Privacy Policy

1. Overview

Powerhouse is an exam-preparation platform. To do its job it needs to know which exam you're studying for, which questions you've practiced, and how you did. This policy explains everything we collect, why we collect it, and the controls you have over your data.

We are the controller of your personal data. Throughout this policy "we", "us" and "Powerhouse" refer to the Powerhouse team operating from Hong Kong. See section 16 for our contact details.

If you're looking for the rules of using the Service itself, our Terms of Service document is the companion to this policy.

2. What we collect

We keep this list as short as we can. Today, that means:

• Account details: your email, role (student, teacher, parent), display name, country and the exam(s) / subjects you're studying.
• Learning activity: which questions you've attempted, your answers, the score we gave each one, time spent and which topics you flagged.
• Pulse chats: messages you send to the Pulse AI tutor and its replies, tied to the question they belong to.
• Classroom data: classes you create or join, assignments, posted messages and submissions.
• Parent linking: 8-character friend codes used to link a student and a parent account, plus the resulting parent-child relationship.
• Device & usage: browser and OS, approximate location derived from IP (country / region only), page views and clicks needed to debug bugs and improve the product.
• Support messages: anything you email us or submit through the contact form.

We do not collect: payment cards (we're free today), browsing history outside Powerhouse, your contacts, photos, or microphone/camera data.

3. How we use your data

We use the data above only to:

• Run the Service (showing you the right questions, marking your answers, tracking your progress).
• Personalise the experience (recommending topics to revise, showing you streak and XP totals).
• Power Pulse, the AI tutor, so it can give hints scoped to the question you're on.
• Let teachers see classroom-level results and let linked parents see their child's activity (subject to section 11).
• Keep the Service secure: detect abuse, prevent fraud, debug crashes.
• Compute anonymous, aggregated statistics to improve the product (e.g. average accuracy on a topic across all students).
• Send essential service emails (password reset, account changes). We don't send marketing emails today.

We do not sell your personal data. We do not use your data to train third-party AI models without your explicit consent.

4. Legal basis (UK & EU users)

Under the UK GDPR and EU GDPR we rely on the following legal bases:

• Contract: to provide the Service you've signed up for (account creation, scoring your answers, hosting classroom content).
• Legitimate interests: to keep the Service secure, prevent abuse, improve the product through aggregated analytics, and respond to your support requests. You can object to processing on this basis (section 9).
• Consent: for any optional processing where consent is required, including parental consent for students under 13. You can withdraw consent at any time.
• Legal obligation: where we're required to retain or disclose data by law (e.g. valid court order).

5. Data and the Pulse AI tutor

Pulse is the syllabus-bound AI tutor available on every practice question. When you chat with Pulse:

• Your message and the question text are sent to a third-party large language model provider (currently Google Gemini, with OpenAI as a fallback when Gemini is unavailable in your region).
• We save your Pulse conversation history against your account so it survives reloads. Only you can see your Pulse chats; teachers and parents cannot, even when linked.
• The LLM provider processes the message under their own terms of service; we do not allow them to train on our students' messages.
• We log call metadata (timestamp, provider, latency, character counts, cost estimate) for rate-limiting and operations. This log does not contain your message contents.

You can clear a Pulse conversation at any time using the trash icon in the panel header. Deleting your account wipes your Pulse history within the 30-day grace period described in section 8.

6. Third-party processors

We use carefully chosen subprocessors to run the Service. As of the last-updated date these are:

• Supabase, primary database, authentication and file storage.
• Google (Gemini API), primary LLM for Pulse.
• OpenAI, fallback LLM for Pulse where Gemini is geo-restricted.
• Vercel, frontend hosting and edge delivery.
• Cloudflare, DNS, CDN and DDoS protection.
• Sentry, crash reporting (if enabled in your account).

We require each subprocessor to apply appropriate technical and organisational measures to protect personal data, and we review their privacy practices before integrating with them.

