Privacy notice for CoreDrive apps and websites

Public URL: https://coredrive.co.uk/privacy/

Last updated: 23 October 2026

COREDRIVE PRIVATE LTD, company number 17502270, is registered in England and Wales. Our registered office is 20 Wenlock Road, London, England, N1 7GU. Use our privacy enquiry form for privacy questions, help or requests. Business contact details and accessible alternatives are on the Contact page. You do not need to pay, hold an account or contact an instructor first. Necessary accessible alternatives and legally effective notices remain available.

Main website privacy

This is CoreDrive’s marketing website. The apps and self-service Instructor Websites service are planned products; their account, payment and publishing functions are not offered here yet. The live CoreDrive Driving School is independently operated by Hussan Lal, with its own school privacy notice. Lesson enquiries are separate from CoreDrive product enquiries and waiting lists.

The main contact form requires enquiry type, full name, contact email address, UK phone number and message. We use the contact details to respond, including a call back where needed. If you cannot provide a UK phone number or use the form, the Contact page provides business contact details and necessary accessible alternatives; your rights do not depend on completing this particular form. Product-update requests also record selected products, your instructor or learner declaration and separate marketing consent; Instructor Websites requires a fully qualified ADI declaration. The compact Instructor Websites waiting-list form requests first name, surname, UK phone number, email, ADI declaration and separate update consent, and adds a standard waiting-list message. Neither form creates an app account, booking, paid subscription or verified mailing-list membership. We check address ownership before sending updates. Do not include passwords, payment details or unnecessary private learner information.

For these website product-update requests, instructor-status confirmation replaces a separate age declaration; learner requests require the separate 18-or-over declaration. This channel-specific rule takes precedence over the shared promotional declaration wording below. A role declaration is not independent verification, and it does not authorise marketing without the separate opt-in. Other services retain their own disclosed age and marketing rules.

CoreDrive uses necessary contact information to answer enquiries, investigate complaints and handle rights requests. We rely on contract necessity for steps you request towards your own contract, applicable legal duties for legally required handling, and assessed legitimate interests in answering other enquiries and protecting the website. Product updates rely on your separate consent. Required fields are needed for the relevant online form, but you can contact us directly or request accessible assistance without using it.

Cloudflare delivers the public website, validates online enquiries and sends them through the existing IONOS email service. It processes request information, including your IP address and submitted form contents. Enquiry text and raw contact details are not stored in its form database. Keyed abuse-control identifiers, counters and delivery outcomes are held in EU-restricted storage; active records expire within one hour and expired records are removed by automatic cleanup. Cloudflare recovery copies may retain previous technical state for up to 30 days. Cloudflare Web Analytics and Worker request logs are not enabled, and form responses are not cached.

Cloudflare may process information globally, including in the United States, under its data-processing terms and applicable international-transfer safeguards, including its UK transfer addendum where required. IONOS provides our email transport and business inbox; incoming CoreDrive messages are also forwarded to the owner’s Microsoft Outlook.com inbox. Authorised CoreDrive personnel and these providers handle delivery and replies. Moje Solutions Ltd operates on CoreDrive’s behalf as explained in section 4. No optional app diagnostics or content-writing AI receives these website enquiries.

IONOS’s data-processing agreement provides for UK/EEA processing and necessary protected transfers. Microsoft may process the forwarded copy in the UK, United States and other countries where it or its providers operate, under its applicable Outlook.com terms and international-transfer arrangements. Use the privacy enquiry form for provider information and relevant safeguards; no UK-only processing promise is made.

Ordinary main-website enquiry, complaint and privacy-request correspondence is kept only while needed, then for no more than 180 days after genuine final closure, subject to the narrow separately justified evidence exceptions in section 5. This includes both mailbox copies, quoted replies and copies we retain. Waiting-list requests are reviewed every three months and kept only while needed for the selected launch updates or until consent is withdrawn. Necessary minimum consent or suppression evidence follows its own justified finite purpose; withdrawal is not permission to keep the full request indefinitely.

IONOS publishes a seven-day email recovery window. Outlook.com removes Deleted Items after 30 days; items removed from that folder may remain recoverable for a further 30 days. These are recovery windows, not immediate all-backup erasure guarantees. Previously used IONOS hosting/database recovery copies follow their finite provider schedules; those earlier services are not the current online-form processing route. We reapply completed deletions after restoration. Provider access/security records and private diagnostics are used only where needed for operation, incidents or legal duties; records under our control are reviewed monthly and deleted when no longer needed. Earlier IONOS anonymised visitor statistics have an eight-week retention period.

