Privacy Policy

Your personal data is important to us and we aim to look after your personal data carefully in line with the latest data protection and privacy laws.

1. Introduction

In this Privacy Policy (the "Policy"), we have set out more detail on those laws and on what personal data we collect about you and how we use that personal data.

Please do read this Policy so you know what we are doing with your personal data.

We may update this Policy from time to time and we will post any changes on our platform at www.zerogravity.co.uk, app.zerogravity.co.uk and/or tutor.zerogravity.co.uk and the Zero Gravity iOS and Android mobile applications (the "Platform"). This Policy was last updated on 8th April 2026.

The rights of individuals are protected by the "UK GDPR" ((being the UK's implementation of the General Data Protection Regulation (Regulation EU) 2016/679) (the "GDPR")), and any amendments to it. These impose restrictions and controls over the way that Zero Gravity collects and uses personal data.

For the purpose of this Policy and the applicable data protection legislation, the controller of your personal data is Zero Gravity Tech Ltd (company number: 12091675), a private limited company incorporated in England with its registered office: 6th Floor One London Wall, London, England, EC2Y 5EB ("Zero Gravity", "we", "us" or "our"). Where you access our Services through a School Partner or Employer Partner, that organisation is an independent data controller in respect of certain personal data — see the For Schools and For Employer Partners sections below for further detail.

This Policy should be read in conjunction with our Safeguarding Policy and Terms and Conditions. If you are a student, you may find the For Students section at the bottom of this page easier to read — it covers the same information in simple terms. If you are a school or employer partner, please skip to the For Schools or For Employer Partners section at the bottom of this page.

As some of our Services are designed for users under the age of 18, we have designed this Policy and our Platform with the requirements of the ICO's Age Appropriate Design Code (the "Children's Code") in mind. Where our Services are likely to be accessed by users under 18, we apply high privacy settings by default and do not use personal data in ways that are detrimental to their wellbeing.

2. Who we are, our aims and objectives

Zero Gravity supports students into top universities and careers. Our mission is to democratise access to opportunity so that talented students can reach their potential, no matter their background. As part of that mission, we also use AI Services to support students throughout their school, university and career journeys (the “AI Services”).

Our ongoing commitment to our social mission means that we only share your personal data with third parties when required to deliver the Services (as defined below) and when compelled to do so by law.

For the purposes of this Policy, the term "Zero Gravity" refers to both Zero Gravity Tech Ltd (company number 12091675) and Zero Gravity Fund (charity number 1188177).

3. What is personal data?

"Personal data" is information relating to a living individual where the individual can be identified from the data, or the individual can be identified from that data combined with other information held by us (or likely to come into our possession).

This might include a name, address, telephone number, email address or photograph. It could also include identifiers such as an identification number or a pseudonym. It does not include anonymised data, where the identity has been permanently removed and cannot be matched back to an individual through other data held so that it is no longer possible to identify an individual.

4. What are special categories of data?

"Special categories of personal data" is data that includes more sensitive information about an individual. This might include information relating to an individual's racial or ethnic origin, physical or mental health, religion, or criminal offences.

5. What services does this Policy cover?

Our services include (without limitation) provision of our Platform, mentoring services, AI Services, provision of information about Zero Gravity, connecting members with universities, prospective employers and employment-based opportunities, provision of audiovisual content, text, photographs, advertising and other services which we may offer at or via the Platform (the "Services").

This Policy covers all of the Services and any reference to "you" or "your" means you as a user of our Services (e.g. visitors to our Platform, mentors, students, job applicants, etc.). This Policy applies to the collection and use of your personal data by us and parties that we use to deliver the Services (such as our processors, suppliers and sub-contractors).

Our AI Services use artificial intelligence technology provided by third-party providers to deliver personalised support and other AI-powered features. The underlying AI models are general-purpose models developed and trained by those providers on their own data; they are not trained on your personal data or on content you submit through our Services. When you use our AI Services, your interactions (including any text you type and any images you upload) are processed by AI systems at the point of generating a response. We are transparent about the use of AI in our Services and this Policy explains how your data is handled in that context.

6. What personal data does Zero Gravity collect?

What personal data we process about you depends on which of our Services you are using or providing. The sections below set out what we collect by user type and service.

