Privacy Policy

Your personal data is important to us and we aim to look after your personal data carefully in line with the latest data protection and privacy laws.

1. Introduction

In this Privacy Policy (the "Policy"), we have set out more detail on those laws and on what personal data we collect about you and how we use that personal data.

Please do read this Policy so you know what we are doing with your personal data.

We may update this Policy from time to time. We will post the current version on our website at www.zerogravity.co.uk, and we will notify you of significant changes by email or a prominent notice on the platform — see section 17. This Policy was last updated 3rd August 2026.

The rights of individuals are protected by the "UK GDPR" ((being the UK's implementation of the General Data Protection Regulation (Regulation EU) 2016/679) (the "GDPR")), and any amendments to it. These impose restrictions and controls over the way that Zero Gravity collects and uses personal data.

For the purpose of this Policy and the applicable data protection legislation, the controller of your personal data is Zero Gravity Tech Ltd (company number: 12091675), a private limited company incorporated in England with its registered office: 6th Floor One London Wall, London, England, EC2Y 5EB ("Zero Gravity", "we", "us" or "our"). Where you use our AI tutoring service through your school under a School Agreement, your school is the data controller of the personal data processed to deliver that service and Zero Gravity acts as your school's data processor, except for the limited purposes described in the For Schools section below. Where you access our Services through an Employer Partner, a university partner, or a School Partner mentoring arrangement, that organisation is an independent data controller in respect of certain personal data — see the For Schools and For Employer Partners sections below for further detail.

This Policy should be read in conjunction with our Safeguarding Policy and Terms and Conditions. If you are a student, you may find the For Students section at the bottom of this page easier to read — it covers the same information in simple terms. If you are a school or employer partner, please skip to the For Schools or For Employer Partners section at the bottom of this page.

As some of our Services are designed for users under the age of 18, we have designed this Policy and our Platform with the requirements of the ICO's Age Appropriate Design Code (the "Children's Code") in mind. Where our Services are likely to be accessed by users under 18, we apply high privacy settings by default and do not use personal data in ways that are detrimental to their wellbeing.

2. Who we are, our aims and objectives

Zero Gravity supports students to raise their attainment and progress into top universities and careers. Our mission is to democratise access to opportunity so that talented students can reach their potential, no matter their background. As part of that mission, we also use AI Services to support students’ learning and progress throughout their school, university and career journeys (the "AI Services").

Our ongoing commitment to our social mission means that we only share your personal data with third parties when required to deliver the Services (as defined below) and when compelled to do so by law.

For the purposes of this Policy, the term "Zero Gravity" refers to both Zero Gravity Tech Ltd (company number 12091675) and Zero Gravity Fund (charity number 1188177).

3. What is personal data?

"Personal data" is information relating to a living individual where the individual can be identified from the data, or the individual can be identified from that data combined with other information held by us (or likely to come into our possession).

This might include a name, address, telephone number, email address or photograph. It could also include identifiers such as an identification number or a pseudonym. It does not include anonymised data, where the identity has been permanently removed and cannot be matched back to an individual through other data held so that it is no longer possible to identify an individual.

4. What are special categories of data?

"Special categories of personal data" is data that includes more sensitive information about an individual. This might include information relating to an individual's racial or ethnic origin, physical or mental health, religion, or criminal offences.

5. What services does this Policy cover?

Our services include (without limitation) provision of our Platform, mentoring services, AI Services, provision of information about Zero Gravity, connecting members with universities, prospective employers and employment-based opportunities, provision of audiovisual content, text, photographs, advertising and other services which we may offer at or via the Platform (the "Services").

This Policy covers all of the Services and any reference to "you" or "your" means you as a user of our Services (e.g. visitors to our Platform, mentors, students, job applicants, etc.). This Policy applies to the collection and use of your personal data by us and parties that we use to deliver the Services (such as our processors, suppliers and sub-contractors).

Our AI Services use artificial intelligence technology provided by third-party providers to deliver personalised support and other AI-powered features. The underlying AI models are general-purpose models developed and trained by those providers on their own data; they are not trained on your personal data or on content you submit through our Services. When you use our AI Services, your interactions (including any text you type and any images you upload) are processed by AI systems at the point of generating a response. We are transparent about the use of AI in our Services and this Policy explains how your data is handled in that context.

6. What personal data does Zero Gravity collect?

What personal data we process about you depends on which of our Services you are using or providing. The sections below set out what we collect by user type and service.

All users

• your full name, salutation, title, address, postcode, email address, telephone number and profile picture;
• records of any consents you have given, together with the date and time, means of consent and any related information;
• information about your use of or delivery of Services, including details of the content you viewed on our Platform, how long you stayed and on which pages, and your engagement with features on the Platform;
• records of your interactions with our online advertising and content;
• IP address, cookie information, the type of device used to access the Platform, dates and times of your interactions with the Platform;
• your username, password and security login details;
• any views and opinions that you choose to send to us, or publicly post about us on social media platforms; and
• other personal data to ensure and check compliance with the Terms & Conditions and/or otherwise as required by law.