This marketing website has no browser analytics, advertising cookies or persistent form storage. Unsaved form entries remain in page memory while you use it and are lost on reload or closing the page. Fonts and images are served from our own site. Optional future app technologies described below are not activated by visiting this website. For complaints about CoreDrive, contact us first using section 6; protected rights and urgent external reporting remain available.

Privacy at a glance

Your information has different audiences. Your instructor controls the tuition records they add. CoreDrive runs the service and handles your account and private learner functions. A shared account, payment or instructor link does not give an instructor or parent access to your private journal. Roles and notices.
Learner accounts are for ages 17 and over. We use proportionate age checks, with a declaration fallback where appropriate. You can ask a person to review a wrong result. You do not need an account just to receive an instructor’s Mock Test report. Age checks.
Optional monitoring is your choice. Usage analytics, screen replay and crash diagnostics have separate choices and start off. You can decline or change your mind without losing ordinary app access. Private journals, learner reports and other restricted screens are excluded even if monitoring is enabled. Choices.
Promotional emails are separate. They require an adult declaration and a separate opt-in. An instructor cannot sign you up using your learner details.
Records are not kept forever. Different records have different limits; sending a report does not automatically erase it from your instructor’s portal. Retention.
You can get help or use your rights. Use the privacy enquiry form to ask about access, correction, deletion or stopping contact, or the complaints form to raise a complaint. No payment or account is needed. Tell us if contacting a parent or instructor would be unsafe. Rights and complaints.

The sections below give the full details, including providers and overseas processing and your separate right to object. This summary does not ask you to consent.

1 Who is responsible for your information?

CoreDrive is one platform with separate modules, delivered through standalone apps, websites and the comprehensive CoreDrive app. Instructor Websites is a separate web app with its own subscription and is not included in Full CoreDrive, the comprehensive app.

This shared notice covers Mock Test, Street Canvas, Progress & Reflections for instructors, Progress & Reflections for learners, Instructor Websites and the comprehensive CoreDrive app, including their shared account and the main CoreDrive website. The module sections explain different uses of information. Shared registration does not combine permissions, marketing choices or access to another service’s records. Once released, Mock Test, Street Canvas and both Progress & Reflections apps will provide registration and sign-in inside the app, with downloads and subscriptions through Apple’s App Store or Google Play. None is available to download yet. CoreDrive still handles the service account and instructed records under this notice. Instructor Websites will have separate web registration and direct web subscriptions when it launches. No direct web signup or purchase is offered for those four mobile apps; public help and privacy-request routes remain available without an account.

Modules and their delivery apps are released as they complete internal testing and launch preparation. Only functions identified as available are offered; describing planned modules does not promise a release date or include unavailable paid features.

This shared pack applies across the CoreDrive platform, including future modules and delivery apps where relevant and supplied for that service. Before a new service or materially different use begins, we explain its actual features, data handling and applicable terms and obtain any required agreement or consent. This scope does not expand existing purchases, permissions or access rights.

Our apps are offered for UK instructors, customers and learners only, including England, Wales, Scotland and Northern Ireland. This customer scope does not mean all supplier processing takes place in the UK, or remove duties and rights for other people whose information we handle.

CoreDrive controls its own account, subscription, instructor eligibility, security, support and privacy administration, and processing to meet duties imposed directly on it as provider, including applicable statutory safety reporting. An instructor or school normally controls the tuition records it asks CoreDrive to process. It must identify itself, explain its purposes and lawful basis, and give the learner its own privacy information. CoreDrive processes those records on lawful documented instructions under a data processing agreement. An instructor's payment or account does not give it access to a learner's private journal or another instructor's records.

Roles depend on the actual processing. If CoreDrive and another organisation jointly determine a particular use, we must explain their responsibilities and make the essence of the required arrangement available. You may exercise your rights against either joint controller. You can contact CoreDrive for help identifying the responsible controller; we remain responsible for our own duties.

Before adding you as a learner, your instructor or school must give you its own actual privacy notice directly, in an accessible form. It must explain its identity/contact, tuition purposes and lawful bases, the relevant information, use of CoreDrive and authorised providers, recipients, retention and your rights. Any earlier legal requirement to provide information, including at direct collection, still applies; adding you later does not postpone it. CoreDrive's notice and a later report email do not replace that instructor's notice. For self-submitted Instructor Websites enquiries, the instructor’s actual accessible notice must be supplied on the form before collection, alongside the relevant CoreDrive information; no prior manual meeting or blanket consent checkbox is required. The same earlier legal information duties apply. Giving or acknowledging a notice is not blanket consent, and CoreDrive still fulfils its separate duties.

2 What information do we use, and why?

We use only what the particular purpose needs. Required fields and their consequences must be explained before collection. A field, purchase or acceptance of this notice is not consent to every use.