All users

• your full name, salutation, title, address, postcode, email address, telephone number and profile picture;
• records of any consents you have given, together with the date and time, means of consent and any related information;
• information about your use of or delivery of Services, including details of the content you viewed on our Platform, how long you stayed and on which pages, and your engagement with features on the Platform;
• records of your interactions with our online advertising and content;
• IP address, cookie information, the type of device used to access the Platform, dates and times of your interactions with the Platform;
• your username, password and security login details;
• any views and opinions that you choose to send to us, or publicly post about us on social media platforms; and
• other personal data to ensure and check compliance with the Terms & Conditions and/or otherwise as required by law.

Students

• your school name, provided as a mandatory field at registration for all Young People using the Platform including those signing up directly rather than through a School Partner, and information about your school(s) attended, examination grades, work experience, extra-curricular activities, average grade, studied subjects and university ambitions;
• diversity-related data, including gender, race, ethnicity, and disability status, information about your socio-economic background, e.g. whether you have lived in care, have been a young carer, have refugee/asylum seeker status, would be or are the first in your family to go to university and/or have received free school meals;
• feedback from your Zero Gravity match, reviewing your session together, collected by surveys after each mentoring session; and
• in the event of a safeguarding issue, recordings of video mentoring sessions between relevant users.

Mentors (university students and professionals)

• records of your expertise, professional history, practising details and qualification details.

AI Services users

• where you use or register for our AI Services: your school name, subjects selected at sign-up (e.g. Maths, Physics), year group, examination board, current and target grades, and topics you find most challenging; images of examination or homework questions that you upload and the text extracted from those images; your session transcripts, feedback and helpfulness ratings, and practice question responses; and insights about your learning patterns, strengths and areas for improvement derived from your sessions, used to personalise future support. Our AI Services are designed for students studying GCSE, A-Level or IB qualifications — the qualification you select at registration is used as a signal that you are of an appropriate age to use the service without parental consent. Where you subscribe to a paid plan, we also collect your date of birth and postcode;

If you apply for roles through our employer partners

• where you apply for roles through our employer partners: your name, the role applied for, and your application stage and outcome (shared with us by the employer partner).

7. When and how do Zero Gravity collect information?

We (or our authorised third parties) collect personal data about you:

• when you register to receive or deliver Services, when you complete a written form stating that you would like further information about the Services, when you register on our Platform and/or when you request support from a mentor or deliver support as a mentor via our Platform;
• when you contact us with an enquiry or other feedback;
• when you provide personal data to us in person;
• in monitoring your use of the Services including (without limitation) communications sent by you via the Services;
• when you upload images (such as photographs of examination questions) to our AI Services, including via your device's camera or photo library;
• when you interact with our AI Services, including the text you type, any voice recordings or audio you submit, and the responses generated during your sessions;
• when we are checking compliance with the Terms & Conditions and/or otherwise as required by law;
• when you visit our Platform, including through the use of "cookies" and/or other devices (for full details, see our Cookie Notice);
• when you disclose your personal data to us in any other way or otherwise through the Services at any other point;
• in the ordinary course of our relationship with you; or
• from third-party suppliers who have confirmed to us that they are authorised to pass your personal data to us in accordance with your legal rights (e.g. schools, universities, local authorities, etc.).
• from our employer partners where you have applied for a role with them, and where they are authorised to share updates on your application status (e.g. name, stage, outcome) with us;

We may also combine personal data that you provide on one part of the Services with personal data collected from other parts of the Services and/or with publicly available information or personal data that we receive from other reputable and lawful sources. All personal data will be stored and used in accordance with this Policy.

8. Special categories of personal data

Where it becomes necessary to process your special categories of personal data for any reason, we rely on one of the following legal bases:

• Consent: We may process your special categories of personal data where we have, in accordance with applicable law, obtained your express consent prior to processing your special categories of personal data (this legal basis is only used in relation to processing that is entirely voluntary — it is not used for processing that is necessary or obligatory in any way);
• Compliance with applicable law: We may process your special categories of personal data where the processing is required or permitted by applicable law (e.g. to comply with our diversity reporting obligations);
• Detection and prevention of crime: We may process your special categories of personal data where the processing is necessary for the detection or prevention of crime (e.g. the prevention of fraud); or
• Establishment, exercise or defence of legal claims: We may process your special categories of personal data where the processing is necessary for the establishment, exercise or defence of legal claims.