7. Sharing & disclosure

We share personal data only in these scenarios:

• With subprocessors listed in section 6, strictly to provide the Service.
• With teachers in your classroom: they see your assignment results, scores and class messages. They do not see Pulse chats or direct messages.
• With your linked parent (only after you accept the link): see section 11.
• With law enforcement or other authorities when legally compelled and we've assessed the request to be valid.
• In connection with a corporate transaction (merger, acquisition). If this happens we'll notify you and the new entity will be bound by terms at least as protective as these.

8. How long we keep data

We hold your data for as long as your account is active. When you delete your account we wipe it after a 30-day grace period (the window lets you reverse an accidental deletion).

Specific retention windows:

• Account & profile: account lifetime + 30 days.
• Learning activity (answers, scores): account lifetime + 30 days.
• Pulse chat history: account lifetime + 30 days.
• API usage logs (for billing & rate-limit operations): 90 days, then aggregated.
• Support correspondence: 2 years (we keep it longer if needed for an active dispute).
• Anonymised aggregate statistics: indefinitely (they no longer identify you).

9. Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access a copy of your data.
• Correct inaccurate data.
• Delete your data (subject to retention obligations).
• Restrict or object to processing.
• Portability: download your data in a machine-readable format.
• Withdraw consent at any time for processing based on consent.
• Complain to a supervisory authority (UK ICO, EU DPA, Hong Kong PCPD, etc.).

The fastest way to exercise these is to email privacy@powerhouse.com. We respond within 30 days as required by GDPR.

10. Children under 13

Powerhouse does not knowingly collect personal data from children under 13 without parental consent. If you are under 13, you may use Powerhouse only through a parent or school account that has consented to these terms on your behalf.

Parents can withdraw consent at any time by deleting the linked accounts or emailing us at privacy@powerhouse.com.

If we learn we have collected personal data from a child under 13 without verified parental consent, we delete it promptly.

11. Parent linking

Parent and student accounts become linked only after the student accepts a link request initiated by the parent. Once linked the parent sees:

• Recent activity and assignment results.
• Scores by subject and accuracy trends.
• Upcoming and parent-set tasks.
• Weekly study-time summary.

Parents cannot see:

• Direct messages between the student and teachers or classmates.
• Pulse AI chat history.
• Account credentials or the ability to change account settings.

Either side may remove the link at any time from the Family page. Removing the link severs the connection only; no data is deleted.

12. Cookies & similar technologies

We use a small number of cookies and similar storage:

• Strictly necessary: authentication session, CSRF token, region detection. Cannot be turned off without breaking sign-in.
• Functional: remembers UI preferences (e.g. whether you collapsed the Session Summary card). Stored in your browser's localStorage / sessionStorage.
• Analytics: anonymous, aggregated metrics about how the product is used. Off by default for EU / UK / Hong Kong visitors until you opt in.

We do not use third-party advertising cookies. We do not embed tracking pixels from social platforms.

Change your cookie preferences

13. Security

We take security seriously. Our key measures include:

• TLS in transit for all traffic.
• Encryption at rest for all data hosted by Supabase.
• Row-level security on every database table that contains personal data, so a bug in one query can't leak across users.
• Service-role keys held only on the backend; never exposed to the browser.
• Principle of least privilege for staff access to production systems.
• Regular dependency updates and security review of third-party libraries.

No security measure is perfect. If you discover a vulnerability please disclose it responsibly to security@powerhouse.com.

14. International transfers

Powerhouse operates from Hong Kong and uses subprocessors with infrastructure in the United States, the European Union and the Asia-Pacific region. When personal data leaves your country we rely on the European Commission's Standard Contractual Clauses (SCCs) and equivalent UK / Hong Kong transfer mechanisms to keep it protected.

If you would like a copy of the SCCs that govern a specific transfer, email privacy@powerhouse.com.

15. Changes to this policy

We'll update this policy as our practices evolve. For material changes we give reasonable notice, usually 30 days, via email or an in-app banner. Continuing to use the Service after that date means you accept the updated policy.

The current version is dated at the top of this page. Earlier versions are available on request.

16. Contact

Privacy-specific requests (data access, deletion, portability, parental consent withdrawal, complaints): privacy@powerhouse.com.

Security-disclosures: security@powerhouse.com.

General support and bug reports: support@powerhouse.com.