searched for.
  • The Root page you arrived on (for example a blog post), without anything after the “?” in the link — for your first visit, and for your most recent visit that came from another site. Your account keeps the most recent one, and the first one only if it came from somewhere different.
  • Any campaign tags on the link you followed — only the source, medium and campaign name (for example “tiktok” from our TikTok bio link, or “chatgpt.com”, which ChatGPT adds itself), never a search term — and whether you arrived by clicking one of our ads (the fact only, never the ad network's click ID).
  • The date and time of those visits.

When you create an account, the note is attached to it and deleted from that browser; it is also deleted whenever you sign in there. While you are signed in, nothing new is recorded. We add your country, worked out from your IP address when your account is confirmed; we do not store your city or your IP address for this. If you joined through a friend's referral link, that is recorded separately as part of the referral programme, and we show it as your source. If you start signing up by email but never confirm your address, the note stays with that unconfirmed signup until it is deleted.

From this we give your account a short label such as “Google search” or “ChatGPT”. It is seen only by the Root team, in our private admin dashboard and in an internal “new signup” email (delivered by our email provider, Resend). We never share it with advertisers or ad networks, never sell it, and never use it to decide what you see or pay inside Root. The Root team can see it for each account; otherwise we use it in totals — which sources bring students, and which of those students go on to use Root.

Turning it off. If your browser sends the Global Privacy Control signal, we record nothing about how you found Root — no note, no source, no country for this purpose — and delete any note already stored. (A friend's referral link is still credited, because that is how the referral programme gives your friend their reward.) You can also clear the note by clearing your browser's site data for roottutor.com, or ask us at any time to delete the label from your account (see Section 9). It has no effect on your use of Root.

2.7 What Root learns about how you study

To teach you better over time, Root's AI reads your study sessions after they end and keeps short notes about how you learn. Some notes are things you said or did. Others are Root's own guesses, and a guess can be wrong. For example:

  • How confident you seem with a topic — for example “confident with factorising, unsure about completing the square”.
  • How you feel about your studies — for example “nervous about the chemistry mock on Friday”, “finds essay planning boring” or “got frustrated after two wrong answers”.
  • How you learn best — for example “learns best from a worked example first” or “likes short answers”.
  • Mistakes that keep coming back — for example “forgets to convert km/h to m/s”.
  • Your pace and habits — for example “often says ‘got it’ before trying a question” or “works best in short sessions”.

Root's teaching coach. Each night, after you have stopped studying, a separate AI (Anthropic's Claude) reads that day's tutoring chats for each subject. It writes a short teaching plan for Root: what to check, which ideas are still shaky, and which explanations worked for you. When you get stuck during a session, it can also suggest a better way to explain that point. A note about a mistake is closed once you have shown you can do it. The coach reads only your tutoring chats and its own earlier notes.

Root uses these notes only to choose how to teach you: for example, to slow down when you seem nervous, or to check a topic you seemed unsure about. Root is told not to repeat a guess about your feelings back to you. The notes are not a diagnosis, not a judgement of your character, and not a mental-health assessment. We never share them with your school, never use them for advertising, and never sell them.

If you tell Root about a learning need (for example dyslexia or ADHD) or ongoing worry about exams, Root keeps that note so it can keep adapting how it teaches you, for as long as it is useful or until you ask us to remove it. Other notes are replaced as Root learns more about you. You can ask us for a copy of all your notes, or to delete any of them, at privacy@roottutor.com. All notes are deleted with your account (see Section 8).