Students

• your school name — a mandatory field at registration for all Young People, however you sign up, used to check your eligibility for our mentoring platform and to contact your school's Designated Safeguarding Lead in the event of a safeguarding concern — plus information about your school(s) attended, examination grades, work experience, extra-curricular activities, average grade, studied subjects and university ambitions;
• information about your socio-economic background: whether you have lived in care, have been a young carer, have refugee/asylum status, would be or are the first in your family to go to university and/or have received free school meals, collected at registration and used to assess eligibility for our Services;
• optional diversity information like your ethnicity and whether you have a disability, which you can choose to share, used only to measure social impact and report to funders in aggregate;
• feedback from your Zero Gravity match, reviewing your session together, collected by surveys after each mentoring session; and
• in the event of a safeguarding issue, recordings of video mentoring sessions between relevant users.

Mentors (university students and professionals)

• records of your expertise, professional history, practising details and qualification details.

AI Services users

• where you use or register for our AI Services: your school name, subjects selected at sign-up (e.g. Maths, Physics), year group, examination board, current and target grades, and topics you find most challenging; images of examination or homework questions that you upload and the text extracted from those images; your session transcripts, feedback and helpfulness ratings, and practice question responses; and insights about your learning patterns, strengths and areas for improvement derived from your sessions, used to personalise future support. Our AI Services are designed for students in secondary education — the education level or qualification you select is used as a signal that you are of an appropriate age to use the service without parental consent. Where you subscribe to a paid plan, we also collect your date of birth and postcode.

If you apply for roles through our employer partners

• where you apply for roles through our employer partners: your name, the role applied for, and your application stage and outcome (shared with us by the employer partner).

7. When and how do Zero Gravity collect information?

We (or our authorised third parties) collect personal data about you:

• when you register to receive or deliver Services, when you complete a written form stating that you would like further information about the Services, when you register on our Platform and/or when you request support from a mentor or deliver support as a mentor via our Platform;
• when you contact us with an enquiry or other feedback;
• when you provide personal data to us in person;
• in monitoring your use of the Services including (without limitation) communications sent by you via the Services;
• when you upload images (such as photographs of examination questions) to our AI Services, including via your device's camera or photo library;
• when you interact with our AI Services, including the text you type, any voice recordings or audio you submit, and the responses generated during your sessions;
• when we are checking compliance with the Terms & Conditions and/or otherwise as required by law;
• when you visit our Platform, including through the use of "cookies" and/or other devices (for full details, see our Cookie Notice);
• when you disclose your personal data to us in any other way or otherwise through the Services at any other point;
• in the ordinary course of our relationship with you; or
• from third-party suppliers who have confirmed to us that they are authorised to pass your personal data to us in accordance with your legal rights (e.g. schools, universities, local authorities, etc.).
• from our employer partners where you have applied for a role with them, and where they are authorised to share updates on your application status (e.g. name, stage, outcome) with us;

We may also combine personal data that you provide on one part of the Services with personal data collected from other parts of the Services and/or with publicly available information or personal data that we receive from other reputable and lawful sources. All personal data will be stored and used in accordance with this Policy.

8. Special categories of personal data

Where it becomes necessary to process your special categories of personal data for any reason, we rely on the following conditions:

• Consent: for example, the optional diversity information you can choose to share with us at registration. We use this condition only for processing that is entirely voluntary — it is never used for processing that is necessary or required in any way — and you can withdraw your consent at any time;
• Safeguarding of children and of individuals at risk: where information about health or wellbeing is revealed during your use of our Services and we process it to protect you or someone else;
• Detection and prevention of crime: where the processing is necessary for the detection or prevention of crime (e.g. the prevention of fraud); and
• Establishment, exercise or defence of legal claims: where the processing is necessary for the establishment, exercise or defence of legal claims.

If you provide special categories of personal data to us about someone else, you must ensure that it is lawful for you to disclose it and that a valid legal basis applies. Where you share your own information with us, we will only process it as set out in this Policy.

9. Do we disclose your personal data to third parties?

We disclose your personal data for legitimate business purposes and the operation of our Platform or provision of our Services, in accordance with applicable law, including:

• where appropriate, to your appointed representatives authorised by us and acting on our behalf, such as our employees, contractors, suppliers and/or agents, including without limitation our customer care teams to administer the Services provided to you by us now or in the future, subject to the requirements noted below in this section;
• to accountants, auditors, consultants, lawyers and other outside professional advisors to Zero Gravity, subject to binding contractual obligations of confidentiality;
• where we have your consent to do so, for marketing communications, such as potential careers opportunities – where we share your personal data with prospective employers, we may be remunerated for this;
• as part of general, statistical information about the Services' user base, traffic volumes and related matters. These details will not include information personally identifying you;
• on an aggregated and anonymised basis for our own benchmarking, service improvement, marketing, and impact reporting to partners, funders and stakeholders;
• to relevant Higher Education providers and UCAS, where you have expressed an interest in a provider or for the purposes of social impact reporting. Providers may store your data on the Higher Education Access Tracker (HEAT), and once you leave school/college, your data will be sent to the Higher Education Statistics Agency (HESA). Your data will be stored on HEAT until you are aged 30, and if you enter university within this time, your data will be kept for an additional 15 years after you graduate;
• to any relevant third party provider, where our Platform uses third party advertising, plugins or content. If you choose to interact with any such advertising, plugins or content, your personal data may be shared with the relevant third-party provider. We recommend that you review that third party's privacy policy before interacting with its advertising, plugins or content;
• to any relevant third party acquirer(s) or successor(s) in title, in the event that we sell or transfer all or any relevant portion of our business or assets (including in the event of a reorganisation, dissolution or liquidation);
• to the Designated Safeguarding Lead at your school where we have a safeguarding concern about you, whether you access our Services through your school or signed up directly; and
• to the police, regulatory bodies or legal advisers in connection with any alleged or suspected criminal offence, unlawful activity or suspected breach of the Terms & Conditions and/or Safeguarding Policy or otherwise where required by law or where we suspect harm or potential harm to others. On request, we will cooperate with any law enforcement authorities, regulatory body, governmental authority or court for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. We shall not be obliged to give you any further notice of this.