If you provide special categories of personal data to us, you must ensure that it is lawful for you to disclose such data to us, and you must ensure a valid legal basis applies to the processing of those special categories of personal data.

9. Do we disclose your personal data to third parties?

We disclose your personal data for legitimate business purposes and the operation of our Platform or provision of our Services, in accordance with applicable law, including:

• where appropriate, to your appointed representatives authorised by us and acting on our behalf, such as our employees, contractors, suppliers and/or agents, including without limitation our customer care teams to administer the Services provided to you by us now or in the future, subject to the requirements noted below in this section;
• to accountants, auditors, consultants, lawyers and other outside professional advisors to Zero Gravity, subject to binding contractual obligations of confidentiality;
• where we have your consent to do so, for marketing communications, such as potential careers opportunities – where we share your personal data with prospective employers, we may be remunerated for this;
• as part of general, statistical information about the Services' user base, traffic volumes and related matters. These details will not include information personally identifying you;
• on an aggregated and anonymised basis for our own benchmarking, service improvement, marketing, and impact reporting to partners, funders and stakeholders;
• to relevant Higher Education providers and UCAS, where you have expressed an interest in a provider or for the purposes of social impact reporting. Providers may store your data on the Higher Education Access Tracker (HEAT), and once you leave school/college, your data will be sent to the Higher Education Statistics Agency (HESA). Your data will be stored on HEAT until you are aged 30, and if you enter university within this time, your data will be kept for an additional 15 years after you graduate;
• to any relevant third party provider, where our Platform uses third party advertising, plugins or content. If you choose to interact with any such advertising, plugins or content, your personal data may be shared with the relevant third-party provider. We recommend that you review that third party's privacy policy before interacting with its advertising, plugins or content;
• to any relevant third party acquirer(s) or successor(s) in title, in the event that we sell or transfer all or any relevant portion of our business or assets (including in the event of a reorganisation, dissolution or liquidation); and
• to the police, regulatory bodies or legal advisers in connection with any alleged or suspected criminal offence, unlawful activity or suspected breach of the Terms & Conditions and/or Safeguarding Policy or otherwise where required by law or where we suspect harm or potential harm to others. On request, we will cooperate with any law enforcement authorities, regulatory body, governmental authority or court for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. We shall not be obliged to give you any further notice of this.

We also share your personal data with the following categories of third-party service providers who act as data processors on our behalf:

• Anthropic, LLC (United States) — provides AI processing for certain AI Services. When you use these services, your messages and any images you upload are sent to Anthropic for processing. Anthropic may process this data in the United States and other jurisdictions where it maintains infrastructure. Anthropic processes this data solely on our instructions and is contractually prohibited from using it for any other purpose, including training its AI models.
• OpenAI (United States) — provides AI processing for certain AI Services. When you use these services, your inputs are sent to OpenAI for processing. OpenAI may process this data in the United States and other jurisdictions where it maintains infrastructure. OpenAI processes this data solely on our instructions and is contractually prohibited from using it for any other purpose, including training its AI model.
• Hosting and infrastructure providers — host the Platform and store your data securely.
• Analytics and performance monitoring providers.
• Error monitoring providers — identify and fix technical issues using limited technical data.
• Email delivery providers — used for transactional emails including safeguarding notifications

If we engage a third party processor to process your personal data, the processor will be subject to binding contractual obligations to: (i) only process the personal data in accordance with our prior written instructions; and (ii) use measures to protect the confidentiality and security of the personal data; together with any additional requirements under applicable law.

For the avoidance of doubt, contact details will not be shared between university and school students to ensure that neither party is personally identifiable through the Platform.

10. International data transfers

We may transfer personal data to other countries that may have different laws and data protection compliance requirements to those that apply in the country in which you are located.

In particular, when you use our AI Services, your personal data (including your messages and any images you upload) is transferred to Anthropic, LLC and/or OpenAI in the United States for processing. We may also use other service providers based outside the United Kingdom, including providers of hosting, analytics and error monitoring services.

If an exemption or derogation applies we may rely on that exemption or derogation, as appropriate. Where no exemption or derogation applies, and we transfer your personal data from the UK to recipients who are not located in jurisdictions that have been formally designated by the UK Government as providing an adequate level of protection fo

r personal data, we do so on the basis of Standard Contractual Clauses incorporating the UK Addendum (as issued under S119A of the Data Protection Act 2018). You are entitled to request a copy of our Standard Contractual Clauses using the contact details provided below.