3. How we use your information

We use the information we collect to:

  • Operate, maintain, and improve the Service.
  • Generate AI-powered tutoring responses, test papers, and feedback in response to your inputs.
  • Personalise the experience to your year, subjects, and learning history.
  • Process subscriptions, payments, refunds, and invoices through Stripe.
  • Send transactional messages (account confirmations, billing receipts, security alerts, important service notices). You cannot opt out of these while you have an active account.
  • Send study reminder emails based on your learning activity, including weekly streak reminders (when your streak is at risk of resetting) and spaced review reminders (when a topic you learned is due for review). Streak reminders are on by default. Spaced review reminders are off by default: they are sent only for units where you switch spaced review on, and you can switch them off for one unit from its card or from the link in the email. You can turn all study reminders off at any time from Settings → Notifications.
  • Send progress and product emails — a monthly recap of your learning activity, occasional notices about new features, and a re-engagement reminder if you stop using Root for a while. These are on by default and you can turn them off at any time from Settings → Notifications or via the one-click unsubscribe link in each email.
  • Detect, investigate, and prevent abuse, fraud, and security incidents.
  • Enforce our Terms of Service and comply with our legal obligations.
  • Analyse aggregated usage to understand how the Service is performing and to plan improvements.
  • Understand which websites, search engines, AI assistants, campaigns and referrals bring new students to Root (see Section 2.6), so we can put our effort where it helps students find us.

Spaced review reminders are scheduled by an automated system. For each topic in a unit where you switched spaced review on, it keeps a review plan: when you learned the topic, how you did then, the result of each review (from Root’s own marks in the review chat), and the review days you chose. Your other revision sessions in that unit count as extra practice: they feed the estimate below but never move your review days, and a new topic they cover is added to the plan. Topics can also come from your tutor chats in that unit (the topics you worked on and any Root noticed you found tricky). The review days follow established spaced-repetition research (by default 3, 7, 16, 35 and 70 days after you learn a topic; you can switch days off). A review that goes badly is repeated before the plan moves on. The plan also shows an estimate of how much you remember, worked out from these results with a standard forgetting-curve formula. It is an estimate, not a test result. You get at most one reminder per pending review and at most one reminder email per day. The emails are built from templates filled with your first name, the unit name, up to three topic names and the estimate for those topics — we do not generate per-email content with AI.

4. Legal bases for processing

GDPR-type laws require us to have a legal basis for everything we do with your information. We apply these bases to all users, wherever you live — not only where the law strictly requires it:

  • Performance of a contract — to provide the Service you signed up for, including running the AI tutor and processing your subscription.
  • Legitimate interests — to improve the Service, secure the platform, prevent abuse, and understand how people find Root (Section 2.6), where these interests are not overridden by your privacy rights. You can object to any of these at any time.
  • Consent — for optional analytics and any communications that require consent under your local law. You can withdraw consent at any time.
  • Legal obligation — where we must process information to comply with applicable laws (for example, tax or accounting rules).

If you voluntarily include special-category information in your content, we rely on your explicit consent to process it as part of providing the Service (see Section 11).

5. Who we share information with

We do not sell your personal information. We share it only with the service providers listed below, each of which is bound to confidentiality and security obligations and may use your information only to provide services to us.