We also share your personal data with the following third-party service providers who act as data processors on our behalf:

• Anthropic (United States) — provides AI processing for certain AI Services. When you use these services, your messages and any images you upload are sent to Anthropic for processing. Anthropic may process this data in the United States. Anthropic processes this data solely on our instructions and is contractually prohibited from using it for any other purpose, including training its AI models.
• OpenAI (United States) — provides AI processing for certain AI Services. When you use these services, your inputs are sent to OpenAI for processing. OpenAI may process this data in the United States. OpenAI processes this data solely on our instructions and is contractually prohibited from using it for any other purpose, including training its AI models.
• Google (United States) — provides AI processing (Gemini models) for certain AI Services. When you use these services, your inputs are sent to Google for processing. Google may process this data in the United States. Google processes this data solely on our instructions and is contractually prohibited from using it for any other purpose, including training its AI models.
• Mathpix (United States) — reads the text from images of examination or homework questions uploaded to our AI Services (optical character recognition). Mathpix processes this content solely as necessary to deliver the service and does not use it for its own purposes, including training its models.
• Hosting and infrastructure providers — Heroku (a Salesforce service) and Amazon Web Services host the Platform and store your data securely. Primary application data and databases are hosted in UK/EU regions only; encrypted backups are replicated to a US region for disaster recovery purposes only. Cloudflare provides content delivery and security services.
• Analytics and application monitoring providers — including AppSignal (Netherlands), which monitors the performance and reliability of our applications using operational, diagnostic and error data, with personal data exposure minimised by design.
• Error monitoring providers — Sentry (United States) identifies and fixes technical issues using limited technical data.
• Payment providers — Payhawk (UK/EU) is used to administer and deliver scholarships, and similar payments, with access limited to the details needed to make the payment.
• Support messaging providers — Intercom is used to provide user support, with access limited to the data necessary to provide that support.
• Communications providers — Twilio (United States) is used to deliver communications such as SMS notifications.
• Email delivery providers — Postmark (ActiveCampaign) is used for transactional emails, including logins, invites, notifications and safeguarding notifications.

If we engage a third party processor to process your personal data, the processor will be subject to binding contractual obligations to: (i) only process the personal data in accordance with our prior written instructions; and (ii) use measures to protect the confidentiality and security of the personal data; together with any additional requirements under applicable law.

For the avoidance of doubt, contact details will not be shared between university and school students to ensure that neither party is personally identifiable through the Platform.

10. International data transfers

We may transfer personal data to other countries that may have different laws and data protection compliance requirements to those that apply in the country in which you are located.

In particular, when you use our AI Services, your personal data (including your messages and any images you upload) is transferred to Anthropic, OpenAI and/or Google in the United States for processing, and images you upload are processed by Mathpix in the United States. We also use other service providers based outside the United Kingdom, including providers of hosting, analytics, error monitoring, support messaging, email delivery and content delivery services.

If an exemption or derogation applies we may rely on that exemption or derogation, as appropriate. Where no exemption or derogation applies, and we transfer your personal data from the UK to recipients who are not located in jurisdictions that have been formally designated by the UK Government as providing an adequate level of protection for personal data, we do so on one of the following bases:

• Standard Contractual Clauses incorporating the UK Addendum (as issued under S119A of the Data Protection Act 2018) — used for transfers to Anthropic and OpenAI, for encrypted disaster-recovery backups replicated by our hosting provider to the United States, and for other providers that do not hold a Data Bridge certification. For each such transfer we carry out and document a transfer risk assessment before personal data is first transferred, and we keep those assessments under review; or
• The UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge") — used for transfers to providers holding a current certification, including Google, Intercom, Postmark (ActiveCampaign), Cloudflare, Mathpix, Sentry and Twilio.

Transfers to providers in the European Economic Area (such as AppSignal in the Netherlands) are made under the UK's adequacy regulations for the EEA. Our primary application data and databases are hosted in UK/EU regions only.

You are entitled to request a copy of our Standard Contractual Clauses using the contact details provided below.

For the purposes of this Section 10, "Standard Contractual Clauses" means the standard contractual clauses adopted by the European Commission, supplemented by the UK Addendum as approved by the UK Government.

11. Will I be sent marketing messages?

We will only send you information about our Services if you indicate that you wish to receive such messages (e.g. by "opting-in" by ticking a tick box). Where we have your consent or are otherwise permitted to do so, we may send you information by email, telephone (including SMS and MMS), mail or other methods of communication.

