Privacy notice

Haws AI is run by an independent developer based in Wales, who is the data controller for the personal data described here. Questions, requests and complaints go to morus.llew@icloud.com.

You must be 13 or over to create an account. This is the age at which UK law lets you agree to an online service on your own behalf. If you are under 13, do not create an account; if you already have, email us and we will delete it.

Only what the app needs to work. In full:

• Your account. Email address, the nickname you choose, the avatar emoji you pick, whether you are a student or teacher, your exam board, and whether you have finished setting up.
• How you sign in. Either an email address and password, or a Microsoft account if you use that button. Passwords are handled by our sign-in provider and are never visible to us.
• Your study material. The subjects and topics you choose, your notes, flashcards and saved resources.
• Class activity. If you join a class, your membership of it, and the quizzes you are set along with your attempts and scores.
• Images you upload. Any picture you add to a question or note.
• Photographs of your work. If you use the scan feature, the photo you take of your written work.
• Answers you write. If you ask for AI feedback, the answer you wrote, so it can be marked.
• Your AI usage. Previous subscription status, short-lived session records, aggregate usage totals and request fingerprints. We temporarily cache completed AI feedback so retries do not repeat the same model request; feedback can include short quotes from your answer.
• Previous payments. If you subscribed before paid plans were paused, Stripe handles your payment details. We store its customer and subscription references and your payment status, but never your full card details.

We do not use advertising trackers, and there is no analytics or profiling of how you move around the app.

Under UK GDPR each use needs a lawful basis. Ours are:

• To perform our contract with you — your account, your notes, your flashcards, your class membership and your marks. Without these there is no service to provide.
• Our legitimate interests — keeping the service secure, preventing abuse of the AI marker, and fixing faults. We limit this to what is necessary and it never involves selling or profiling your data.
• Your consent — for the optional features you choose to use, such as scanning a photograph of your work. You can simply not use them, and you can withdraw consent by deleting what you sent.

We use a small number of established technology providers to run the service. Hosting, AI and email providers process study and account data on our instructions. Stripe handles any previous subscription records under its own privacy terms, including fraud prevention. You can ask us for details of these providers.

• Hosting and storage — runs the website and stores your account and study material.
• AI — marks answers and reads photographs of work. Your answer or photograph is sent to it to be marked. It does not use this data to train its models.
• Email — sends sign-in and verification emails.
• Stripe — retains previous subscription records and lets affected users manage or cancel them. Your account email and an account reference are sent to Stripe; your study material is not.

Some of these providers operate outside the UK. Where data is transferred abroad it is protected by the safeguards UK law requires, such as the UK addendum to the standard contractual clauses.

We do not sell your data, and we do not share it with anyone else except where the law requires it.

If you join a class, the teacher who runs it can see your name and your attempts at the quizzes they set — that is the point of a class. They cannot see your private notes, your flashcards, or anything else in your own workspace.

If you accept a staff invitation, we store your school, staff role, name, email and whether your membership is active. Haws administrators appoint school administrators, who can see and manage their own school’s staff list and invitations. This does not give them access to your private notes, flashcards or personal study workspace.

Invitation links expire after seven days and are tied to the invited email. Pending and completed invitation records are scheduled for deletion after fourteen days. Disabling a staff membership preserves its history, while removing school access. A separate personal subscription can continue after a school licence ends.

Your account and study material are kept for as long as your account exists. Delete your account and we remove them.

Photographs sent to the scan feature and answers sent for AI marking are processed to produce your feedback. The original photo and the full request are not stored in our session cache. Completed feedback is cached temporarily for retries and is scheduled for deletion one day after the session expires. Deletion can take additional time.

Draft answers, including maths working and drawings, are saved with your account so you can return to them. They remain private to you and are removed when your account data is deleted.

You can ask us to:

• give you a copy of the personal data we hold about you
• correct anything that is wrong
• delete your account and everything in it
• hand your data over in a portable format
• stop or limit a particular use of it

To exercise any of these, email morus.llew@icloud.com. There is not yet a button in the app that deletes your account, so a request by email is currently the way to do it. We will respond within one month.

If you think we have handled your data badly you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first so we can put it right.

Haws AI keeps a copy of your work on your device so the app opens quickly and keeps working if your connection drops. Clearing your browser data removes that copy; your work is also saved to your account so it can be restored. We do not use cookies for advertising or tracking.

Your data is stored securely, and access controls stop one person's account reading another's. Sign-in requires a verified email address. School staff access requires an invitation addressed to that email and a current school licence. No system is perfect, and we do not claim otherwise — if something goes wrong that puts your data at risk, we will tell you and the ICO as the law requires.

If we change how we use your data we will update this page and change the date at the top. If the change is significant we will tell you in the app rather than relying on you noticing.