  • Supabase — hosts our database and stores your account, study sessions, and progress data. Our database is located in the European Union (Ireland, eu-west-1).
  • OpenAI, L.L.C. — provides the AI models used for all tutoring, test papers, marking, and revision. When you send a message or generate a test, the relevant content is sent to OpenAI's API to produce the reply. Per OpenAI's API terms, content submitted through the API is not used to train their models, and we have not opted in to any programme that would change that. OpenAI keeps API inputs and outputs for up to 30 days to monitor for abuse, then deletes them, unless keeping them longer is required by law or is reasonably necessary to protect OpenAI's services or someone from harm. To keep Root fast and affordable we also use OpenAI's prompt caching: the instructions and recent conversation sent with your messages may be kept in OpenAI's cache for at least 30 minutes after they were last used, expiring within 24 hours, so they do not have to be re-processed on every message. Cached content is used only to produce replies faster; it is not shared with other OpenAI customers and is not used for training. OpenAI is based in the United States; see Section 13.
  • Anthropic, PBC — provides the Claude AI models. Root uses them (a) to read your tutoring chats and write teaching notes, as described in Section 2.7, and (b) as a backup if OpenAI is temporarily unavailable. Per Anthropic's commercial API terms, API content is not used to train their models. Anthropic deletes API inputs and outputs within 30 days, unless keeping them longer is needed to enforce its usage policy or is required by law. Anthropic is based in the United States; see Section 13.
  • Stripe, Inc. — processes subscription payments and stores billing details.
  • Vercel, Inc. — hosts the Root web application and processes related logs.
  • Google LLC — provides “Sign in with Google” authentication. Google no longer provides any AI model used by Root; your study content is not sent to Google. If you opt in to our ad-measurement cookie (see Section 7), Google Ads additionally receives limited conversion data (that a signup followed one of our ads) — never your study content, and never for personalised advertising.
  • PostHog, Inc. — provides product analytics so we can understand how the Service is used.
  • Upstash, Inc. — provides rate-limiting infrastructure used to protect the Service from abuse.
  • Resend, Inc. — sends transactional, reminder, and product emails (welcome emails, referral notifications, weekly streak reminders, spaced-repetition study reminders, monthly learning recaps, re-engagement reminders, and occasional product-update announcements) on our behalf. Resend receives your email address, your first name, and the contents of the email we send you. It also delivers our internal “new signup” email to the Root team, which contains your name, email address and how you found Root (Section 2.6).

Other users (Friends). If you choose to connect with friends on Root, the people you add can see your display name and your gamification stats — your XP, level, weekly XP, week streak, and streak freezes. Friends can never see your study sessions, messages, notes, uploads, or test papers. You can remove a friend at any time.

We keep an up-to-date list of our sub-processors and will provide it on request. We may also disclose information when we believe in good faith that it is required by law, court order, or government request; to enforce our Terms of Service; to protect the rights, property, or safety of Root, our users, or the public (including to protect a child from a serious risk of harm); or in connection with a corporate transaction such as a merger, acquisition, or sale of assets (in which case we will ensure the recipient is bound by privacy commitments at least as protective as this Policy).

6. AI processing and training

Root uses a third-party AI API to generate tutoring replies, test questions, marking, and revision feedback: OpenAI's API for all of these features, with Anthropic's Claude API used automatically as a backup if OpenAI is temporarily unavailable. Anthropic's Claude API is also used for Root's teaching coach (Section 2.7). When you send a message or generate a test, the relevant content is transmitted to the applicable provider's API, processed to produce the response, and the response is returned to you and stored in your account.

How long the AI provider keeps what is sent. OpenAI retains API inputs and outputs for up to 30 days for abuse and misuse monitoring and then deletes them, unless keeping them longer is required by law or is reasonably necessary to protect OpenAI's services or any third party from harm. In addition, we have enabled OpenAI's prompt caching: eligible tutoring instructions and recent conversation for a session may be held in OpenAI's cache for at least 30 minutes after they were last used, expiring within 24 hours. This exists to make replies faster and cheaper to produce. The cache is not shared with other OpenAI customers and is not used to train models. Nobody at Root reads it. OpenAI limits access to its stored API data to authorised employees (for support, abuse investigation and legal compliance) and to specialised contractors bound by confidentiality, solely for abuse and misuse review. If you delete your account, anything still in the cache expires on its own within that window, and the 30-day retention above runs its course subject to the same exceptions. We do not use any “zero data retention” arrangement with OpenAI.

We do not use your study sessions, messages, generated tests, or any other personal content to train AI models. Both providers' commercial API terms state that content submitted through the API is not used to train their models. We do not opt in to any data-sharing programs that would change this.

You are always dealing with an AI. The tutor, the revision coach and the test-prep marker are automated systems, not people, and no member of our team reads or answers your messages in real time. Everything Root produces for you — explanations, practice questions, model answers, marking, feedback, and diagrams — is AI-generated content. We tell you this in the product itself, next to the chat box, as well as here and in our Terms of Service. This reflects our obligations as the provider of an AI system under Article 50 of the EU AI Act.