Purpose	Information and lawful basis
Accounts and access	Contact details, authentication and necessary role or eligibility information. We rely on contract necessity where this is needed for your own agreement. Where an account user is not the contracting customer, we rely on assessed legitimate interests in providing and protecting the authorised account and resolving eligibility/access issues, subject to your rights and children’s interests. A contract with someone else is not automatically a basis for using your information.
Purchases and subscriptions	Necessary product, transaction, entitlement and payment-status information to supply the customer's contract and handle refunds; legal obligations for necessary company accounting records. We do not need full card details or a store password to answer a request.
Tuition records	Learner contact details, assessment entries, results, feedback and shared reflections within the authorised relationship. The instructor or school identifies its lawful basis; CoreDrive follows its lawful instructions.
Private learner functions	Account-linked entries and preferences needed to provide the function you choose. Contract necessity applies only where that processing is genuinely necessary for your own agreement; optional uses need a separate basis and choice. Private entries are not automatically shared with an instructor.
Support, rights and safety	Necessary correspondence, functional adjustment needs, case information and security records. We rely on an applicable legal obligation for legally required action, contract necessity for support needed to perform your agreement, and assessed legitimate interests for necessary service security, preventing unauthorised access and fairly resolving service problems where neither of those bases applies. Sensitive or offence-related information needs additional conditions.
Optional functions and marketing	Permitted diagnostic information, location or other optional information under the explained purpose. We rely on consent for optional monitoring and promotional emails; where location is genuinely necessary for a specifically requested function, we explain its applicable basis and any required device choice. We require prior consent for optional diagnostics and opt-in for marketing. Read the device-storage notice for device access and exceptions.

Our legitimate interests must be specific, necessary and balanced against your rights, including children's interests. We must establish and explain the actual basis before using information; we cannot invent a new basis to evade a withdrawal or objection.

Information in each module

Mock Test: the instructor adds a learner's name and optional email address to their own workspace. The name identifies assessments; an email address is needed only when an email report is requested and may be entered or corrected then. No separate learner Mock Test account is needed to receive that email. We also process the instructor's recorded faults, results, feedback, route description, test elements, timing and linked record/delivery information to save and recover assessments, show the instructor their history/statistics, deliver requested reports and support authorised export/correction/deletion. CoreDrive handles these tuition records on the instructor's lawful instructions; we do not reuse them for our own marketing, advertising, AI training or independent learner profiling/product analytics. Hosting and requested email delivery involve authorised providers; the records are not confined to two people's devices. Instructors must include only necessary tuition information in free-text notes. Results are practice information, not an official test result or medical-fitness decision. Requested sharing needs the proper authority and recipient checks; independently saved or forwarded copies have separate control limits.
Street Canvas: drawings, saved artwork and recent searches may remain on the device. Maps, postcode lookups, reference downloads and enabled diagnostics can involve separate requests and technical information. Do not include private learner details in searches; CoreDrive must also prevent unnecessary information being added to those requests. An exported file or device backup is a separate copy.
Progress & Reflections — instructor and learner apps: the separate apps provide role-specific access to authorised progress records, feedback and reflections. A learner’s private entries remain private; an instructor account, payment or link does not grant access. Sharing must have lawful authority and clear recipient controls. A link, block, unlink or instructor change must not give a new person access to private or historical records without lawful authority.
Comprehensive CoreDrive app: combines available module functions, applying the same purpose, audience and retention rules to each. A single interface does not merge private learner records with instructor records or permit cross-module reuse.
Instructor Websites: instructor-declared registered name, ADI reference/expiry and necessary dated verification evidence support eligibility; private identity fields are not automatically published or sent to content AI. We also handle business/display/contact details, services/prices, drafts, policies, images and permission summaries, public website revisions, private enquiries and delivery state, subscription references and optional AI-review records. Public business details and lawfully approved photos/testimonials are visible to visitors and search engines; do not publish a private home address or personal contact simply because it appears in registration. Required business disclosures remain necessary. The instructor normally controls school content, learner enquiries and its independent mailbox copies; CoreDrive processes instructed hosting, publication, inbox, delivery and authorised business-text review. CoreDrive has its own separate account, billing, eligibility, security and directly imposed duties. A person’s public appearance or sole-trader business text can still be personal information.

Website enquiry forms collect full name, phone and email; lesson/waiting-list or instructor-training enquiries also collect postcode and the applicable selected service, preferences or booked-test details. General enquiries exclude postcode. A message is optional; attachments, diagnoses and licence scans are not requested. A sensitive-support question remains disabled until its specific qualification is complete. Required fields and consequences must be explained and their necessity verified before use. Full permitted enquiry content goes to the designated verified instructor recipient and private inbox, not to other schools, CoreDrive marketing or AI. Submission is an enquiry, not a booking, lesson contract, guaranteed waiting-list place or proof of delivery/read receipt. No learner account is needed, and we do not automatically email an unverified enquirer. Public readers/enquirers may be children even where the website subscriber is an instructor or school; we provide appropriate information and protected handling of unexpected sensitive content.