To stop receiving marketing communications from us, you can use the 'unsubscribe', 'stop' or similar facility contained in any such communication or you can email us at data@zerogravity.co.uk stating that you do not wish to receive further communications from us.

We do not pass or sell your personal information to third parties for any other purpose than as set out in this Policy. Unless you have given us your consent to pass your details to a third party, any marketing referred to in this section is conducted by us on our own behalf through authorised third parties assisting in the delivery of the Services.

12. How long will Zero Gravity store my personal data?

We take every reasonable step to ensure that your personal data is only processed for the minimum period necessary for the purposes set out in this Policy. Unless you request that we delete your personal data, we will keep your personal data only for as long as:

• subject to safeguarding obligations, we maintain an ongoing relationship with you (e.g. where you are a user of our Services, are acting as a mentor, etc.); or
• your personal data is necessary in connection with the lawful purposes set out in this Policy, for which we have a valid legal basis (e.g. where your personal data is included in a contract between us and your employer, and we have a legitimate interest in processing that data for the purposes of operating our business and fulfilling our obligations under that contract; or where we have a legal obligation to retain your personal data),

Plus the duration of:

• any applicable limitation period under applicable law (i.e. any period during which any person could bring a legal claim against us in connection with your personal data, or to which your personal data is relevant); and
• an additional two (2) month period following the end of such applicable limitation period (so that, if a person brings a claim at the end of the limitation period, we are still afforded a reasonable amount of time in which to identify any personal data that is relevant to that claim).

We do not automatically delete inactive accounts. We retain your account and personal data to provide our Services and to measure our long-term social impact, covering the period we expect you may be in higher education and entering work. You can ask us to delete your account and data at any time (except safeguarding records, which we retain as described in this section).

Video recordings taken for safeguarding purposes are retained in line with our safeguarding records retention schedule (currently 10 years from the date of the safeguarding concern), having regard to Keeping Children Safe in Education (KCSIE) statutory guidance.

If you are a school student and you have consented to Zero Gravity sending you direct marketing communications, we will generally retain your personal data for the period necessary to provide our services and to cover the period we expect that you may be in higher education and entering work, unless you consent to us retaining it for a longer period.

Specific retention periods for AI Services data and for school-provided data are set out in the For Students and For Schools sections below.

13. Cookies & similar devices

In addition, in common with many other online services, and subject always to obtaining your consent, where required in accordance with applicable law, we and our authorised third parties may use "cookies" and/or other tools to store and sometimes track information about you in accordance with our Cookie Notice.

14. Are my details safe?

We endeavour to take all reasonable steps to protect your personal data. We are careful to choose storage facilities that we have had assessed and which we are confident are suitably secure to store your information.

Zero Gravity is certified to ISO/IEC 27001:2022 (information security management) and ISO 9001:2015 (quality management) and holds Cyber Essentials Plus. Personal data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Primary application data and databases are hosted in UK/EU regions only; encrypted backups are replicated to a US region for disaster recovery purposes only. Access to personal data is role-based and limited to the minimum necessary, multi-factor authentication is enforced for Zero Gravity personnel, and we commission regular independent penetration testing of the Platform.

Where your data is processed by our AI Service providers (Anthropic, OpenAI and/or Google), we ensure that appropriate technical and organisational measures are in place, including encryption in transit and contractual obligations regarding data security. Our AI Service providers' terms provide that data may be retained for a short period solely for safety purposes, after which it is deleted. They do not use your data for any other purpose, including training their AI models.

Zero Gravity has conducted a Data Protection Impact Assessment (DPIA) in respect of its AI Services, as required under Article 35 of the UK GDPR. This assessment is reviewed annually and updated when there are material changes to our processing activities. A summary of the DPIA is available on request from our Data Protection Officer at data@zerogravity.co.uk.

Please always think carefully before disclosing personal data to other users of the Platform or otherwise making your information publicly available. It is important that you are aware that any information you disclose to another user of the Platform may then be disclosed by that user. We have no responsibility or control over the contents of communications made between users of our Services.

15. What are my rights?

Any personal information you supply will be treated in accordance with the UK GDPR.

We are committed to delivering the rights that individuals are entitled to under data protection laws in the UK. These are:

• the right to request access to, or a copy of, the personal data we hold about you, together with information regarding the nature, processing and disclosure of that personal data (this includes access to video recordings taken for safeguarding purposes);
• the right to object to your personal information being used for direct marketing. We will give you the ability to object to this, and where required, we will ensure we obtain your consent before undertaking marketing;
• the right to rectification. You may request that we rectify any inaccurate and/or complete any incomplete personal data;
• the right to information about automated decision-making. You have the right to be informed if your personal data is subject to automated decision-making, including profiling, which affects your use of our platform. This includes the right to: be informed about the processing of your data, request human intervention if you believe a decision has been made in error, express your point of view, and contest the decision;
• the right to withdraw consent. You may, as permitted by applicable law, withdraw your consent to the processing of your personal data at any time. Such withdrawal will not affect the lawfulness of processing based on your previous consent. Please note that if you withdraw your consent, you may not be able to benefit from certain service features for which the processing of your personal data is essential;
• the right of erasure. You may request that we erase your personal data and we will comply, unless there is a lawful reason for not doing so. For example, there may be an overriding legitimate ground for keeping your personal data, such as, a legal obligation that we have to comply with, including but not limited to safeguarding school students;
• the right to request, on legitimate grounds, the restriction of processing of your personal data;
• the right to data portability. In certain circumstances, you may request that we provide your personal data to you in a structured, commonly used and machine-readable format and have it transferred to another provider of the same or similar services to us. Where this right is applicable, we will comply with such transfer as far as it is technically feasible; and
• the right to lodge a complaint with the supervisory authority. We suggest that you contact us with any questions or if you have a complaint in relation to how we process your personal data. However, you do have the right to contact the relevant supervisory authority directly. To contact the Information Commissioner's Office in the United Kingdom, please visit the ICO website for instructions.