We change AI providers from time to time for quality, cost, or legal reasons. If we do, we will update this Policy and the list in Section 5 before or at the time of the change, and we will tell you in advance if the change is material.

7. Cookies and analytics

We and our service providers use cookies, local storage, and similar technologies to keep you signed in, remember your preferences, secure your session, measure usage, and prevent abuse. You can disable cookies in your browser settings, but parts of the Service may not work without them.

Root uses PostHog for product analytics. PostHog receives anonymised event data about how you use the Service. Our analytics run in “cookieless” mode — they do not store cookies or persistent identifiers on your device. This is part of our high-privacy-by-default approach for younger users. We do not use PostHog to track you across other websites.

Optional ad-measurement cookie (opt-in only). We run ads on Google to let students and parents find Root. To know whether those ads work, we use Google's conversion-measurement tag (Google Ads) — but only if you say yes in the cookie banner. Until you accept, the tag is not loaded and sets nothing on your device. If you accept, it sets a cookie so Google can tell us that a signup followed one of our ads. It is used strictly for counting conversions: we keep ad personalisation, remarketing, and cross-site profiling permanently switched off — for everyone, including consenting users — because our audience includes teens. Analytics remain cookieless regardless of your choice.

“How you found Root” note (local storage, not a cookie). The note described in Section 2.6 sits in your browser's local storage while you browse Root without an account, and is deleted from that browser when an account is created or signed in there. It is never read by any other website and never sent to an advertiser. A browser sending Global Privacy Control never gets one.

If your browser sends the Global Privacy Control (GPC) signal, we treat it as a “no” automatically and won't ask. You can change your choice at any time here:

Withdrawing consent stops the tag from loading on future visits and instructs Google to stop using ad cookies immediately. Google LLC (and Google Ireland Ltd for UK/EEA users) processes this conversion data as described in Google's privacy documentation; transfers to the US are covered by the EU–US / UK Data Privacy Framework and standard contractual clauses.

8. How long we keep your data

We keep your information for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or irreversibly anonymise your personal information within 30 days, except where we must keep certain records to comply with legal, tax, accounting, or anti-fraud obligations (for example, transactional records held by Stripe for tax purposes), or where information has been aggregated in a way that no longer identifies you.

The “how you found Root” record (Section 2.6) is kept with your account. When you delete your account, we keep a short leaving record with no name or email address: an internal account number, the reason you chose and any note you typed when leaving, your plan, your signup date, and the Section 2.6 details. We use it only to understand why students leave and which sources bring students who stay, and we never use it to contact you. Please don't put personal details in the leaving note.

Root's study notes (Section 2.7) are kept while your account is active. Most are replaced as Root learns more about you; a learning need or ongoing worry you told Root about is kept for as long as it is useful, or until you ask us to remove it. We also keep a working record of each of these automatic reviews for up to 30 days, only so we can check the notes are accurate; it is then deleted.

Inactive free-tier accounts may be deleted after a prolonged period of inactivity (we will give notice by email before doing so).

9. Your rights

Depending on where you live, you may have the following rights regarding your personal information:

  • Access — request a copy of the personal information we hold about you.
  • Portability — receive your data in a machine-readable format. You can do this yourself from Settings → Download my data.
  • Correction — correct inaccurate or incomplete information.
  • Deletion — delete your account and the personal information we hold about you. You can do this yourself from Settings → Delete account.
  • Restriction or objection — restrict or object to certain processing.
  • Withdraw consent — where we rely on consent, withdraw it at any time.
  • Complain to us directly. If you think we have handled your information wrongly, you can complain to us about it wherever you live (for UK users this is a legal right under section 164A of the Data Protection Act 2018). Email privacy@roottutor.com with the word “complaint” in the subject line. We will acknowledge it within 30 days and respond without undue delay. You do not have to complain to us before going to a regulator, but we would rather have the chance to put it right.
  • Lodge a complaint with your local data protection authority, at any time.
    • UK: the Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint.
    • EU / EEA: the supervisory authority in the country where you live, where you work, or where the problem happened. The full list is published by the European Data Protection Board at edpb.europa.eu.
    • Hong Kong: the Office of the Privacy Commissioner for Personal Data (PCPD) — pcpd.org.hk.
    • Australia: the Office of the Australian Information Commissioner (OAIC) — oaic.gov.au.
    • California: the California Privacy Protection Agency.