For the purposes of this Section 10, "Standard Contractual Clauses" means the standard contractual clauses adopted by the European Commission, supplemented by the UK Addendum as approved by the UK Government.

11. Will I be sent marketing messages?

We will only send you information about our Services if you indicate that you wish to receive such messages (e.g. by “opting-in” by ticking a tick box). Where we have your consent or are otherwise permitted to do so, we may send you information by email, telephone (including SMS and MMS), mail or other methods of communication.

To stop receiving marketing communications from us, you can use the ‘unsubscribe’, ‘stop’ or similar facility contained in any such communication or you can email us at data@zerogravity.co.uk stating that you do not wish to receive further communications from us.

We do not pass or sell your personal information to third parties for any other purpose than as set out in this Policy. Unless you have given us your consent to pass your details to a third party, any marketing referred to in this section is conducted by us on our own behalf through authorised third parties assisting in the delivery of the Services.

12. How long will Zero Gravity store my personal data?

We take every reasonable step to ensure that your personal data is only processed for the minimum period necessary for the purposes set out in this Policy. Unless you request that we delete your personal data, we will keep your personal data only for as long as:

• subject to safeguarding obligations, we maintain an ongoing relationship with you (e.g. where you are a user of our Services, are acting as a mentor, etc.); or
• your personal data is necessary in connection with the lawful purposes set out in this Policy, for which we have a valid legal basis (e.g. where your personal data is included in a contract between us and your employer, and we have a legitimate interest in processing that data for the purposes of operating our business and fulfilling our obligations under that contract; or where we have a legal obligation to retain your personal data),

Plus the duration of:

• any applicable limitation period under applicable law (i.e. any period during which any person could bring a legal claim against us in connection with your personal data, or to which your personal data is relevant); and
• an additional two (2) month period following the end of such applicable limitation period (so that, if a person brings a claim at the end of the limitation period, we are still afforded a reasonable amount of time in which to identify any personal data that is relevant to that claim).

Where a user under 18 has registered for our Services directly (not through a School Partner) and has not logged in for a continuous period of two years, we will notify the user by email that their account and associated data will be deleted within 30 days unless they log in. If the user does not log in within that period, we will delete their account and all associated personal data, except for any safeguarding records which will be retained as required by law.

Video recordings taken for safeguarding purposes are retained for 7 years from the date of the relevant safeguarding concern, in line with Keeping Children Safe in Education (KCSIE) guidance.

If you are a school student and you have consented to Zero Gravity sending you direct marketing communications, we will generally retain your personal data for the period necessary to provide our services and to cover the period we expect that you may be in higher education and entering work, unless you consent to us retaining it for a longer period.

Specific retention periods for AI Services data and for school-provided data are set out in the For Students and For Schools sections below.

13. Cookies & similar devices

In addition, in common with many other online services, and subject always to obtaining your consent, where required in accordance with applicable law, we and our authorised third parties may use "cookies" and/or other tools to store and sometimes track information about you in accordance with our Cookie Notice.

14. Are my details safe?

We endeavour to take all reasonable steps to protect your personal data. We are careful to choose storage facilities that we have had assessed and which we are confident are suitably secure to store your information.

Where your data is processed by our AI Service providers (Anthropic, LLC and/or OpenAI), we ensure that appropriate technical and organisational measures are in place, including encryption in transit and contractual obligations regarding data security. Our AI Service providers' terms provide that data may be retained for a short period solely for safety purposes, after which it is deleted. They do not use your data for any other purpose, including training their AI models.

Zero Gravity has conducted a Data Protection Impact Assessment (DPIA) in respect of its AI Services, as required under Article 35 of the UK GDPR. This assessment is reviewed periodically and updated when there are material changes to our processing activities. A summary of the DPIA is available on request from our Data Protection Officer at data@zerogravity.co.uk.

Please always think carefully before disclosing personal data to other users of the Platform or otherwise making your information publicly available. It is important that you are aware that any information you disclose to another user of the Platform may then be disclosed by that user. We have no responsibility or control over the contents of communications made between users of our Services.

15. What are my rights?

Any personal information you supply will be treated in accordance with the UK GDPR.