Subject to applicable law, you may also have the following additional rights regarding the processing of your personal data:

• the right to object, on grounds relating to your particular situation, to the processing of your personal data by us or on our behalf, where such processing is based on Articles 6(1)(e) (public interest) or 6(1)(f) (legitimate interests) of the GDPR; and
• the right to object to the processing of your personal data by us or on our behalf for direct marketing purposes.

This does not affect your statutory rights.

Automated decision-making in our AI Services: Our AI Services use AI to automatically identify the topic and difficulty level of questions you submit, to determine an appropriate coaching approach, and to filter responses through our safeguarding systems. These automated processes do not produce decisions that have legal or similarly significant effects on you. You may contact us at any time to understand more about how these automated processes work or to request that a human reviews any aspect of the service.

To exercise one or more of these rights, or to ask a question about these rights or any other provision of this Policy, or about our processing of your personal data, please use the contact details provided below. Please note that:

• in some cases it will be necessary to provide evidence of your identity before we can give effect to these rights; and
• where your request requires the establishment of additional facts (e.g. a determination of whether any processing is non-compliant with applicable law) we will investigate your request reasonably promptly, before deciding what action to take.

16. How can I change my details?

Where you register your details for certain Services and open a user account with us, you can then use that to access and log on to use those Services. You may change or update some of your details at any time via your account. If you are not registered for these Services but wish to update your details then please contact us at data@zerogravity.co.uk. You should please make sure that you update your details as soon as possible with all relevant changes.

17. Changes to this policy

We will notify you of significant changes by email or by a prominent notice on the Platform. For schools, any material changes affecting data processing arrangements will be communicated in writing.

18. How to contact us

If you would like to discuss any aspect of this Policy or the way Zero Gravity processes your information, please contact our Data Protection Officer.

Role: Data Protection Officer

Name: Hannah Mills

Email: data@zerogravity.co.uk

If you find our response unsatisfactory, or you do not believe we are processing your personal data in accordance with the law, you have the right to contact the Information Commissioner's Office who can be contacted in writing at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or by telephone 0303 123 1113. Zero Gravity's registration number with the Information Commissioner's Office is ZB000749.

In addition to the information above, please read the section that relates to your role:

1. I'm a student

What is this page about?

When you use Zero Gravity — whether for mentoring, university applications, career support, or our AI Services — we collect information about you. This section explains: what information we collect, why we collect it, who can see it, how long we keep it, and what you can do if you have questions.

What information do we collect?

We collect different types of information depending on how you use Zero Gravity.

When you register:

• Your name, email address, school name (required for all young people), and login details
• Your year group, subjects, exam board, and university ambitions
• Whether you receive free school meals, are a young carer/have spent time in care, have refugee status, or would be the first in your family to go to university. We use this information to determine eligibility — it helps us ensure that we are reaching the students who need us most.

If you choose to share it — optional diversity information:

• Information about your ethnic background and whether you have a disability. We use this to measure our social impact and report to funders. You do not have to share it.

When you use mentoring:

• Records of messages between you and your mentor
• Video recordings of mentoring sessions (stored securely for safeguarding purposes)
• Your feedback about your mentor after sessions

When you use our AI Services:

• Your current and target grades, and the topics you find most challenging
• Photos of exam or homework questions you upload, and the text we read from them
• Everything you type during your tutoring sessions, and the responses you receive
• Your ratings and feedback after sessions, and your answers to practice questions
• What the tutor learns about how you study — like topics you find hard or mistakes you keep making — so it can help you better next time

When you apply for jobs through our employer partners:

• Your name and the outcome of your application (shared with us by the employer)

Why do we collect it?

We collect this information so that: we can match you with the right mentor and deliver our services to you; our AI Services can give you personalised help based on what you're studying; we can keep a record of your sessions so you can pick up where you left off; we can keep you safe (more on this below); and we can measure our social impact and improve the service for everyone.

How do our AI Services work?

When you type a question or upload a photo, it is processed by the specialist AI providers we use to run the service — they may process your data outside the UK, including in the United States (our providers are listed in section 9, and section 10 explains the safeguards). Safety systems also check messages to make sure conversations stay safe and appropriate. None of our providers use your data to train their AI.

AI-generated responses and practice content are original, informed by examiner standards. Our AI Services are built with reference to publicly available exam specifications — they are not endorsed by or affiliated with any exam board.

What happens to photos I upload?

Please only upload photos of exam or homework questions — not photos that show personal information about you or anyone else.

Marketing

We will only send you marketing communications (like information about jobs or university opportunities) if you have opted in. You can unsubscribe at any time using the link in any email we send, or by emailing data@zerogravity.co.uk.