Optional website push uses the instructor’s chosen device/app binding, subscription token and minimal notification reference. A generic alert contains no learner details; full content requires authorised sign-in. Refusing push does not prevent enquiries or ordinary website use. Public website reports can be anonymous, with page/item, reason, optional details and optional private reply contact; they are separate from enquiries. Do not submit sensitive content or imagery as proof. Relevant IP/technical signals used for proportionate anti-abuse checks have their own minimum lawful scope and finite limits.

Optional website AI review operates only after the instructor expressly starts a review of selected permitted business copy. It may send that text and necessary business facts to the qualified Anthropic API, with a qualified OpenAI API fallback for availability problems. It excludes registered identity/ADI details, enquiries, learners’ names/contact information, photos, private records, support/billing material, policies and testimonials. Public sole-trader text may still be personal data: actual roles, instructions, lawful bases, contracts and transfers must be established. A first-use acknowledgement is information, not blanket consent or a substitute for those duties. Providers, actual retention/training controls and exceptional access must be disclosed before use; no UK-only, zero-retention or absolute confidentiality promise is made. Unqualified routes stay off. Review output is private until the instructor approves changes and explicitly publishes; AI can be wrong and does not decide eligibility, rights or billing.

Mock Test feedback and notes are limited to necessary driving-performance observations. Do not enter health or disability information, diagnoses, medical history or medication details, or infer a medical cause from driving performance. Unexpected sensitive information needs protected lawful handling and authorised correction/removal, rather than routine report delivery or reuse. An observation that itself reveals health information still needs its actual legal classification and safeguards; a performance label does not make it non-sensitive. Necessary accessibility/support information uses a separate protected minimum-data route, not the assessment notes.

CoreDrive must explain each enabled function's actual collection, audience and sharing before use. Local storage and linkable identifiers are not automatically anonymous. We do not use private learning, health, reflection or precise-location information for advertising, marketing or training any AI or machine-learning model, or send that restricted information to a general AI writing, support or analysis service. The separately qualified, narrowly limited provider abuse-check route below is the only permitted automated supplier-content exception; no stronger earlier accepted restriction is weakened without required lawful agreement.

Practice calculations support human judgement. Our service does not make decisions with legal or similarly significant effects based solely on automated processing. Any change needs its applicable lawful conditions, safeguards and clear information about the logic and consequences before use.

Instructors are responsible for entering and keeping learner contact details accurate, making authorised corrections and choosing the correct recipient for each requested report. They must check the email address before sending. CoreDrive processes the requested delivery on lawful instructions and remains responsible for its own security, confidentiality and data-protection duties. This responsibility does not depend on an automated address-verification feature.

3 Children, sensitive information and other sources

Learner accounts are intended for people aged 17 or over. Seventeen-year-olds are children for data protection, and younger children may appear in lawful tuition or safety records. A parent, instructor, employer or payer does not automatically have authority to see a person's information. We assess the child's understanding, rights and safety and provide clear, age-appropriate information.

Learner age checks: supported apps may request Apple Declared Age Range or Google Play Age Signals, where available and shared, to assess the 17+ account requirement. A store download, purchase, content rating or broad 16–17 band does not prove that the current learner is 17+. We distinguish declared, parent-managed and other assurance methods rather than describing every result as verified.

If the signal is unavailable, declined or inconclusive, the fallback is a neutral declaration of under 17 / 17 / 18 or over, without a routine birth-date or ID upload, where our children's risk assessment supports that level of assurance. Under-17s cannot open learner accounts. Clear conflicting age information needs proportionate human review, not a declaration that overrides it. Where stronger assurance is necessary, keep the affected feature unavailable until a suitable check is qualified; offer an accessible correction/review route and preserve existing rights and remedies.

Keep only necessary eligibility/age-band, source/method and date evidence while needed for account eligibility or an age-correction case. Remove obsolete working signals promptly; after account ending retain only separately justified minimum evidence under the applicable finite case/compliance schedule. Store-derived signals and decisions remain restricted to the requesting app's age-appropriate eligibility and safety purposes, not marketing, PostHog, other analytics or reuse across separate apps/websites. Apply the Children's Code privacy standards to all learner-account users, with suitable information and controls for their needs. Age 17 remains a child status. Age checks do not replace separate monitoring choices or the independent adult marketing declaration/opt-in. Age-check functions are enabled only when these safeguards can be met. Requested Mock Test report recipients do not need an account or a new age/identity check merely to receive the report; protected help and rights remain available regardless of age.

