Privacy Notice

Your child’s school is the data controller: it decides what pupil data is collected and why. Bookworm is the data processor: we process that data only on the school’s instructions. Because the school is the controller, requests to see, correct or delete your child’s data are handled through the school in the first instance; we assist the school in responding.

• Identity: your child’s name and the username they log in with.
• Login data: the credentials and identifiers used to sign in.
• Learning data: assignments, submitted work, scores, progress and teacher feedback.
• Messages: messages between you and your child’s teachers.
• Guardian details: your name, email and the link to your child.
• Device data: a push-notification token (if you enable notifications) and technical logs to run and secure the service.

We do not use your child’s data for advertising, and we do not sell it.

To provide the learning platform to your school: managing classes, setting and marking homework, showing progress, and enabling parent–teacher messaging and notifications. The school determines the lawful basis (often a public task, or consent); Bookworm provides tools for the school to record and withdraw parental consent.

Three features use artificial intelligence, and all of them run on Amazon Bedrockin the UK. Rawi, the in-app study helper, answers pupils’ questions about their homework. After an exam, the platform writes a short results report from your child’s answers. Teachers can also ask for a suggested first draft of their feedback on a piece of work or of an end of term report; a teacher always reviews and edits that draftbefore anything is saved or shown to a pupil, and schools can turn this feature off. In every case the AI sees only the work being marked, never your child’s wider record, and Amazon Bedrock does not use this content to train its models. No AI feature makes any decision about your child; grading and pass marks are fixed rules, and feedback remains the teacher’s.

We use a small number of trusted providers under contracts that require them to protect the data: Amazon Web Services (hosting, email, notifications; UK), MongoDB Atlas (database; UK), Clerk (sign-in; US), Expo (push delivery; US), Stripe (billing contacts only; UK/US) and Sentry (error monitoring; US). Where data is handled outside the UK we use an approved transfer safeguard.

Pupil, guardian and staff records are stored in the United Kingdom. We keep your child’s data while they are enrolled and delete it on the school’s instruction when no longer needed, usually within 90 days of the school ending its use of Bookworm, aside from routine encrypted backups.

You have rights to access, correct, delete, restrict or object to the use of your child’s data, and to data portability. As the school is the controller, please raise these with your school, which can action them with our help. You can also complain to the Information Commissioner’s Office (ico.org.uk).

Bookworm is designed with the ICO’s Age Appropriate Design Code in mind: each school’s data is kept separate, we collect only what is needed, and we never use children’s data for advertising or profiling. We protect data with encryption in transit and at rest, strict access controls, monitoring, and a documented breach process.

For questions about how Bookworm handles data, email info@bookworm.app. For anything about your child’s account or your rights, contact your school as the data controller.