Your right to object, set out separately because the law requires it to be. You can object at any time to us processing your information where we rely on legitimate interests — including profiling based on it. If you object, we will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms. You can also object at any time to your information being used for direct marketing, and if you do, we will stop entirely and immediately. To object, email privacy@roottutor.com.

US state residents (including California): we do not “sell” or “share” personal information as those terms are defined in the CCPA/CPRA, we honour opt-out preference signals such as Global Privacy Control where legally required, and we will never discriminate against you for exercising any privacy right.

To exercise any right that isn't available in-app, email privacy@roottutor.com. We will respond within 30 days. We may need to verify your identity before acting on your request.

10. Children and young people

Root is intended for users aged 13 and over. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, email privacy@roottutor.com and we will delete it.

Because much of our audience is under 18, we design the Service with children in mind and aim to follow the UK Information Commissioner's Age Appropriate Design Code (the “Children's Code”). For users we know or believe to be under 18, this means:

  • privacy-protective settings by default, and collecting only the information we need to provide the Service;
  • we do not use their information for behavioural advertising or to build marketing profiles, and we never sell it;
  • we do not use manipulative or “nudge” techniques designed to push them to share more information, or to spend more money or time, than they freely choose; and
  • we aim to explain our data practices in language a young person can understand (the plain-English summary at the top of this page is part of that).

Parents and guardians. We encourage a parent or guardian to be involved in any under-18's use of Root. A parent or guardian may ask to access, correct, or delete their child's information by emailing privacy@roottutor.com; we may ask for reasonable proof of parental responsibility before acting. If you are between 13 and the age of majority in your country, you may use the free tier on your own, but you must have a parent or guardian's consent to subscribe to a paid plan.

Safety. Root is an educational tool, not a counselling, crisis, or emergency service (see Section 16 of our Terms of Service for sources of help). If we become aware of a serious risk to the safety of a child or any person, we may take appropriate steps, including contacting relevant authorities, to the extent permitted or required by law.

If you're thinking about hurting yourself, please tell a trusted adult now, or call Childline on 0800 1111 (free, any time), the Samaritans on 116 123, or 999 in an emergency. Outside the UK, call your local emergency number. Root doesn't check your chats for signs of this, and it can't help the way a person can (see Section 16 of our Terms of Service).

11. Sensitive (special-category) information

We do not ask you to provide special-category information — such as details about your health, race or ethnicity, religious or philosophical beliefs, sexual orientation, or biometric data — and the Service does not need it. Please do not share such information with the AI tutor, or upload documents containing it (about yourself or anyone else).

If you choose to include special-category information in your messages, notes, or uploads, it will be processed as part of Your Content solely to provide the Service to you. By voluntarily providing it, you give your explicit consent to that processing. You can delete it at any time, and we do not use it for marketing or to make decisions about you.

Some notes in Section 2.7 can be about your health — for example a learning need such as dyslexia or ADHD that you tell Root about. Root keeps these only because you told it, and only to adapt how it teaches you. You can ask us to delete them at any time. Notes about how you feel about your studies (for example, nervous about a test) are not a diagnosis, and Root does not use them to judge your mental health.

12. Automated decisions, marking and personalisation

Root makes decisions about your studying automatically, without a person involved. You should know what they are and how to push back on them.