We are committed to delivering the rights that individuals are entitled to under data protection laws in the UK. These are:

• the right to request access to, or a copy of, the personal data we hold about you, together with information regarding the nature, processing and disclosure of that personal data (this includes access to video recordings taken for safeguarding purposes);
• the right to object to your personal information being used for direct marketing. We will give you the ability to object to this, and where required, we will ensure we obtain your consent before undertaking marketing;
• the right to rectification. You may request that we rectify any inaccurate and/or complete any incomplete personal data;
• the right to information about automated decision-making. You have the right to be informed if your personal data is subject to automated decision-making, including profiling, which affects your use of our platform. This includes the right to: be informed about the processing of your data, request human intervention if you believe a decision has been made in error, express your point of view, and contest the decision;
• the right to withdraw consent. You may, as permitted by applicable law, withdraw your consent to the processing of your personal data at any time. Such withdrawal will not affect the lawfulness of processing based on your previous consent. Please note that if you withdraw your consent, you may not be able to benefit from certain service features for which the processing of your personal data is essential;
• the right of erasure. You may request that we erase your personal data and we will comply, unless there is a lawful reason for not doing so. For example, there may be an overriding legitimate ground for keeping your personal data, such as, a legal obligation that we have to comply with, including but not limited to safeguarding school students;
• the right to request, on legitimate grounds, the restriction of processing of your personal data;
• the right to data portability. In certain circumstances, you may request that we provide your personal data to you in a structured, commonly used and machine-readable format and have it transferred to another provider of the same or similar services to us. Where this right is applicable, we will comply with such transfer as far as it is technically feasible; and
• the right to lodge a complaint with the supervisory authority. We suggest that you contact us with any questions or if you have a complaint in relation to how we process your personal data. However, you do have the right to contact the relevant supervisory authority directly. To contact the Information Commissioner's Office in the United Kingdom, please visit the ICO website for instructions.

Subject to applicable law, you may also have the following additional rights regarding the processing of your personal data:

• the right to object, on grounds relating to your particular situation, to the processing of your personal data by us or on our behalf, where such processing is based on Articles 6(1)(e) (public interest) or 6(1)(f) (legitimate interests) of the GDPR; and
• the right to object to the processing of your personal data by us or on our behalf for direct marketing purposes.

This does not affect your statutory rights.

Automated decision-making in our AI Services: Our AI Services use AI to automatically identify the topic and difficulty level of questions you submit, to determine an appropriate coaching approach, and to filter responses through our safeguarding systems. These automated processes do not produce decisions that have legal or similarly significant effects on you. You may contact us at any time to understand more about how these automated processes work or to request that a human reviews any aspect of the service.

To exercise one or more of these rights, or to ask a question about these rights or any other provision of this Policy, or about our processing of your personal data, please use the contact details provided below. Please note that:

• in some cases it will be necessary to provide evidence of your identity before we can give effect to these rights; and
• where your request requires the establishment of additional facts (e.g. a determination of whether any processing is non-compliant with applicable law) we will investigate your request reasonably promptly, before deciding what action to take.

16. How can I change my details?

Where you register your details for certain Services and open a user account with us, you can then use that to access and log on to use those Services. You may change or update some of your details at any time via your account. If you are not registered for these Services but wish to update your details then please contact us at data@zerogravity.co.uk. You should please make sure that you update your details as soon as possible with all relevant changes.

17. Changes to this policy

We will notify you of significant changes by email or by a prominent notice on the Platform. For schools, any material changes affecting data processing arrangements will be communicated in writing.

18. How to contact us

If you would like to discuss any aspect of this Policy or the way Zero Gravity processes your information, please contact our Data Protection Officer.

Role: Data Protection Officer

Name: Elliot Little

Email: data@zerogravity.co.uk

If you find our response unsatisfactory, or you do not believe we are processing your personal data in accordance with the law, you have the right to contact the Information Commissioner's Office who can be contacted in writing at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or by telephone 0303 123 1113. Zero Gravity's registration number with the Information Commissioner's Office is ZB000749.

In addition to the information above, please read the section that relates to your role:

1. I'm a student

What is this page about?

When you use Zero Gravity — whether for mentoring, university applications, career support, or our AI Services — we collect information about you. This section explains: what information we collect, why we collect it, who can see it, how long we keep it, and what you can do if you have questions.

• What information do we collect?

  We collect different types of information depending on how you use Zero Gravity.