Health or disability information, wellbeing inferences and alleged criminal offences need their actual additional legal conditions and safeguards. Optional sensitive fields need genuinely explicit, informed consent where that is the condition used. Necessary safeguarding, legal claims or statutory duties require their own applicable conditions. Volunteering information does not establish every required condition. We minimise unexpected sensitive content and handle it lawfully rather than ignore a request or retain it indefinitely.

Information may come from you, an authorised instructor or representative, a purchase platform, a provider or a person making a report. We must explain the actual source and required privacy information within the applicable period: normally no later than one month, and earlier at first communication or disclosure where required. Any exception must genuinely apply; a website notice alone does not justify withholding individual information. A new purpose needs the required information and lawful authority before it begins.

For Mock Test, Street Canvas, both Progress & Reflections apps and the corresponding functions in the comprehensive app, where enabled under the safeguards below, CoreDrive uses PostHog for optional user-linked usage analytics, automatic tracking of permitted interactions, session replay and sanitised crash reports. Information can include random app-specific monitoring and session IDs, permitted interactions and device/app versions. These IDs remain personal information. We keep the minimum account-to-monitoring-ID lookup restricted inside CoreDrive for rights and verified deletion; we do not send names, emails, hashed contact details or shared account IDs as the monitoring identity or merge identities across apps.

Each purpose needs its separate informed choice before local capture; declining or withdrawing preserves ordinary access. An instructor’s choice does not authorise learner-data capture. Exclude learner contact/report screens, private reflections, support/rights, password/payment and other restricted screens entirely, even with masking. Mask permitted information on other allowed screens before capture. Crash reports must exclude private values, credentials, learner content and request/response bodies. Unverified surfaces remain unrecorded. Withdrawal/account changes must stop affected capture and unauthorised queued upload. The device-storage notice explains choices and capture controls; section 5 sets retention limits and the conditions for enabling monitoring. PostHog EU Cloud in Frankfurt is the selected monitoring route; it is enabled only after the necessary contracts, transfer safeguards, access and configuration checks. Monitoring does not authorise marketing, advertising, training or independent reuse of tuition data. Instructor Websites has a different boundary: only demonstrably anonymous server-prepared summaries may reach PostHog; no visitor/instructor-linked identifiers, browser SDK, replay, autocapture or raw errors are authorised there. Hashing an identifier does not make it anonymous. Source records and supplier administration remain separately governed personal-data processing.

In the comprehensive app, monitoring choices and restricted-content exclusions apply to each relevant module as well as the app. Your choice in a standalone app does not automatically permit capture in another app or a new module. Instructor Websites is separate from the comprehensive app and retains its anonymous-summary-only monitoring limit. Before monitoring a future project, we explain the actual technologies and purposes and obtain any required prior choice.

We share only information necessary for a lawful purpose with authorised recipients: the relevant instructor or learner; a recipient you lawfully choose; providers for hosting, authentication, payments, requested delivery, maps, diagnostics or support; professional advisers; and authorities where a lawful duty or justified disclosure applies. A provider may separately control its own transaction or other specified business records. We must explain that role and route for rights without passing away our own responsibilities.

Moje Solutions Ltd manages the development, maintenance and day-to-day operation of all CoreDrive services on CoreDrive’s behalf. Its authorised staff may use only the information needed to operate, secure and support the service, including instructed learner or website records where necessary. Moje follows CoreDrive’s instructions and confidentiality, security and deletion requirements; it cannot use this information for its own marketing, AI training or other independent purposes. CoreDrive remains responsible for its obligations to you.

Private records are not a public audience or a marketing list. Provider access needs suitable contracts, security and, for subprocessors, the controller's required written authorisation. Unused candidates must not be presented as active providers. A retired provider remains relevant while it retains or processes affected information.

A London database does not establish UK-only processing. Before an overseas disclosure or remote access, CoreDrive must identify the actual country, receiving entity and applicable UK adequacy coverage or binding safeguards and required assessment, or a strictly applicable legal exception. Generic provider terms or a brand logo are insufficient. You may request understandable transfer information and a meaningful copy of applicable safeguards; necessary limited redaction must not defeat that right.