What is decided automatically

  • Marking. When you answer a practice question or sit a generated test, an AI marks it and writes the feedback.
  • “Mastery” estimates. Root scores how well it thinks you know each topic.
  • What you study next. Your study plan, the order of topics, and when a topic comes back for revision are all chosen automatically.

How those decisions are made, in plain terms

Root uses the answers you have given, which questions you got right and wrong, how recently you studied each topic, the subjects and year level you told us during onboarding, and any materials you uploaded. Marking works by comparing your answer against a mark scheme, or, when there is none, against Root's own view of a strong answer. Mastery goes up when you answer correctly without help and decays over time if you do not revisit a topic. Review timing follows established spaced-repetition intervals, the review days you chose and your own review results, not anything else about you. Root also uses the study notes described in Section 2.7 (for example, how confident you seem with a topic). Those notes are not secret: you can ask us for a copy at any time. Root makes no judgement about your character, background, or potential.

Marks and grades are estimates. When you ask Root to mark your work and there is no official mark scheme, Root gives its own estimate of the mark and, if you ask, the grade. In the tutor chat, every mark or grade Root gives comes with a warning that it is an estimate. Every mark from Root, anywhere in the app, is an estimate. It can be wrong, and your teacher or exam board may mark the same work differently. Do not rely on it to predict your real result.

What it means for you, and what it does not

These outputs shape what Root shows you next. They are estimates and practice, not formal assessment. They are not shared with your school, they do not set or influence your real grades or qualifications, and no institution uses them to decide anything about you.

Your right to challenge any of it. If a mark, a mastery score, or a study plan looks wrong to you, you can tell Root so directly in the chat and ask it to mark again or re-plan, and you can change your plan yourself. You can also ask a human being at Root to look at it, explain it, or overturn it, by emailing privacy@roottutor.com. We will not treat an automated score as final if you dispute it.

13. International transfers

Where your data is stored. Your account, study sessions, messages, uploads and progress data are stored in our Supabase database in the European Union (Ireland). That is the primary home of your data.

Ireland is in the European Economic Area, which the UK recognises as providing adequate protection, so no additional safeguards are needed for your data to sit there.

If you use Root from outside the UK and EEA — for example from the United States, Hong Kong, or Australia — your information is transferred to and stored in the European Union (Ireland) and processed by the providers listed in Section 5, some of which are in the United States. We apply the same contractual and technical protections to every user's data, wherever you live, and we comply with the cross-border transfer rules of your local law (including the Hong Kong PDPO and the Australian Privacy Principles).

Where it is transferred. Some of the providers listed in Section 5 are established in the United States — in particular OpenAI (AI processing), Anthropic (AI processing for the teaching coach, and backup), Stripe (payments), Vercel (hosting and logs), PostHog (analytics), Upstash (rate limiting) and Resend (email). Using Root therefore involves transferring personal data from the UK and the EEA to the United States.

How those transfers are protected. Where we transfer personal data out of the UK or the EEA to a country without an adequacy decision, we rely on a lawful transfer mechanism — the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, supported by the technical and organisational measures described in Section 14 (encryption in transit and at rest, access controls, and minimisation of what is sent). Where a provider is certified under the EU–US Data Privacy Framework and its UK extension, we may rely on that instead. You can ask us which mechanism applies to a particular provider, and request a copy of the relevant safeguards, by emailing privacy@roottutor.com.

We do not transfer your study content to any provider not listed in Section 5.

14. Security

We use industry-standard technical and organisational measures to protect your personal information, including encryption in transit (HTTPS), encryption at rest for our database, access controls, rate limiting, and routine security reviews. No system can be guaranteed 100% secure; if we become aware of a security incident affecting your data, we will notify you and the relevant authority in line with applicable law.

15. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through an in-app notice before the changes take effect. The “Last updated” date at the top of this page tells you when the current version became effective.

16. Contact us

If you have questions about this Policy or how we handle your data, email us at privacy@roottutor.com.

← Back to home