AskThena
Try free

Privacy policy

How Grepus Limited collects, uses and protects personal data about your family, and the rights you have over it.

Thena, a marble statue of a young Athena

Introduction

  1. This Privacy Policy explains how Grepus Limited (“we”, “us” or “our”) collects, uses, discloses and protects personal data in connection with Thena (the “Service”). It applies to the parent or guardian who holds a Family Account (“you”) and to each Child added to that account. Capitalised terms that are not defined here have the meanings given to them in our Terms of Service.
  2. We are a company incorporated in England and Wales under company number 17428640, whose registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We determine the purposes and means of processing personal data in connection with the Service, and are therefore its controller for the purposes of the UK General Data Protection Regulation (the “UK GDPR”) and the Data Protection Act 2018.
  3. Any question or request concerning this Privacy Policy or your personal data should be sent to [email protected].

Summary

  1. This summary is provided for convenience. The remainder of this Privacy Policy sets out the full position.
    1. We collect only the personal data that teaching requires. For a Child, this is their first name and the month and year of their birth, and never the day.
    2. An adult creates every account, and may view, amend or delete all personal data relating to their Children.
    3. We do not display advertising, sell personal data, use tracking cookies or send notifications to Children.
    4. Lesson content is disclosed to the providers of Thena’s teaching and voice, solely so that she can teach.

Personal data we collect

  1. Data about you. We collect:
    1. your name, email address and country of residence;
    2. your password, which is stored only in hashed form so that nobody can read it, or the public key of any passkey you register; and
    3. details of your Plan, any Exam Prep and Top-ups, and their payments. Payment details are collected by Onelink, a service of Stripe, which sells them to you as our reseller (Terms of Service, clause 6.5), and we never receive your full card number.
  2. Data about each Child. We collect:
    1. the Child’s first name, and the month and year of their birth;
    2. the Child’s school year, and their level in each subject;
    3. the content of each Lesson, including what Thena said and drew and every answer the Child gave, whether typed, tapped or spoken;
    4. the test for which the Child is preparing, with any area, school and test date you give us, and the questions, answers and scores of each practice paper the Child sits; and
    5. Thena’s observations about how the Child learns, the stars and badges the Child has earned, and any safety alerts.
  3. Technical data. When the Service is used, we collect your IP address and browser details, which we keep with your login record in order to keep your account secure. We also use a small number of strictly necessary cookies, which are described in section 11.
  4. Location. When you visit our website, we use your IP address to determine the country from which you are visiting, so that the website shows the school years, teaching methods and prices that apply in that country. We obtain the country from our network provider or from our geolocation provider (section 6). We keep only the country, in your session, for the duration of your visit, together with a record linking a keyed hash of your IP address to that country, which we delete after 24 hours. We do not determine your location more precisely than the country.

Voice input

  1. The Service’s Talk button relies on the speech recognition built into your web browser. Some browsers, including Google Chrome and Microsoft Edge, send the audio to Google or Microsoft respectively to convert it into text, under their own privacy terms. We receive only the resulting text, and we never record or retain the audio.
  2. Children may instead answer by typing or tapping, in which case no audio leaves the device.

Purposes and lawful bases

  1. The UK GDPR requires us to have a lawful basis for each purpose for which we use personal data. Those purposes, and the lawful basis on which we rely for each, are as follows:
    Teaching your Children and administering your Family Account
    Performance of our contract with you (Article 6(1)(b) UK GDPR).
    Reviewing every Lesson message, and notifying you where a Child may need help
    Our legitimate interest in keeping Children safe (Article 6(1)(f) UK GDPR). Where an alert involves special category data, we rely on the substantial public interest condition for safeguarding children and individuals at risk (Article 9(2)(g) UK GDPR and paragraph 18 of Schedule 1 to the Data Protection Act 2018).
    Sending you emails about your Family Account and Plan
    Performance of our contract with you (Article 6(1)(b) UK GDPR).
    Diagnosing faults and improving Thena’s teaching
    Our legitimate interest in providing better and safer Lessons (Article 6(1)(f) UK GDPR). For example, before a change to Thena’s teaching is released, we may test it against messages from past Lessons. Those messages are seen only by our personnel and the service providers listed in section 6.
    Showing you the version of our website for your country
    Our legitimate interest in showing you the prices and teaching that apply to you (Article 6(1)(f) UK GDPR).
    Keeping the Service secure and preventing misuse
    Our legitimate interest in operating a safe and secure service (Article 6(1)(f) UK GDPR).
    Keeping payment records
    Compliance with a legal obligation to which we are subject (Article 6(1)(c) UK GDPR).
  2. We do not use personal data for advertising, we do not sell it, and we do not build profiles of Children for marketing purposes.

