Privacy policy
Privacy policy
Who we are
Online Ready is a product built by Abity. If you have any questions about this policy or your data, email us.
What we collect, and why
From students
- Name — so a certificate can be issued in their name.
- Quiz answers and scores — to confirm they've completed each module.
- Written reflections — stored encrypted, using a key made from the student's own PIN, so they can continue on another device. We cannot read them without that PIN, and the student's teacher can read them from their dashboard.
- A hashed PIN — never the PIN itself. Every student sets a 4-digit PIN so their progress is protected.
From teachers and schools
- Name, email, school name — provided when requesting seats.
- Finance contact email — used only to send an invoice.
Legal basis
We process student data on the basis of the school's own legitimate educational and safeguarding interest in delivering online safety education, acting as a data processor on the school's behalf. We process teacher and finance contact details to perform the contract of supplying the course.
Children's data
This product is used directly by children. We collect the minimum needed to run the course and issue a certificate, reflections are encrypted client-side by default, and nothing is used for advertising or profiling.
How long we keep data
Student data (name, progress, quiz scores, encrypted reflections and certificate) is kept until 31 August following the school's purchase. It is then automatically and permanently deleted on 1 September, for every school.
Teacher and school contact details stay for as long as the school's licence is active, and are removed if the licence is not renewed. Paid order and invoice records are archived for statutory accounting purposes and then removed from our live database. We also keep a minimal certificate verification record (certificate ID, month issued and school name, with no student name) so a certificate can still be confirmed as genuine later. Our GDPR page has the full retention table.
Who else sees it
Data is hosted with Supabase (database) and processed for email delivery via a transactional email provider. We don't sell or share data with advertisers. Our Data Protection Impact Assessment lists every processor and links to their data processing agreements.
Your rights
Schools, as the data controller for student data, can ask us to provide, correct, or delete a student's data at any time by emailing us.
Cookies
See our separate cookie policy.
Changes to this policy
We'll update the date at the top of this page whenever this policy changes.