⬡ BioCraftEd — Privacy

Privacy Policy

BioCraftEd Lab · educational molecular-biology simulation · Version 0.1 draft

⚠️ DRAFT — pending legal review. This is a defensible plain-English draft prepared by a data-protection/EdTech specialist (not a lawyer). It is not yet legal advice and must be reviewed and finalised by a qualified solicitor before launch. Items marked [REVIEW: …] still need a founder decision or solicitor sign-off — they are shown openly rather than guessed. Effective date: [REVIEW: launch date]. Controller: [REVIEW: registered company name] (UK Ltd, England & Wales).

The short version (for younger readers)

Hi! Here's what BioCraftEd does with your information — in plain words.

🧪 BioCraftEd is a learning game. You design primers, run a pretend qPCR machine, and complete missions. It's a simulation — not a real laboratory.
📧 What we keep about you: your email, the name you choose to show, your progress in the missions, your lab-notebook entries, and your saved runs.
🏫 If your school signed you up: we also keep the code that links you to your school, and a parent or guardian's name and email so your school can ask them for permission. Your school is in charge of your data — we just run the game for them.
🔒 We don't sell your data and we don't track you for ads. There are no advertising or analytics trackers. We keep one small "key" in your browser so you stay logged in — that's it.
🗑️ You can ask us to show you, fix, or delete your information. If your school signed you up, ask your teacher first; otherwise email us (below).
🛟 If something online worries or upsets you, tell a trusted adult or your teacher. See our Safeguarding page.

Grown-up to talk to: [REVIEW: privacy contact name + email].

Full Privacy Policy

1. Who we are

BioCraftEd Lab is operated by [REVIEW: registered company name], a company registered in England & Wales (company no. [REVIEW], registered office [REVIEW]). It is a browser-based educational simulation that teaches molecular biology (qPCR, primer design, a simulated "lab"). We are the data controller (except where your school is — see §2) and are registered with the ICO under [REVIEW: ICO registration number]. Contact: [REVIEW: privacy contact email / postal address].

2. Our role — controller vs processor (read this carefully)

Your rights and who you contact depend on how you use BioCraftEd:

If you are…	Who is the data controller	Our role
An under-18 student who joined via a school code	Your school	We are the school's processor — we process your learning data only on the school's documented instructions.
A newsletter subscriber	BioCraftEd	Controller
An 18+ "enthusiast" self-learner	BioCraftEd	Controller
A teacher (your own account details)	BioCraftEd	Controller
A school contact in our CRM	BioCraftEd	Controller

[REVIEW: This split must match the signed school data-processing agreement. Where BioCraftEd is processor, students/parents should direct rights requests to the school first; confirm wording with counsel.]

3. What personal data we process, and why

Data	Who it's about	Why (purpose)	Lawful basis (UK/EU GDPR)
Email, source form, consent record, unsubscribe token	Newsletter subscribers	Send the newsletter you asked for	Consent (Art. 6(1)(a))
Email, optional display name, role/tier, PBKDF2-hashed password	Account holders	Create and secure your account, log you in	Contract (Art. 6(1)(b)) / legitimate interests for security
School link (join code → school id), guardian name and email	Under-18 students	Connect you to your school's class; give the school a guardian contact for its own consent process	Processed on the school's instruction (school's lawful basis — typically public task or consent); we hold it as processor
18+ self-declaration ("adult_confirmed")	Enthusiast tier	Confirm you are old enough for the self-learner tier (no guardian)	Legitimate interests (age-gating)
Mission progress, assignment submissions, lab-notebook entries, saved runs	Students & learners	Deliver the learning experience; let teachers grade	Contract (self-learners) / school instruction (school pupils)
School contact name, role, email, phone, pipeline notes	School staff (B2B)	Manage school relationships / sales pipeline	Legitimate interests (B2B outreach)

We do not knowingly collect special-category data, and we do not ask for more than the above. [REVIEW: confirm no free-text field — lab notebook, display name, CRM notes — is being used to capture special-category or safeguarding-sensitive data; add input guidance if needed.]