How long do we keep your information?

If you use Zero Gravity through your school, your school decides how long we keep your information — see the For Schools section. When your school's agreement with us ends, we return or delete the information we processed for your school within 30 days (except safeguarding records, which the law requires us to keep).

Keeping you safe

Our AI Services automatically check messages for signs that someone might be at risk of harm. If a safeguarding concern is flagged: our Designated Safeguarding Lead is notified; if you're using the service through your school, your school's Designated Safeguarding Lead is also notified. If you signed up directly, we may still contact your school's Designated Safeguarding Lead about a serious concern — this is why we ask for your school name when you register.

This is there to protect you — not to get you in trouble. If you're going through something difficult, please talk to a trusted adult.

Who can see your information?

• Zero Gravity staff — only people who need access to run the service
• Anthropic, OpenAI and/or Google — to process your questions and generate responses (they cannot use your data for anything else, including training their AI models)
• Mathpix — only to read the text in photos you upload
• Your school's staff — if you are using the service through your school, teachers and your school's Designated Safeguarding Lead can see your usage and any safeguarding flags. If you signed up directly, your school's Designated Safeguarding Lead may be contacted where we have a safeguarding concern about you — they do not otherwise see your usage.

Nobody else — we do not sell your data or share it with anyone for advertising.

If you’re under 18 and using Zero Gravity through your school

Your school set up your account and manages it on your behalf. To ask us to access, correct, or delete your information, please ask a teacher or your school's data protection contact to get in touch with us at data@zerogravity.co.uk. We will respond within one month.

If you’re under 18 and signed up yourself

Our AI Services are designed for students studying GCSE, A-Level or IB qualifications. If you are under 13, you may only use Zero Gravity if your school has set up your account — in that case, your school is responsible for ensuring it has the appropriate authority (including parental consent where required) to provide your data to us. If you think we have collected data from someone under 13 without appropriate consent, please contact us at data@zerogravity.co.uk.

If you’re 18 or over

You can contact us directly at any time to see what information we hold about you, ask us to correct something, ask us to delete your information, or get a copy of your data. Email data@zerogravity.co.uk. We will respond within one month.

Your school and your data

If your school referred you to our mentoring platform, it gave us your name, school email address and graduation year so we could invite you to join. Your school is responsible for its decision to share those details; once you join, your membership is with Zero Gravity, and we are responsible for your data from then on.

If you use our AI tutoring service through your school, your school decided to provide the service to you and is the data controller for the information processed to deliver it. Zero Gravity processes that information on your school's behalf and on its instructions. For a few limited purposes — keeping safeguarding records, keeping the platform secure, and (if you later sign up to Zero Gravity yourself) running your own account — Zero Gravity is responsible for your data in its own right. Your school's own privacy notice will tell you more about how it uses your data. If you have questions about your school's use of your data, please contact your school directly.

Your employer and your data

If you have applied for a role through one of Zero Gravity's employer partners, that employer may share information about your application with us — such as your name, the role you applied for, and your application outcome. Zero Gravity and the employer are each independent data controllers in respect of that data. The employer's own privacy notice will tell you more about how it uses your data.

Still have questions?

Contact our Data Protection Officer: Hannah Mills | data@zerogravity.co.uk | Zero Gravity Tech Ltd, 6th Floor One London Wall, London, EC2Y 5EB

If you're not happy with our response, you can also contact the Information Commissioner's Office (ICO): ico.org.uk | 0303 123 1113

2. I'm a school

Zero Gravity provides schools with two distinct services, and your data protection relationship with us differs between them:

• Part A — the Zero Gravity mentoring platform (School Partner Hub): you refer students to our mentoring and opportunities platform. You and Zero Gravity are each independent data controllers.
• Part B — Zero Gravity Tutor: we provide AI tutoring to your pupils under a School Agreement and an Article 28 Data Processing Agreement. You are the data controller and Zero Gravity is your data processor.

If your school uses both services, both parts apply — each to the data processed for that service.

Part A — The Zero Gravity mentoring platform (School Partner Hub)

Your role and ours: independent controllers

When your organisation refers students to the Zero Gravity mentoring platform through the School Partner Hub, you share their basic details with us so that we can invite them to join. Students who join then hold their own Zero Gravity accounts under our terms and this Policy. This means you and Zero Gravity Tech Ltd are each independent data controllers: you are responsible for your decision to share student details with us (and for having a lawful basis to do so), and Zero Gravity is responsible for everything we do with students' data once they join — including the data collected at and after registration, mentor matching, the safeguarding measures we apply, and how long we retain data. This is not a processor or joint-controller arrangement — each party is separately responsible for complying with data protection law in respect of its own processing.

What data you share with us

• Student first name, last name, school email address and graduation year — provided via the secure Zero Gravity data portal and/or an encrypted, password-protected file.

Once a student registers, they provide further information to us directly (profile and education details, optional diversity information, mentoring messages, session recordings and feedback). We process that data as controller, as described in the main sections of this Policy and the For Students section.

Safeguarding on the mentoring platform

Mentoring sessions are subject to safeguarding measures, including automated moderation of session content, video recordings retained for safeguarding purposes (30 days, or up to 10 years where required for an investigation), and notification of your Designated Safeguarding Lead where a concern relates to a student at your school. Records of safeguarding cases are retained for 10 years in line with KCSIE statutory guidance.

