Legal
Privacy Policy
We built nevele with child privacy at the centre of every decision. Here is exactly what we collect, why, and what we never do.
Last updated: 7 May 2026
Plain English summary: nevele collects only what it needs to run the service. We never sell your data. We never show your child's real name to anyone. We are registered with the ICO and comply fully with UK GDPR and the Children's Code.
Who we are
nevele is an AI-powered 11+ exam preparation platform built for families in the United Kingdom. nevele is operated by Rishi Nair, a sole trader registered in England and Wales.
Data Controller: Rishi Nair, trading as nevele
Contact: rishi@neveleai.com
Website: neveleai.com
What data we collect
Account information (parent)
- Full name
- Email address
- Encrypted password (never stored in plain text)
- Target schools selected during signup
- Subscription and billing status
Child information
- First name only
- Age (used to calibrate question difficulty)
- A randomly generated nevele tag (e.g. SwiftFox#4821)
- Practice session results, XP and accuracy scores
Usage data
- Session timestamps and duration
- Questions answered and accuracy per subject
- Streak and level progression
We do not collect: full name of the child, school attended, photos, location data, device identifiers, or any sensitive personal data as defined by UK GDPR.
How we use your data
We use the data we collect solely to provide and improve the nevele service:
- To create and manage your family account
- To personalise practice sessions to your child's ability level
- To display progress and performance on the parent dashboard
- To calculate leaderboard rankings using nevele tags only
- To process subscription payments via Stripe
- To send account-related emails (confirmation, billing, important updates)
We do not use your data for advertising, profiling for third parties, or any purpose beyond operating the nevele service.
Child privacy — our highest priority
nevele is designed for children aged 9–11. We take our obligations under the UK Children's Code extremely seriously.
- Children never create their own accounts — parents hold all accounts
- Children log in using only their nevele tag and a PIN — no email required
- No child's real name is ever displayed publicly on the platform
- No child can be contacted through the platform by other users
- No advertising is shown to children at any time
- Data minimisation — we collect only what is strictly necessary
- nevele is designed for desktop and tablet use in shared family spaces
Parents can request deletion of all their child's data at any time by emailing rishi@neveleai.com. All data will be permanently deleted within 30 days.
Data sharing
We share your data with the following third parties only, and only as necessary to provide the service:
- Supabase — secure database and authentication hosting (EU servers)
- Stripe — payment processing (PCI DSS Level 1 compliant)
- Anthropic — AI question generation (no personal data is sent, only subject and difficulty parameters)
- Vercel — website hosting (EU edge network)
We never sell your data. We never share your data with advertisers, data brokers, or any party not listed above. We never will.
Data retention
- Active account data is retained for as long as your subscription is active
- If you cancel, your data is retained for 30 days then permanently deleted
- You can request immediate deletion at any time
- Billing records are retained for 7 years as required by UK law
Your rights
Under UK GDPR you have the following rights:
- Right of access — request a copy of all data we hold about you
- Right to rectification — correct any inaccurate data
- Right to erasure — request permanent deletion of your data
- Right to portability — receive your data in a machine-readable format
- Right to object — object to how we process your data
- Right to restrict processing — limit how we use your data
To exercise any of these rights, email rishi@neveleai.com. We will respond within 30 days.
Cookies
nevele uses only essential cookies necessary to keep you logged in and maintain your session. We do not use advertising cookies, tracking cookies, or analytics cookies.
- Session cookie — keeps you logged in (expires when you log out)
- Auth token — secure authentication via Supabase
No cookie consent banner is required as we use only strictly necessary cookies.