Privacy Policy

1. Who we are

Conquer Your A Levels (“we”, “us” or “our”) operates the Conquer Your A Levels learning service, also referred to as StepsToConquer. We are based in New Zealand and can be contacted at thechefalevels@gmail.com.

2. Information we collect

• Account details, including name, username, email, avatar and settings.
• Learning information, including subjects, answers, working, mistakes, marks, progress, study time and learning history.
• Content you provide, including prompts, feedback, uploads and support requests.
• Social information, including friendships, visibility choices, presence and messages.
• Subscription and transaction records.
• Technical and security information, including IP address, browser, device, timestamps and activity records.
• AI interaction information, including prompts, responses, ratings and the learning context needed to answer a request.

3. Why we use information

We use personal information to:

• Create and manage accounts.
• Provide learning, social, support and subscription features.
• Save progress and personalise learning recommendations.
• Protect users and investigate misuse or security incidents.
• Fix faults and test whether features work correctly.
• Meet legal, regulatory, accounting and dispute obligations.
• Train, test or evaluate models only under the separate rules in Section 5.

We will not use identifiable information for an unrelated purpose unless a lawful basis applies and, where required, we obtain new authorisation.

4. Access by authorised personnel

Personal information is not available to every administrator. A limited number of designated Super Administrators or approved reviewers may access the minimum information reasonably needed to provide support, investigate abuse or security, repair a fault, check an AI feature, complete approved development, or perform model work covered by your current choices.

Access must be role-based, confidential and logged where the relevant system supports audit logging. The organisation remains responsible for the information; a Super Administrator does not own it and may not use it for personal purposes.

5. Model training and service improvement

We may use aggregated or properly de-identified statistics to measure feature performance, find common learning difficulties and improve the Service. We take reasonable steps to prevent this information from being linked back to an individual.

Identifiable or pseudonymised answers, working, prompts, AI responses and feedback are eligible for model training only when you have separately opted in. The choice is off by default, is not required to use ordinary features and can be withdrawn in Privacy Settings.

Before approved examples enter an active training dataset, we will take reasonable steps to remove direct identifiers and unnecessary personal details. A limited number of authorised reviewers may inspect selected examples for de-identification, labelling, quality and safety.

We will not intentionally use the following for model training:

• Passwords, authentication tokens or security credentials.
• Payment card or bank details.
• Private direct messages between users.
• Names, email addresses or government identifiers.
• Precise location, health, biometric or other highly sensitive information.
• Content a user had no right to provide.

Withdrawal stops information from being selected for future training. We will remove identifiable source examples from active training datasets where reasonably practicable. It may not be possible to undo training already completed because a completed model may contain statistical patterns that cannot be separated from one person.

6. Children and young people

We recognise that many A-Level students are under 18. We use age-appropriate notices and consider age, understanding, sensitivity and the young person’s best interests.

Users must be at least 13 to create an account. Users under 18 must have permission from a parent or legal guardian to use the Service, and the parent or guardian should review the optional training choice with them. We do not ask users to select or disclose an age group in this consent flow.

7. Sharing and overseas processing

We may provide necessary information to:

• Hosting, database, security, analytics, payment, email and AI providers acting for us.
• Professional advisers who owe confidentiality duties.
• Regulators, courts or law-enforcement bodies where disclosure is required or permitted by law.
• Other users when you intentionally use a public, leaderboard, friendship or messaging feature.

We do not sell personal information.

Some providers may process information outside New Zealand. We will take reasonable steps to ensure comparable safeguards, appropriate contractual protection or another lawful basis for the transfer.

We will not allow an external provider to train its general models on identifiable User Content unless we clearly disclose that separate use and obtain any authorisation required by law.

8. Security and retention

We use reasonable safeguards, which may include encryption, access controls, backups, confidentiality duties, audit records and security monitoring. No online service can guarantee complete security.

We retain information only for as long as reasonably required for the purpose for which it was collected, including legal, security, backup and dispute needs. We delete or de-identify it when it is no longer required, unless the law permits or requires longer retention.

9. Your choices and rights

Subject to applicable law, you may:

• Ask whether we hold personal information about you.
• Request access to that information.
• Ask us to correct inaccurate information.
• Change profile and social privacy settings.
• Enable or withdraw optional model-training permission.
• Request account closure or deletion of information no longer required.
• Make a privacy complaint.

Send requests to thechefalevels@gmail.com. We may need to verify your identity. If we cannot resolve a concern, you may contact the New Zealand Office of the Privacy Commissioner at privacy.org.nz.

10. Privacy breaches

If a privacy breach is likely to cause serious harm, we will notify affected individuals and the New Zealand Privacy Commissioner as required by law.

11. Changes to this Policy

We may update this Policy when the Service or our legal duties change. Every signed-in user will be required to acknowledge a materially new version. A Policy update will not automatically enable optional model training.