  When you register:

  • Your name, email address, school name (required for all young people), and login details
  • Your year group, subjects, exam board, and university ambitions

  If you choose to share it — optional diversity information:

  • Information about your background, such as whether you receive free school meals, are a young carer, have refugee status, or would be the first in your family to go to university. We use this to measure our social impact and report to funders — it helps us show that we are reaching the students who need us most. You do not have to share it.

  When you use mentoring:

  • Records of messages between you and your mentor
  • Video recordings of mentoring sessions (stored securely for safeguarding purposes)
  • Your feedback about your mentor after sessions

  When you use our AI Services:

  • Your current and target grades, and the topics you find most challenging
  • Photos of exam or homework questions you upload, and the text we read from them
  • Everything you type during your tutoring sessions, and the responses you receive
  • Your ratings and feedback after sessions, and your answers to practice questions
  • What the tutor learns about how you study — like topics you find hard or mistakes you keep making — so it can help you better next time

  When you apply for jobs through our employer partners:

  • Your name and the outcome of your application (shared with us by the employer)

     

  Why do we collect it?

  We collect this information so that: we can match you with the right mentor and deliver our services to you; our AI Services can give you personalised help based on what you’re studying; we can keep a record of your sessions so you can pick up where you left off; we can keep you safe (more on this below); and we can measure our social impact and improve the service for everyone.

   

  How do our AI Services work?

  When you type a question or upload a photo, it gets sent to our AI providers (including Anthropic, LLC) to generate your responses. These providers may process your data in the United States and other countries where they operate. Your messages are also checked by safety systems to make sure the conversation stays safe and appropriate. None of our AI providers use your data to train their AI.

  AI-generated responses and practice content are original, informed by examiner standards. Our AI Services are built with reference to publicly available exam specifications — they are not endorsed by or affiliated with any exam board.

   

  What happens to photos I upload?

  Please only upload photos of exam or homework questions — not photos that show personal information about you or anyone else.

   

  Marketing

  We will only send you marketing communications (like information about jobs or university opportunities) if you have opted in. You can unsubscribe at any time using the link in any email we send, or by emailing data@zerogravity.co.uk.

  How long do we keep your information?

  What we keep	How long
  Your account and profile data	Until you delete your account, or ask us to delete it
  Mentoring session messages	Until you delete your account, or ask us to delete them
  Video recordings of mentoring sessions	30 days (or longer if needed for a safeguarding investigation)
  Your tutoring session records	Until you delete your account, or ask us to delete them
  Photos you upload	Until you delete your account, or ask us to delete them
  Your learning profile (year group, exam board, grades)	Until you delete your account
  Safeguarding records	7 years — we are required by law to keep these

  Keeping you safe

  Our AI Services automatically check messages for signs that someone might be at risk of harm. If something is flagged: our Designated Safeguarding Lead is notified; if you're using the service through your school, your school's Designated Safeguarding Lead is also notified; and we keep a record of any concern for 7 years, as required by law.

  This is there to protect you — not to get you in trouble. If you’re going through something difficult, please talk to a trusted adult.

   

  Who can see your information?

  • Zero Gravity staff — only people who need access to run the service
  • Anthropic, LLC and/or OpenAI — to process your questions and generate responses (they cannot use your data for anything else, including training their AI models)
  • Your school’s staff — if you are using the service through your school, teachers and your school's Designated Safeguarding Lead can see your usage and any safeguarding flags

  • Nobody else — we do not sell your data or share it with anyone for advertising

     

  If you’re under 18 and using Zero Gravity through your school

  Your school set up your account and manages it on your behalf. To ask us to access, correct, or delete your information, please ask a teacher or your school’s data protection contact to get in touch with us at data@zerogravity.co.uk. We will respond within one month.

   

  If you’re under 18 and signed up yourself

  Our AI Services are designed for students studying GCSE, A-Level or IB qualifications. If you are under 13, you may only use Zero Gravity if your school has set up your account — in that case, your school is responsible for ensuring it has the appropriate authority (including parental consent where required) to provide your data to us. If you think we have collected data from someone under 13 without appropriate consent, please contact us at data@zerogravity.co.uk.

   

  If you’re 18 or over

  You can contact us directly at any time to see what information we hold about you, ask us to correct something, ask us to delete your information, or get a copy of your data. Email data@zerogravity.co.uk. We will respond within one month.

