Privacy Policy

StarLiz Academy operates learning platforms for families and schools. Draft for legal review — not formal legal advice.

StarLiz Academy is the trading name used for this service.

Legal entity, company registration and registered office details must be configured and published before paid subscriptions open.

Contact for privacy queries: [email protected].

Preferred data-governance position pending solicitor and DPO review.

When a school provides StarLiz, the school or academy trust will normally be the data controller for pupil, timetable, attendance and school-directed learning records, and StarLiz will process that information on the school's documented instructions.

When a parent buys Short Learning directly from StarLiz, StarLiz is normally the data controller for the subscription, booking and learning-service information needed to provide that service.

StarLiz may also act as an independent controller for limited purposes such as account security, legal compliance, fraud prevention, safeguarding incidents and operating its direct consumer services.

Roles are determined by processing purpose. Full mapping is in the Data Protection Policy.

Account and profile data; child learning data including Day School and Short Learning activity; support and safeguarding records where raised; technical logs; payment and subscription metadata via payment providers (we do not store full card numbers on StarLiz servers).

To provide Day School and Short Learning services; personalise AI tutoring and report progress to authorised parents and school staff; operate subscriptions and booking access; keep children safer online; meet legal obligations; and defend against misuse.

We do not sell children's personal data.

Identifiable school pupil data is not used for StarLiz independent product development unless the school contract expressly permits it and the role, lawful basis and transparency requirements are met. Irreversibly anonymised analytics may be used for service improvement.

Parents should only create child profiles for children they are authorised to manage.

Schools may access school-scoped learner data for enrolled students according to their role.

We share data with processors such as hosting, email, AI and payment providers under contracts. Suppliers are labelled according to the real contract role, not automatically as processors.

UK GDPR rights may include access, rectification, erasure, restriction, objection and complaint to the ICO, subject to exemptions.

For school-controlled Day School records, StarLiz logs the request, verifies enough information to route safely, promptly refers it to the school, and assists the school under the data-processing agreement. StarLiz does not independently decide the school's response unless legally required.

For StarLiz-controlled Short Learning and subscription data, StarLiz handles the request directly.

Mixed requests are split internally; we explain which organisation is handling each part.

Contact [email protected]. Safeguarding retention or legal holds may limit erasure in some cases.

See the Data Retention Policy, Cookie Policy and AI Use and Transparency Policy.