Amazon Simple Email Service (SES) is CoreDrive’s selected transport for outbound app emails, including requested reports, account/security and service notices, and separately opted-in promotions. IONOS hosts our business inbox for support and privacy correspondence received through the website enquiry form and other recognised routes. Please avoid sending unnecessary learner records or sensitive attachments. These providers serve separate purposes; sharing an email service does not combine consent or permit reuse of learner records. The selected route is enabled only after its supplier, security and delivery requirements are met. App accounts and instructed records use qualified account-authentication, hosted database and secure file-storage providers where enabled under the applicable DPA. The separate Instructor Websites service may also use managed website hosting and recovery, optional device-push delivery and an assessed enquiry-abuse challenge. Actual recipient information and any required named-party choices are supplied before those functions begin; proposed infrastructure suppliers are not presented as active recipients. Selected API providers for optional business-text review are described above. Before a route is enabled, we provide the applicable supplier, role, country, access and retention information and establish the required safeguards. Listing a selected supplier does not authorise an unavailable function.

Necessary provider security and abuse checks are limited to their qualified purpose and minimum information. They do not authorise model training, general AI editing/support or marketing reuse. Provider terms, overseas access and retention must be checked before the affected service is enabled; any actual former-provider copies remain subject to our deletion and rights duties.

5 Choices, retention and deletion

Optional diagnostics, location and marketing have separate choices. Refusing, withdrawing or objecting must not reduce ordinary free, paid, trial or testing access, change the price or remove data rights. A genuinely optional function may need its disclosed information; we explain that effect and provide a lawful alternative where required. Marketing stops promptly from the first request across the affected, reliably associated audience. Service messages do not authorise promotional reuse. Recipient-level open, click and link measurement is disabled in marketing and service messages under our service rules.

If you separately choose promotional emails, CoreDrive may email you about its new apps, modules, features, relevant offers and upgrades designed to support driving instructors and learners. This is optional and separate from monitoring, terms acceptance and necessary service notices. You can unsubscribe through every promotional email, your available email-preference control or the privacy enquiry form, without losing ordinary app access. We do not use learner contact details supplied by an instructor as CoreDrive marketing contacts. A requested report, purchase or account registration is not this opt-in.

CoreDrive promotional emails are limited to people who declare that they are 18 or over through the separate self-declaration “I am 18 or over” beside the separate marketing choice and who separately opt in. This is a declaration, not independently verified age; retain only its necessary confirmation/date rather than collecting a full birth date or identity documents for marketing. Credible conflicting information keeps promotional sending off until appropriately resolved. Under-18 or unknown-age recipients remain excluded from promotional sending. This restriction does not stop necessary account/security/service messages or requested instructor reports. Account eligibility or an instructor’s selection is not independent proof of age or marketing consent. Do not collect unnecessary identity documents merely for promotional eligibility. Marketing to younger users requires a separately reviewed child-specific assessment and decision before activation.

Where optional app monitoring is available, we provide a brief, skippable first-use panel and the same controls in Privacy settings. Usage analytics/automatic tracking, session replay and crash diagnostics have separate, clearly explained switches, all initially off. Skipping or declining leaves ordinary app access available and does not count as consent. Before your choice, we explain each purpose, permitted information, provider and retention period. You can change or withdraw a choice in Privacy settings as easily as enabling it. These choices are separate from marketing and terms acceptance. Optional monitoring stays off unless these choices and capture controls are available and effective.

We keep only information necessary for its lawful purpose. Earlier erasure, shorter lawful instructions and greater accepted rights take priority over a maximum below.

