Privacy FAQ

GCSE Reader is an early reading-support service run by Jon Margetts. For privacy questions, access requests, corrections or deletion requests, email jon@gcsereader.com.

We store your name, email address, protected password credentials, login sessions, account settings and trial usage. If you choose an avatar, we also store that image or preset choice. Signup form submissions record your details and marketing choice; they do not contain your password.

We send a time-limited link to the email address you enter. No user account is created at this stage. A temporary verification record is stored to validate the link and control repeat sends. You set your password and create your account only after opening that link. Unused verification records expire after 30 minutes and are cleaned up during later verification requests.

When you press Send, your question, the conversation included with that request, the current literary passage and limited earlier reading context are sent to OpenAI to generate a reply. Account names, email addresses and avatar images are not deliberately added to AI requests. Anything you type can still contain personal data, so do not include identifying or sensitive information.

The conversation is held in the current browser page and clears when the page is reloaded or a different text is selected. GCSE Reader does not save conversation bodies in its CMS. The current OpenAI Responses API integration uses store: true, so inputs and outputs can be retained by OpenAI. This is not a zero-retention service. Provider logs and legal or security requirements can also affect retention.

OpenAI states that API data is not used to train its models by default unless the API customer opts in. This does not mean messages are never stored. Retention and optional data-sharing settings are separate. See OpenAI’s current API data-controls information at https://platform.openai.com/docs/guides/your-data. Do not submit confidential data.

Your feedback, the selected text, your account email and a submission reference are stored in an administrator-only CMS form submission. A notification is sent to the site owner through Resend. Your reading conversation is not automatically attached. Share only the details needed to explain the issue. Feedback is reviewed to improve the service and is not an emergency reporting channel.

Vercel hosts the application and website media. Supabase hosts the Postgres database; the configured projects are in London. Resend sends verification and notification emails. Klaviyo processes signup details and marketing preferences. OpenAI processes reading inputs and outputs. Some providers may process data outside the UK; a London database does not mean that all processing stays in the UK.

No. Marketing consent is optional and separate from email verification and service emails. Tick the box only if you want email updates and resources. You can unsubscribe through marketing emails. An unchecked box does not grant marketing consent. Signup details may still be recorded in Klaviyo without subscribing you to marketing.

Account details, signup records, feedback and usage records remain until removed by the administrator; automatic deletion schedules for these records have not yet been introduced. Contact jon@gcsereader.com to request access, correction or deletion. We will explain any records that must be retained and any limits on deleting provider logs or backups. Clearing the conversation in your browser does not delete provider-held copies.

Login uses a session cookie so the service can recognise your account. The website also includes Vercel Web Analytics. Your browser may store a theme preference. We do not deliberately send reading conversation text as website analytics events. Provider behaviour and settings may change; contact us if you need more detail.

AI responses can contain factual errors, invented quotations or weak interpretations. Check claims against the source text and use your own judgement. Outputs are reading support, not assessed work, professional advice or an authoritative mark scheme. Do not upload or share material you do not have permission to use. Rights in source texts still apply.

This is an early prototype. Adults should assess its suitability before use with pupils. Do not enter pupil names, school details, health information or safeguarding disclosures. The assistant cannot alert a teacher or emergency service, and feedback is not monitored continuously. Speak to a trusted adult or the school’s safeguarding lead about a concern; call 999 if someone is in immediate danger.