Privacy Policy

1. Who we are (data controller)

ThinkHub ("we", "us", or "our"), operating the platform at mythinkhub.app, is the data controller for personal data processed through the ThinkHub service (quizzes, surveys, ThinkHub Pools, flashcards, labs, blogs, Q&A, mentoring features, and related tools).

Privacy / data protection contact: use the contact form on mythinkhub.app and clearly state that your message is a privacy or data protection request. We will respond without undue delay and within one month of receipt (or as otherwise required by UK GDPR).

2. Personal data we collect

Depending on how you use ThinkHub, we may process:

• Account data: name, email address, hashed password, role (for example student, teacher, mentor, or admin), approval status for teachers, and optional profile details (such as profile picture, about me, mentor expertise, and session pricing).
• Verification and security data: email verification codes, password-reset codes, and related timestamps used to create or recover accounts.
• Learning and session data: quiz attempts and answers, scores, survey responses, flashcard activity, lab participation, ThinkHub Pool contributions, attendance or join details, and nicknames used when joining without a full account.
• Content you create: courses, questions, answers, explanations, blog posts, comments, likes, Q&A posts, mentor schedules, and similar material you submit.
• Contact form data: name, email, institution, request type, and message when you contact us.
• Technical and device data: IP address, browser and device information, and logs needed for security, debugging, and reliable operation of the service.
• Local device data: authentication tokens, theme preference, and temporary session identifiers stored in your browser (see Cookies and local storage below).

We do not intentionally collect special category data (such as health, religion, or biometric data for identification). Please do not submit such information in quizzes, posts, or forms unless your institution has a separate lawful basis and has instructed us to process it.

3. How we collect data

• Directly from you when you register, sign in, join a session, submit content, or contact us.
• Automatically when you use the platform (technical logs and browser storage needed for the service).
• From teachers or institutions when they create activities that you join, or when an administrator manages accounts on the platform.

4. Purposes and lawful bases

Under UK GDPR we must have a lawful basis for each processing purpose. We typically rely on the following:

Where we rely on legitimate interests, we balance those interests against your rights and freedoms. You may object to processing based on legitimate interests (see Your rights).

We do not sell your personal data. We do not use your personal data for third-party advertising.

5. Who we share data with

We share personal data only where necessary:

• Other users on the platform: for example, teachers may see class participation and scores; public or class-visible content you post may be seen by other authorised users.
• Service providers (processors): trusted providers who help us operate ThinkHub, such as email delivery (currently Resend), hosting, and database infrastructure. They may process data only on our instructions and under appropriate contracts.
• Institutions: if your access is provided through a school, university, or similar organisation, authorised staff of that organisation may receive data needed to run teaching activities.
• Authorities: where required by law, court order, or to protect rights, safety, or security.

6. International transfers

Some providers we use may process data outside the United Kingdom. Where that happens, we take steps required by UK GDPR, such as using providers in countries covered by a UK adequacy decision or putting in place appropriate safeguards (for example the UK International Data Transfer Agreement or Addendum, or equivalent approved mechanisms). You can contact us for more information about transfers relating to your data.

7. Retention

We keep personal data only as long as needed for the purposes above:

• Account data and learning records: for the life of your account, and for a limited period afterwards where needed for backups, dispute resolution, or legal compliance.
• Verification and password-reset codes: for a short period until used or expired.
• Contact form messages: for as long as needed to handle your enquiry and related follow-up.
• Security and technical logs: for a limited period consistent with security and operational needs.

You may delete your account in Settings (where available). Deletion removes associated personal data from active systems, subject to residual copies in backups for a limited time and any data we must retain by law.

8. Security

We use appropriate technical and organisational measures to protect personal data, including hashed passwords, access controls, and secure transmission where supported. No method of transmission or storage is completely secure. You are responsible for keeping your password confidential and for using a strong unique password.

9. Cookies and local storage

ThinkHub primarily uses essential browser storage rather than non-essential tracking cookies:

• Authentication token (local storage) – keeps you signed in.
• Theme preference (local storage) – remembers light/dark display choice.
• Session identifiers (session/local storage) – for example quiz attempt IDs, lab participant IDs, or survey nicknames so a session can continue if you refresh the page.

These are necessary for the service to function or to remember a setting you chose. We do not use advertising cookies. You can clear browser storage in your browser settings; doing so may sign you out or interrupt an in-progress session.

10. Children and education use

ThinkHub is designed for educational use. If you are under 18, you should only use the platform with the consent of a parent/guardian or through an arrangement with your school or institution, as applicable. Teachers and institutions are responsible for ensuring that classroom use of ThinkHub is appropriate for their learners and complies with their own safeguarding and data protection obligations.

11. Your rights under UK GDPR

Subject to legal limits, you have the right to:

• Access your personal data (subject access request).
• Rectification of inaccurate or incomplete data.
• Erasure ("right to be forgotten") in certain circumstances.
• Restriction of processing in certain circumstances.
• Data portability for data you provided to us, where processing is based on contract or consent and carried out by automated means.
• Object to processing based on legitimate interests.
• Withdraw consent where processing is based on consent (withdrawal does not affect prior lawful processing).
• Complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint. We encourage you to contact us first so we can try to resolve your concern.

To exercise these rights, contact us using the details in section 1. We may need to verify your identity before fulfilling a request.

12. Automated decision-making

We do not use your personal data for solely automated decision-making that produces legal or similarly significant effects about you (UK GDPR Arts. 22). Scoring in quizzes is part of the educational service you choose to use and is not used to make such decisions about you outside the platform.

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. Where changes are material, we may also provide a notice on the platform or by email. Continued use of ThinkHub after an update means you acknowledge the revised policy. If you do not agree, you should stop using the service and may delete your account.

14. Related documents

Use of ThinkHub is also governed by our Terms and Conditions.