Information	Maximum retention or criterion
Account, eligibility and active relationship information	While needed for the lawful service. Review account dormancy after 24 months; that review alone does not end an agreement or revive a tuition record's clock. Remove unnecessary links when a relationship ends.
Mock Test portal records	Retained on the instructor/controller’s documented instructions while needed for its lawful tuition purpose. The instructor can request authorised deletion earlier and must periodically review necessity and specify justified retention criteria. Sending an email does not itself delete the portal report. This is not permission for indefinite storage. Processing-service ending follows the DPA’s return/deletion provisions.
Mock Test prepared email content	Terminal prepared email payloads become due for deletion seven elapsed days after their last update, under monitored cleanup. Reads or routine housekeeping must not restart that clock; terminal content is not kept as a sent-email archive. Active delivery/retry work is kept only while needed under a bounded delivery process. This does not delete portal reports, independent recipient copies or separately justified minimum delivery/security records. Provider and backup copies follow their disclosed finite schedules.
Other ordinary tuition and reflection records	Normally no more than 12 months after the last relevant tuition activity in that relationship. For private entries outside a tuition relationship, use the last meaningful activity for that private function. Earlier erasure and lawful shorter instructions take priority.
Ordinary support, complaint and privacy-request cases	While necessary to handle the matter, then no more than 180 elapsed days after genuine final closure. Complete and communicate the outcome and any necessary remedy, payment or provider work before closure. Remove sensitive attachments, identity documents and working extracts sooner when no longer needed. Necessary accounting or specifically justified minimum legal evidence follows its separate rule. This does not authorise a 180-day archive of response bundles.
Temporary completed privacy-response bundles	Securely available for 30 elapsed days from the later of accessible completion and notification, without extending the legal response deadline. Earlier removal is possible with confirmed receipt or agreement. Help and secure alternative delivery or justified reissue remain available for failed or expired access. Remove unnecessary working copies sooner.
Separately justified minimum compliance, legal/regulatory and consent evidence	Only necessary proof under a documented lawful purpose and finite criterion; the maximum is three years after the relevant closure or processing end where genuinely justified, with earlier removal when necessity ends. This is separate from ordinary support/privacy-request cases and is not permission to keep whole conversations, identity documents, response copies or deleted content.
Financial and accepted-contract evidence	Necessary company accounting records normally six years from the end of the relevant company financial year. Minimum contract/dispute evidence may be kept up to six years after ending where justified; this is not a universal UK limitation period or authority to keep tuition content.
Choices, deletion and restriction markers	Only the minimum needed to honour the current purpose-specific choice or prevent relevant controlled copies being restored, with necessity reviewed. A continuing refusal must survive recovery; where its scope is lost, keep that affected optional use off until a new clear choice. No indefinite marker for a hypothetical reinstall.
Website enquiries	No more than 90 elapsed days from original acceptance, earlier lawful individual/module deletion. Retries, offline access or changed recipients do not restart the period. Instructor-held mailbox copies have their own lawful controller retention.
Website AI results and activity	Latest successful result per item: 90 elapsed days from completion, earlier replacement/item/module deletion. Minimum customer activity: 90 elapsed days from submission. Content-free allowance/idempotency ledger: originating period plus at most 90 elapsed days after its end. No retained prompt/output archive for analytics.
Website content, drafts and eligibility	Formerly paid site text/configuration/media/custom policies and ordinary ADI summary: at most 90 elapsed days from actual paid-service end, earlier confirmed deletion. Login, pause extension or failed renewal does not reset the anchor. Never-paid drafts/settings/ordinary verification: at most 90 elapsed days after last substantive save, not reads or unchanged autosaves. Successful resumed paid service has its own lawful active lifecycle; do not promise recovery after expiry. Ordinary DVSA correspondence: remove within 30 elapsed days of final reviewed, communicated verification decision; necessary disputed evidence separately justified.
Website routine non-policy export artifacts	Secure temporary artifacts expire within 24 elapsed hours from creation; reads/retries do not extend expiry. Remove unnecessary working files sooner. These contain only authorised current business/design/eligible media, not enquiry/private identity/billing/verification/policy-library/AI history. Statutory rights and all-Controller-Data return use their own lawful scope and usable delivery, not this routine export exclusion.
Website permissions, audits and minimum incidents	Permission/withdrawal summaries: while content is lawfully retained, then at most 180 elapsed days after effective withdrawal/permanent removal. Security/privileged audit: 180 elapsed days from event, no content/secrets. Minimum breach register: 24 calendar months after final necessary response/remediation/notification closure. Justified website-only upheld-ban identifiers/outcome: 24 calendar months from final decision, unless individual lawful review establishes finite continuation. These periods do not extend raw content or ordinary case retention.
Website recovery and deletion safeguards	Maximum copy ages required before the affected website processing is enabled: 30 elapsed days from creation for content/media/custom policies/enquiries/AI results/activity; 90 elapsed days for separately isolated administrative/compliance metadata; mixed copies take the shorter limit. Affected processing is not enabled unless the supplier arrangements can meet these limits. Deleted copies immediately leave ordinary use; minimum revocation markers last through 30 elapsed days after all relevant restorable copies expire and delivery/replay reconciliation is terminal, with bounded escalation and necessity review. Other modules retain their own verified schedules.
Safety and legally required records	Their specific lawful scope and finite period. Applicable NCA reporting rules have separate one-year report-material and five-year reference periods with distinct sending/issue triggers; they do not justify an indefinite whole-account hold.
Optional PostHog session recordings	Maximum routine period: 30 elapsed days from recording creation, with earlier lawful deletion where required. Configure before capture; a changed setting applies only to new recordings. Actual expiry/removal delay and provider copies must be verified. No routine exported archive or indefinite saved recording.
Optional PostHog user-linked analytics and automatic events	Required limit before enabling collection: 90 elapsed days from each event, including associated monitoring identifiers only while needed. This is not a supported shorter Cloud retention setting. Identifiable collection must remain disabled until a lawful, tested deletion arrangement can meet the published service rule; the vendor’s one-/seven-year event window is not silently adopted.
Optional PostHog crash/exception events	Required limit before enabling collection: 90 elapsed days from the exception event, with private content excluded before capture. Exception events use PostHog’s event system; no independent shorter error-event expiry setting has been verified. Apply the same collection gate as identifiable analytics.
Optional diagnostic logs	Maximum routine period: 14 elapsed days from log creation, if separately enabled and necessary; verify provider operation/copies. These are distinct from required incident, security or rights evidence with their own justified finite schedules.
Local files, caches and backups	Temporary files only while needed; user-saved artwork until removed, with independent exports and device backups separately controlled. Controlled backups must expire on a verified finite cycle and preserve current deletion and stop decisions before restoration.