Disclosure of personal data

  1. We disclose personal data only to the service providers that help us operate the Service, each of which is bound by a written contract permitting it to use that data solely to perform services for us:
    Anthropic (Claude)
    Generates Thena’s Lessons and reviews Lesson messages for safety. It receives the messages in a Lesson, the Child’s first name, the Child’s age in months and Thena’s notes about the Child. It never receives the Child’s date of birth.
    ElevenLabs
    Provides Thena’s voice. It receives the words Thena speaks, which may include a Child’s first name.
    Our geolocation provider
    Determines the country from which you are visiting our website. It receives your IP address and nothing else.
    Our hosting and email providers
    Host our servers and database, and send our emails.
  2. Onelink, a service of Stripe, sells Plans, Exam Prep and Top-ups to you as our reseller and merchant of record (Terms of Service, clause 6.5). It collects your payment details and processes them as a separate controller under its own privacy policy, and we share with it what it needs to sell and manage your purchase, such as your email address.
  3. Photographs shown in Lessons are obtained from Wikipedia through our own servers. Your Child’s device does not contact any other party to obtain them, and no information about your Child is sent with the request.
  4. We may also disclose personal data where we are required to do so by law, or where disclosure is necessary to protect a Child from serious harm.
  5. If Grepus Limited is sold to, or merges with, another organisation, personal data may be transferred to that organisation, which will be bound by this Privacy Policy. We will notify you before any such transfer takes place.

International transfers

  1. Anthropic and ElevenLabs process personal data in the United States. Where personal data is transferred outside the United Kingdom, it is protected either by the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), where the recipient is certified under it, or by the International Data Transfer Agreement or International Data Transfer Addendum approved under UK data protection law.

Retention

  1. We keep your Children’s Lessons, practice papers, notes and badges for as long as your Family Account remains open, so that you can review them and Thena can build on them.
  2. When you remove a Child from your Family Account, we delete all personal data relating to that Child immediately.
  3. When you close your Family Account, we delete it, together with all personal data relating to your Children.
  4. Backup copies are kept for a limited period so that the Service can be restored if necessary, and are then overwritten.
  5. Payment records are kept for six years, as UK tax law requires.

Children’s privacy

  1. An adult creates every Family Account and adds each Child. Children cannot register for the Service, and nothing a Child does in the Service makes their personal data public.
  2. Children cannot send messages to other people, and nobody else can see them.
  3. The Service contains no advertising and nothing to buy within a Lesson, and uses no streaks, leaderboards or notifications designed to draw Children back.
  4. We have designed the Service having regard to the Information Commissioner’s Age Appropriate Design Code (the “Children’s Code”). Our safety page explains how.
  5. Families in the United States. Under the Children’s Online Privacy Protection Act (“COPPA”), a parent must consent before a child under 13 uses the Service. A parent creates the Family Account and adds each Child, so no Child begins using the Service without that consent. A parent may at any time review their Child’s personal information in the grown-ups area of the Service, have it deleted, or direct us to stop collecting it, by removing the Child or by contacting us at [email protected].

Your rights

  1. Subject to certain conditions and exemptions, UK data protection law gives you the right to:
    1. obtain a copy of the personal data we hold;
    2. have inaccurate personal data corrected;
    3. have personal data erased;
    4. restrict our use of personal data, or object to it; and
    5. receive personal data in a structured, commonly used and machine-readable format, and have it sent to another organisation.
  2. You can exercise many of these rights yourself in the grown-ups area of the Service, where you can read every Lesson, change a Child’s details or remove a Child. Any other request should be sent to [email protected]. We will respond within one month of receiving it, which may be extended by up to two further months where a request is complex or one of several, in which case we will tell you.
  3. If you are unhappy with how we have handled your personal data, please contact us first. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.
  4. Residents of some US states have similar rights to know about, correct and delete their personal information. Wherever you live, you may contact us and we will help.

Cookies

  1. We use only cookies that are strictly necessary for the Service to work, which do not require consent under the Privacy and Electronic Communications (EC Directive) Regulations 2003. For that reason, we do not display a cookie banner. We do not use analytics, advertising or tracking cookies.
  2. The cookies we use are:
    thena-session
    Keeps you logged in while you use the Service, and remembers which country’s version of our website to show you during a visit.
    remember_web
    Keeps you logged in between visits, if you tick “Remember me”.
    XSRF-TOKEN
    Stops other websites from submitting forms on your behalf.
    appearance and sidebar_state
    Remember whether you chose light or dark mode, and whether the grown-ups area’s menu is open.

Changes to this Privacy Policy

  1. We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email before it takes effect. The date at the top of this page shows when it was last revised.
  2. Our Terms of Service govern all other aspects of your use of the Service.
Grepus LimitedRegistered in England and Wales, company number 17428640
71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
[email protected]