Privacy notice

Haws AI is run by Morus Williams, a sole trader in Wales, who is the data controller for the personal data described here. Questions, requests and complaints go to morus.llew@icloud.com.

You must be 13 or over to create an account. This is the age at which UK law lets you agree to an online service on your own behalf. If you are under 13, do not create an account; if you already have, email us and we will delete it.

Only what the app needs to work. In full:

• Your account. Email address, the nickname you choose, the avatar emoji you pick, whether you are a student or teacher, your exam board, and whether you have finished setting up.
• How you sign in. Either an email address and password, or a Microsoft account if you use that button. Passwords are handled by Firebase Authentication and are never visible to us.
• Your study material. The subjects and topics you choose, your notes, flashcards and saved resources.
• Class activity. If you join a class, your membership of it, and the quizzes you are set along with your attempts and scores.
• Images you upload. Any picture you add to a question or note.
• Photographs of your work. If you use the scan feature, the photo you take of your written work.
• Answers you write. If you ask for AI feedback, the answer you wrote, so it can be marked.

We do not use advertising trackers, and there is no analytics or profiling of how you move around the app.

Under UK GDPR each use needs a lawful basis. Ours are:

• To perform our contract with you — your account, your notes, your flashcards, your class membership and your marks. Without these there is no service to provide.
• Our legitimate interests — keeping the service secure, preventing abuse of the AI marker, and fixing faults. We limit this to what is necessary and it never involves selling or profiling your data.
• Your consent — for the optional features you choose to use, such as scanning a photograph of your work. You can simply not use them, and you can withdraw consent by deleting what you sent.

We use a small number of established providers. They process data on our instructions and are not permitted to use it for their own purposes.

• Google (Firebase) — authentication, database and file storage. This is where your account and study material live.
• Google (Gemini API) — the AI that marks long answers and reads scanned work. Your answer or photograph is sent to it to be marked. Google states that data sent through the paid Gemini API is not used to train its models.
• Vercel — hosts the site and the server code that talks to the AI.
• Resend — sends the sign-in and verification emails.

Some of these providers operate outside the UK. Where data is transferred abroad it is protected by the safeguards UK law requires, such as the UK addendum to the standard contractual clauses.

We do not sell your data, and we do not share it with anyone else except where the law requires it.

If you join a class, the teacher who runs it can see your name and your attempts at the quizzes they set — that is the point of a class. They cannot see your private notes, your flashcards, or anything else in your own workspace.

Your account and study material are kept for as long as your account exists. Delete your account and we remove them.

Photographs sent to the scan feature and answers sent for AI marking are processed to produce your feedback and are not stored by us as a separate record beyond what is shown back to you.

You can ask us to:

• give you a copy of the personal data we hold about you
• correct anything that is wrong
• delete your account and everything in it
• hand your data over in a portable format
• stop or limit a particular use of it

To exercise any of these, email morus.llew@icloud.com. There is not yet a button in the app that deletes your account, so a request by email is currently the way to do it. We will respond within one month.

If you think we have handled your data badly you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first so we can put it right.

Haws AI keeps a copy of your workspace in your browser's local storage so the app opens quickly and keeps working if your connection drops. It stays on your device, and clearing your browser data removes it. We do not use cookies for advertising or tracking.

Your data is held in Google Cloud and access is enforced by server-side rules, so one person's account cannot read another's. Sign-in requires a verified email address. Teacher accounts are granted only on a recognised school domain or by manual approval. No system is perfect, and we do not claim otherwise — if something goes wrong that puts your data at risk, we will tell you and the ICO as the law requires.

If we change how we use your data we will update this page and change the date at the top. If the change is significant we will tell you in the app rather than relying on you noticing.