Monitoring limits: PostHog Cloud’s standard event-retention window is longer than our limits. Affected collection stays off unless a tested lawful deletion arrangement can meet the periods above. Any material change requires updated information and the necessary lawful authority and choices before collection. Your withdrawal and erasure rights remain applicable.

Controlled backups must expire on a finite, verified cycle. A submitted deletion job is not proof of completed erasure. We explain genuinely retained categories, reasons and pending copies. We cannot directly erase a file independently saved by you or another recipient, but must perform our own duties and required recipient notifications.

You can request access, correction, erasure, restriction, qualifying portability, object where applicable, and withdraw consent at any time, as easily as you gave it, without affecting earlier lawful processing. Required adjustments must continue through a lawful route; withdrawing health-data consent does not itself remove an owed adjustment. Account deletion and billing have separate effects: Instructor Websites web subscriptions and Apple/Google-billed mobile subscriptions follow the separate cancellation routes in the terms. Deletion does not automatically change a store’s billing setting or create a refund; use the purchasing store’s cancellation controls for store-billed subscriptions. CoreDrive takes available developer steps and honours legally effective notices and independent duties. Privacy rights do not depend on cancelling billing first.

Your right to object

You may object at any time to direct marketing, including profiling connected with it; we will stop that use. If we rely on legitimate interests, including recognised legitimate interests, or an applicable public-task basis, you may object on grounds relating to your particular situation, including to related profiling. We must stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or need it for establishing, exercising or defending legal claims. These grounds do not permit continued direct marketing after an objection. Object free of charge using the privacy enquiry form or through another legally effective or necessary accessible route; no account is required.

6 Requests, complaints and changes

Use the privacy enquiry form, choosing Privacy or Data Rights; choose Account Deletion for an account-deletion request. You may also use the business contact details and accessible alternatives or another legally effective or necessary accessible route. The online form requires a UK phone number; if you cannot provide one or use the form, use the business contact details and accessible alternatives. No account, payment or marketing consent is needed to exercise your rights. If your account email is unsafe or unavailable, give a safe reply email and explain this in your message. We recognise the substance of a request and use proportionate identity or authority checks for protected actions. Tell us if your usual address, parent or instructor is unsafe. A block does not prevent protected rights communications, and checks must not reset separate cancellation, refund or safety deadlines.

Rights requests: we respond without undue delay and normally within one month under the applicable rules. We explain any genuinely lawful start, clarification, extension or refusal and honour earlier binding deadlines. Ordinary rights handling is free; any exceptional lawful fee or refusal must meet its actual conditions and be explained.

Privacy complaints — contact CoreDrive first: please tell us your concern using the complaints form so we can investigate and try to put it right before you escalate it. You may also write to our registered office or use another recognised or necessary accessible route; no account, payment, prescribed form or special wording is needed. We recognise a complaint by its substance, including when received by a different CoreDrive contact. We acknowledge data-protection complaints within 30 days beginning with first receipt, investigate appropriately, keep you informed and explain the outcome without undue delay. We also apply the faster ordinary response targets in the terms. Forwarding, identity checks or an internal review do not restart this acknowledgement period or any separate rights-request deadline.

If you remain unhappy, tell us why and ask for a review; we give safe reasons and suitable independent input for a serious conflict involving the original decision-maker. You can complain to the ICO, the UK data-protection regulator. The ICO normally expects you to give the organisation a chance to resolve the issue first and applies its own complaint procedure. Our request to contact us first does not remove your right to contact the ICO, seek independent advice or use available court remedies, and no internal-review requirement postpones a legal deadline. Do not delay urgent safeguarding, security or other lawful reporting to wait for us. Complaints never require contacting an unsafe or implicated instructor or parent.

We provide the relevant notice before collection and explain material changes before a new use begins. Updating a webpage is not consent, acceptance of unseen terms or permission to restart stopped processing. This notice does not reduce any greater protection or commitment already binding on us. Necessary finite evidence of the exact notice and choices must remain retrievable.

Save a text copy of this notice

CoreDrive privacy notice