   

  Your school and your data

  If you access Zero Gravity through your school, your school also processes some of your personal data independently — for example, to set up your account and to respond to any safeguarding concerns. Your school and Zero Gravity are each independent data controllers, which means each of us is separately responsible for how we handle your data. Your school’s own privacy notice will tell you more about how it uses your data. If you have questions about your school’s use of your data, please contact your school directly.

   

  Your employer and your data

  If you have applied for a role through one of Zero Gravity’s employer partners, that employer may share information about your application with us — such as your name, the role you applied for, and your application outcome. Zero Gravity and the employer are each independent data controllers in respect of that data. The employer’s own privacy notice will tell you more about how it uses your data.

   

  Still have questions?

  Contact our Data Protection Officer: Elliot Little | data@zerogravity.co.uk | Zero Gravity Tech Ltd, 6th Floor One London Wall, London, EC2Y 5EB

  If you’re not happy with our response, you can also contact the Information Commissioner’s Office (ICO): ico.org.uk | 0303 123 1113

   

  2. I'm a school

   

  Your role as data controller

  When your organisation uses our Platform and AI Services for your students, you and Zero Gravity Tech Ltd are each independent data controllers. Each party independently determines the purposes for which it processes personal data and is independently responsible for complying with data protection law in respect of its own processing activities. You control the decision to provide student data to us and manage access within your organisation. Zero Gravity controls how the Platform and AI Services operate, including the data we collect during sessions, the AI providers we use, the safeguarding measures we apply, and how long we retain data.

  This arrangement is documented in our School Agreement, which includes a data sharing schedule setting out the categories of data shared between us, the purposes of sharing, and the obligations of both parties. If you do not yet have a signed School Agreement, please contact us before allowing students to access the service.

   

  What data we process

  When your students use our Platform and AI Services, we process the following categories of data in order to deliver those services:

  • Student names and school email addresses (provided by you at setup, or via Single Sign-On)
  • Registration data: postcode, date of birth, school name, and subjects selected at sign-up
  • Year group, exam board, current and target grades, and topics found most challenging
  • Images uploaded during sessions and the text extracted from those images
  • Session transcripts, feedback and helpfulness ratings, and practice question responses
  • Learning insights derived from sessions, used to personalise future support
  • Safeguarding flags generated by our monitoring systems

  We do not use this data for any purpose other than delivering our services. We do not use student data, or any exam board intellectual property, to train any AI model.

   

  How student accounts are set up

  You provision student accounts either through bulk upload (your IT administrator uploads a student roster) or Single Sign-On (SSO), whereby students authenticate via your school's Microsoft or Google account.

   

  What reporting you receive

  You have access to a teacher dashboard showing individual student usage and session activity, topic and subject performance data, and safeguarding flags (aggregated for DSL overview; individual flags visible to your DSL). Please ensure access is limited to staff with a legitimate need.

   

  Safeguarding

  Our AI Services include automated monitoring to detect content that may indicate a safeguarding concern. Where a concern is identified, it is flagged to Zero Gravity's DSL and made visible to your school's DSL via the teacher dashboard. Zero Gravity retains a log of the concern for 7 years in line with KCSIE. Your school remains responsible for following your own safeguarding procedures in response to any flag.

   

  Sub-processors

  By entering into our School Agreement, you authorise us to use the following sub-processors:

  Sub-processor	Location	Purpose
  Anthropic, LLC	United States (headquarters); processing may occur in other jurisdictions	AI model processing for certain AI Services
  OpenAI	United States (headquarters); processing may occur in other jurisdictions	AI model processing for certain AI Services
  Heroku	UK/Ireland	Platform hosting and infrastructure
  AppSignal	Netherlands	Application monitoring
  Sentry	United States	Error tracking

  We will notify you in advance of any intended changes to our sub-processor list. Any rights in relation to changes to our sub-processor list are set out in the School Agreement.

   

  Transfers of student personal data to Anthropic, LLC and/or OpenAI are made on the basis of Standard Contractual Clauses incorporating the UK Addendum. These providers may process data in the United States and other jurisdictions where they maintain infrastructure. You can request a copy from our Data Protection Officer at data@zerogravity.co.uk.

   

  Data retention and deletion

  Data type	Retention period
  Student account and profile data	Deleted within 30 days of the School Agreement ending, unless legally required to retain
  Tutoring session transcripts	Deleted within 30 days of the School Agreement ending, or on your written request
  Images uploaded by students	Deleted upon request or account deletion
  Safeguarding logs	7 years from the date of any incident (KCSIE). Cannot be deleted on request during this period.