Sub-processors (mentoring platform)

International transfers (mentoring platform)

Where student data is transferred outside the UK, we use the transfer mechanism identified for each provider above, as described in Section 10. Under our Partner Hub Agreement, our default is UK/EEA storage, and any storage outside the UK/EEA is subject to appropriate safeguards.

Retention and deletion (mentoring platform)

Data you share with us is retained while the student maintains an active relationship with Zero Gravity, or until they enter higher education and employment, unless they consent to longer retention. Students (or you on their behalf) can request deletion at any time. On termination of your Partner Hub Agreement, data you provided will be securely deleted within 30 days. On request, we will provide reasonable evidence of deletion sufficient to demonstrate compliance.

Your obligations as an independent controller

• Ensuring you have a lawful basis to share student data with us, including obtaining and retaining proof of consent where required
• Informing students (and parents/guardians where appropriate) about the referral, and reflecting it in your own privacy notice
• Keeping the data you share with us accurate, and telling us promptly about corrections
• Notifying us promptly if you become aware of a data breach affecting shared data

Data subject rights (mentoring platform)

Students hold their own accounts and can exercise their rights directly with us at data@zerogravity.co.uk; you may also submit requests on a student's behalf. We respond within one month.

Part B — Zero Gravity Tutor (AI tutoring under a School Agreement)

Our roles: you are the controller, we are your processor

When your school (or trust) uses the Zero Gravity Tutor platform for your pupils under a School Agreement, you are the data controller and Zero Gravity is your data processor for the personal data processed to deliver and evaluate the service ("School Data"). This includes the data you provide to us and the data generated through pupils' use of the service (accounts, tutoring session content and transcripts, usage and progress data).

This relationship is documented in a Data Processing Agreement made pursuant to Article 28 of the UK GDPR, which forms part of your School Agreement. Under it, Zero Gravity:

• processes School Data only on your documented instructions, including in respect of international transfers;
• does not use School Data for marketing, advertising or commercial profiling, and does not use School Data — or any personal data derived from it — to train or improve any AI or machine learning model;
• ensures everyone authorised to process School Data is bound by confidentiality and receives data protection training;
• maintains the technical and organisational security measures set out in the agreement (see "Security" below);
• assists you with data subject rights requests and with your obligations on security, breach notification, DPIAs and prior consultation;
• notifies you without undue delay of any personal data breach affecting School Data, providing the information required by Article 33(3) UK GDPR, and will not notify the ICO or data subjects on your behalf without your prior written approval (except where required by law); and
• makes available the information needed to demonstrate compliance, including audit rights — in the first instance through our certifications (ISO/IEC 27001:2022, Cyber Essentials Plus, ISO 9001:2015) and recent penetration test summaries, with inspections available where those do not resolve your enquiry.

If you do not yet have a signed School Agreement, please contact us before allowing students to access the service.

Where Zero Gravity is a controller in its own right

For a small number of purposes, Zero Gravity processes personal data as an independent controller rather than as your processor:

• Safeguarding records — we retain records of safeguarding concerns for 10 years from the date of the concern, in line with KCSIE statutory guidance, notwithstanding any deletion instruction. Where we reasonably believe a child is at imminent risk of serious harm, we may report a concern directly to the police, children's social care or another appropriate authority, informing your Designated Safeguarding Lead as soon as practicable unless doing so would increase the risk to the child.
• Platform security and administration — security logging, fraud and abuse prevention, service diagnostics and compliance with legal obligations addressed to Zero Gravity, using the minimum personal data necessary and kept logically separate from School Data.
• Pupils who join Zero Gravity directly — if a pupil chooses, after the end of your agreement or otherwise outside its scope, to register as an individual user of Zero Gravity's consumer platform, that new relationship is governed by this Policy, with appropriate age assurance and parental involvement where required. School Data does not transfer to the consumer platform except on your documented instruction.
• Longitudinal outcome evaluation (where applicable) — matching of pupil records against national outcome datasets (including UCAS data and the Department for Education's Longitudinal Education Outcomes (LEO) dataset) to evaluate long-term impact on pupil outcomes and widening participation, using only pupil name, date of birth, unique pupil identifier and postcode to the extent necessary. No such matching will begin until the required lawful basis assessment, dataset access permissions, transparency information and retention period are in place.

Where Zero Gravity acts as controller, we comply with data protection law in that capacity, including providing transparency information to the individuals concerned.

Your school's use of the mentoring platform is covered separately in Part A above.

What data we process on your behalf

When your pupils use the Tutor platform, we process the following categories of School Data in order to deliver the service:

• Pupil full name, date of birth, unique pupil identifier and postcode
• Year group/class, prior attainment, and free school meals / Pupil Premium status
• School name, subjects selected, exam board, current and target grades, and topics found most challenging
• Platform account and usage data
• Tutoring session content and transcripts, images uploaded during sessions and the text extracted from those images, feedback and helpfulness ratings, and practice question responses
• Learning insights derived from sessions, used to personalise future support
• Safeguarding flags generated by our monitoring systems
• Participating teachers' and staff members' names, professional contact details and account data

Special category data: safeguarding and wellbeing data may be generated during tutoring through our safeguarding risk detection (and may exceptionally include health data or other special category data revealed by a pupil in session content, or information concerning criminal allegations). This is not part of the data you share with us as input. We process it in reliance on Article 9(2)(g) UK GDPR with DPA 2018 Schedule 1 Part 2 paragraph 18 (safeguarding of children and individuals at risk), and the applicable Schedule 1 condition for any criminal-offence data.

