Privacy Notice for Independent Users

Effective date: 02/06/2025

Fruitful Labs Ltd
Contact: support@fruitify.co.uk

1. Introduction

This privacy notice explains how Fruitful Labs Ltd (“we”, “us”, “our”) processes personal data for individuals who use the Fruitify platform independently (i.e., outside of a school environment).

Independent users – including parents, tutors, individual learners, and other subscribers – act as data controllers under the UK GDPR. This means you decide what data is provided to the platform and how you use it. Fruitful Labs acts as a data processor for the personal data you upload or generate through the platform.

Our platform supports automated marking, personalised feedback, progress tracking, and learning analytics.

2. Our Role

For independent accounts, you are the data controller.
Fruitful Labs acts as your data processor, processing data solely to provide and improve the platform.

3. Data We Process

We process the following types of personal data when you use the platform:

User Account Data

• Full name
  
  

• Email address
  
  

• Password (securely hashed)
  
  

• Login information and authentication details
  
  

• Social login data (Facebook and Google), limited to identity, email, and profile information you permit
  
  

Learning and Platform Data

• Submissions, responses, and written answers (which may contain personal data)
  
  

• Progress tracking, scores, and analytics
  
  

• Feedback and generated content
  
  

• Activity logs related to usage, performance, and platform interactions
  
  

Generated Usage Data (for service improvement)

• Device and technical data
  
  

• Session activity
  
  

• Error logs, performance metrics, and monitoring data
  
  

• Learning patterns and anonymised analytics
  
  

Monitoring, logging, and event data may pass through third-party providers such as Langfuse (EU-hosted).

4. Purpose of Processing

We process your data to:

• Operate the Fruitify platform and deliver core features
  
  

• Provide automated marking, personalised feedback, and analytics
  
  

• Manage your account and subscription
  
  

• Support authentication, including Google and Facebook SSO
  
  

• Debug, monitor, and improve system performance
  
  

• Develop and refine our algorithms
  
  

• Produce anonymised or aggregated data for product improvement, research, and machine-learning model training
  
  

We never use identifiable personal data for external marketing or advertising.

5. Lawful Basis

As the data controller, you determine the lawful basis for the data you provide and use within the platform.

Fruitful Labs processes data under:

• Article 6(1)(b) — performance of a contract (your platform subscription and account)
• Article 6(1)(f) — our legitimate interests in maintaining, improving, and securing the platform
• Article 6(1)(a) — your consent where applicable (e.g., connecting Google or Facebook accounts)

Anonymised data may be processed under legitimate interests for research, improvement, and model training.

6. Data Sharing

We do not share your personal data with third parties except:

• When necessary to operate the platform
  
  

• When required by law
  
  

• When you explicitly authorise integrations (e.g., SSO via Google/Facebook)
  
  

Our subprocessors include:

Hosting & Compute

• Amazon Web Services (UK) — secure hosting
  
  

• Microsoft Azure (UK) — secure hosting
  
  

Monitoring & Logging

• Langfuse (EU) — performance monitoring and logs (may include user content)
  
  

All subprocessors operate under data protection agreements compatible with UK GDPR.

7. Data Storage & Retention

• Identifiable account data is stored in the UK, with logs stored in Germany for monitoring.
  
  

• We retain your personal data for as long as your account is active.
  
  

• If you cancel your subscription, you may delete your account at any time.
  
  

• When an account is deleted, all identifiable user data is permanently erased within 30 days.
  
  

• Anonymised data (e.g., aggregated analytics, model training data) may be retained indefinitely.
  
  

8. Data Security

We implement appropriate technical and organisational measures, including:

• Encryption at rest and in transit
  
  

• Role-based access control
  
  

• Secure server environments
  
  

• Regular security reviews and internal audits
  
  

• Monitoring for misuse or anomalies
  
  

9. Data Subject Rights

As an independent user, you have full control over your data and may exercise all rights under the UK GDPR, including:

• Access
  
  

• Rectification
  
  

• Erasure
  
  

• Restriction
  
  

• Objection
  
  

• Data portability
  
  

You can delete your personal data by:

1. Cancelling your subscription
   
   

2. Deleting your account via the Account page
   
   

3. Contacting us at support@fruitify.co.uk
   
   

We respond to all rights requests within one month.

10. Social Login (Google and Facebook)

You may choose to sign in using:

• Google Sign-In
  
  

• Facebook Login
  
  

If you use SSO, we receive:

• Your name
  
  

• Email address
  
  

• Profile ID
  
  

• (Optional) Profile picture, depending on your permissions
  
  

This data is used solely for authentication and account creation.

We do not post to your social accounts or access any data beyond what you authorise.

11. International Data Transfers

Most data is stored in the UK. Monitoring and log data is stored within the EU (Germany), which is covered by UK adequacy regulations.

We do not transfer data outside the UK/EU without appropriate safeguards, such as Standard Contractual Clauses.

12. Contact Us

For privacy questions, data deletion, or GDPR rights requests, contact:

Fruitful Labs Ltd
Email: support@fruitify.co.uk