  Your obligations as data controller

  As an independent controller, you are responsible for:

  • Ensuring you have a lawful basis to share student data with us
  • Informing students and parents/guardians about the use of our service
  • Ensuring your school's own privacy notice reflects the use of our service
  • Notifying us promptly if you become aware of a data breach
  • Managing access permissions for staff within the teacher dashboard

  • Conducting your own Data Protection Impact Assessment (DPIA) in respect of your decision to deploy our AI Services to students, where required by applicable data protection law

     

  Data subject rights

  Where a student, parent, or guardian submits a data subject rights request (for access, erasure, restriction, or otherwise) in connection with data processed through your school's use of our service, please submit that request to us on their behalf. We will respond within one month. Submit requests to data@zerogravity.co.uk.

   

  3. I'm an employer partner

   

  Your role as data controller

  When your organisation shares recruitment outcome data with Zero Gravity — such as the name of a candidate, the role they applied for, and their application stage or outcome — you and Zero Gravity are each independent data controllers in respect of that data. Each party is independently responsible for complying with data protection law in respect of its own processing activities.

   

  What data you share with us

  The only data we receive from employer partners in connection with recruitment is: the candidate's name, the role applied for, and their application stage and outcome.

   

  Why we use this data

  Zero Gravity uses recruitment progress data to deliver our service to students, to measure and evidence our social impact, and to improve our platform.

   

  Our legal basis

  Zero Gravity processes this data on the basis that it is necessary to perform our contract with students, or on the basis of our legitimate interest in measuring the effectiveness of our Services.

   

  Who we share this data with

  Recruitment outcome data may be shared on an aggregated and anonymised basis with funders, partners and stakeholders for impact reporting. Individual candidate data will not be shared with any third party in an identifiable form except where required by law.

   

  How long we keep this data

  Zero Gravity retains recruitment progress data for as long as we maintain an ongoing relationship with the relevant student as a Zero Gravity user, plus any applicable legal limitation period and an additional two months.

   

  Your obligations as data controller

  As an independent data controller, you are responsible for:

  • Ensuring you have a lawful basis to share candidate data with us
  • Ensuring your own privacy notice informs candidates that their application status may be shared with Zero Gravity

  Our use of this data is governed by the employer partner agreement.

4. I'm a university partner

Your role as data controller

When your organisation uses our Services to support student access, widening participation, or student success outcomes, you and Zero Gravity Tech Ltd are each independent data controllers. Each party independently determines the purposes for which it processes personal data and is independently responsible for complying with data protection law in respect of its own processing activities. This arrangement is documented in our University Agreement, which includes a data sharing schedule setting out the categories of data shared between us, the purposes of sharing, and the obligations of both parties. If you do not yet have a signed University Agreement, please contact us before allowing students to access the service.

What data we may share

The specific categories of personal data shared between Zero Gravity and university partners vary depending on the nature of the partnership. Data sharing may include one or more of the following, as set out in the applicable partnership agreement:

• Zero Gravity user data shared with you — such as identifiers, interest flags, event attendance, or engagement data — to support outreach, access, and widening participation activity
• Aggregate or anonymised outcome data shared with you — to support impact reporting, Access and Participation planning, or student success evaluation
• Aggregate outcome data shared by you with Zero Gravity — such as application, enrolment, continuation, awarding, or graduate outcomes data — to enable Zero Gravity to measure and evidence its social impact

Where person-level data is shared, this will be limited to the minimum necessary for the agreed purpose. The specific fields, purposes, lawful bases, retention periods, and safeguards applicable to your partnership are set out in your data sharing agreement with Zero Gravity.

Our legal basis

Zero Gravity processes personal data shared with university partners on the basis of its legitimate interests in delivering its services, measuring social impact, and improving its platform.

Your obligations as data controller

As an independent data controller, you are responsible for:

• Ensuring you have a lawful basis to share any personal data with Zero Gravity
• Ensuring your own privacy notice informs individuals that their data may be shared with Zero Gravity where relevant
• Complying with any obligations set out in your data sharing agreement with Zero Gravity

Data subject rights

If an individual submits a data subject rights request in connection with data shared under your partnership with Zero Gravity, please contact us at data@zerogravity.co.uk. We will respond within one month.