4. Children's data (ICO Children's Code)

BioCraftEd is likely to be accessed by children, so we apply the Children's Code:

Best interests of the child come first in design decisions.
High-privacy by default: no behavioural tracking, no advertising, no profiling, no nudges to weaken privacy, no geolocation.
Data minimisation: we collect only what the table in §3 lists.
Age-appropriate transparency: see the short version above.
Parental involvement via the school: for school pupils, the school holds parental consent and is the controller; we record a guardian contact only.
Minimum age: the self-serve "enthusiast" tier is for ages 18+ (self-declared). Under-18s use BioCraftEd only through a school. [REVIEW: confirm minimum age and whether any non-school under-18 route exists; EU age of digital consent varies 13–16 by member state — see §11.]

5. How we collect data

Directly from you (registration, newsletter form, lab activity) or from your school (when a teacher enrols a class / shares a join code). We do not buy personal data or enrich it from third parties.

6. Who we share data with

Your school (for school pupils — the controller).
Email provider — when transactional or newsletter email is switched on, we send the message content (including your email address) to Resend or an SMTP provider acting as our processor. Until then, email is simulated and nothing leaves the server. [REVIEW: name the chosen provider(s) and their hosting location; see DPA checklist 08.]
No one else. We do not sell data, do not use advertising networks, and do not share with analytics trackers.
We may disclose data if legally required (court order, lawful request) or to protect a child's safety (see Safeguarding statement).

7. Where your data is stored / international transfers

All application data is stored on our self-hosted server behind Caddy/TLS in [REVIEW: hosting location/country]. The only routine transfer off that server is outbound email via Resend/SMTP once enabled. If that provider processes data outside the UK/EEA, we will rely on an appropriate transfer mechanism (UK IDTA / EU SCCs) — [REVIEW: confirm provider region and transfer tool].

8. How long we keep it (retention)

See the full Retention Schedule (in our compliance pack). In summary, we keep data only as long as needed for the purpose, then delete or anonymise it. All periods are [REVIEW] pending confirmation, e.g. inactive self-learner accounts deleted after [REVIEW: e.g. 24 months] of inactivity; school-pupil data deleted/returned per the school's instruction at the end of the engagement.

9. How we protect data

Passwords are hashed with PBKDF2-HMAC-SHA256 (salted, 200,000 iterations) — we never store or see your plaintext password.
All traffic is encrypted in transit (TLS via Caddy).
The application is bound to localhost; only the reverse proxy can reach it.
Admin-only data (Schools CRM, grading) is gated by server-side role checks.
[REVIEW: document at-rest encryption of the JSON store, server access controls, backup security, and breach-detection — see DPIA.]

10. Your rights

You have the right to access, rectify, erase, restrict, object to, and (where applicable) port your personal data, and to withdraw consent at any time (e.g. unsubscribe link in every newsletter). Where BioCraftEd is the controller, contact us at [REVIEW: privacy email]. Where your school is the controller (school pupils), please contact your school first; we will support the school in responding. You can complain to the ICO (ico.org.uk) or your EU supervisory authority.

11. EU users

If you are in the EU, the EU GDPR applies in parallel. The age at which a child can consent to online services themselves ranges from 13 to 16 depending on the member state; below that age a parent/guardian must consent. Because under-18s use BioCraftEd only through a school, the school manages this. [REVIEW: confirm whether BioCraftEd needs an EU representative (Art. 27) — likely only if offering services to EU individuals as a controller; assess once EU schools are onboarded.]

12. Changes & contact

We will post changes here and, for material changes, notify account holders by email. Questions: [REVIEW: privacy contact email + postal address].

Last updated: 2026-06-27 (draft) · Terms · Safeguarding · Cookies · ← Back to BioCraftEd