We do not use this data for any purpose other than delivering our services. We do not use student data, or any exam board intellectual property, to train any AI model.

How student accounts are set up

Pupil accounts may be provisioned through MIS/API integration (for example Bromcom or Arbor), bulk upload (your IT administrator uploads a student roster), or Single Sign-On (SSO), whereby students authenticate via your school's Microsoft or Google account. School Data must be transferred to us only by the secure methods agreed between us (MIS/API integration, the Platform, or encrypted and password-protected files).

What reporting you receive

You have access to a teacher dashboard showing individual student usage and session activity, topic and subject performance data, and safeguarding flags (aggregated for DSL overview; individual flags visible to your DSL). Please ensure access is limited to staff with a legitimate need.

The Platform's outputs — including progress insight, misconception analysis and suggested teaching actions — are advisory. They support, but do not replace, the professional judgment of teachers and school staff. The Platform does not make decisions producing legal or similarly significant effects on pupils based solely on automated processing.

Safeguarding

All Zero Gravity Tutor interactions are subject to automated content moderation and safeguarding-signal detection, including a tiered protocol for indicators of distress, self-harm, abuse or crisis, as outlined in our Safeguarding Policy. Where Zero Gravity Tutor is deployed to students through a school partnership, you will receive safeguarding alerts generated by the Tutor directly to your nominated DSL through the Platform. Records of safeguarding cases are retained for 10 years in line with KCSIE statutory guidance.

Sub-processors (Tutor)

By entering into our School Agreement, you authorise us to use the following sub-processors:

We impose on each sub-processor, by written contract, data protection obligations equivalent to those in our agreement with you, and we remain fully liable to you for each sub-processor's performance. Pupil data submitted to the large language model providers listed above is not used to train or improve those providers' models.

We will give you at least 14 days' notice of any intended addition or replacement of a sub-processor and you may object on reasonable data protection grounds within the notice period, unless the change is reasonably necessary on an urgent basis to protect the security, integrity or continuity of the Platform, in which case Zero Gravity may make the change immediately and shall notify the School as soon as reasonably practicable. An up-to-date list of sub-processors is available on request. Full details of the authorisation, notice and objection process are set out in the School Agreement.

International transfers (Tutor)

We will not transfer School Data outside the United Kingdom except to the sub-processors and locations listed above, or with your prior written authorisation, and in each case only under appropriate safeguards (Articles 44–49 UK GDPR). Restricted transfers are made under the transfer mechanism identified for each sub-processor above — the Standard Contractual Clauses incorporating the UK Addendum, or the UK Extension to the EU-US Data Privacy Framework where the importing entity holds a current certification — with supplementary measures including encryption in transit and at rest and, for the LLM providers, contractual prohibitions on model training.

Primary application data and databases are hosted in UK/EU regions only (AWS eu-west-1, Ireland, via Heroku); encrypted backups are replicated to a US region for disaster recovery purposes only.

For each restricted transfer relying on the Standard Contractual Clauses, we carry out and document a transfer risk assessment before School Data is first transferred and keep those assessments under review. You can request copies of our Standard Contractual Clauses and transfer risk assessments or an appropriate summary from our Data Protection Officer at data@zerogravity.co.uk.

Research and evaluation

Where your school participates in an externally evaluated programme or research study, we share School Data with the evaluator only in anonymised or aggregated form, or — where personal data is required — on your documented instructions under a written data-sharing arrangement recording each party’s role, lawful basis, the data fields shared, purpose, security measures, retention and responsibility for data subject requests.

Data retention, return and deletion (Tutor)

We may retain anonymised and aggregated data derived from School Data (such as usage, engagement and outcome statistics) that does not identify any individual and cannot reasonably be re-identified, applying the ICO's anonymisation guidance, for service evaluation, research and product improvement.

Your obligations as controller (Tutor)

As the controller, you are responsible for:

• Ensuring you have a lawful basis under data protection law to share School Data with us, and an Article 9 condition for any special category data you share or instruct us to process
• Providing pupils and parents/guardians with privacy notices that cover the sharing and the processing under the service, and ensuring your school's own privacy notice reflects the use of the service
• Ensuring the accuracy and completeness of the School Data you provide, and notifying us promptly of corrections
• Transferring School Data to us only by the agreed secure methods
• Providing and maintaining safeguarding escalation contacts (your DSL and agreed deputies), and ensuring alerts are actioned in accordance with your Safeguarding Policy
• Managing access permissions for staff within the teacher dashboard
• Notifying us promptly if you become aware of a data breach
• Conducting your own Data Protection Impact Assessment (DPIA) in respect of your decision to deploy our AI Services to students, where required by applicable data protection law — we will assist with the information you need

Data subject rights (Tutor)

Where a student, parent or guardian submits a data subject rights request (for access, erasure, restriction or otherwise) in connection with your school's use of our service, we act on your instructions as your processor. If we receive a request directly, we will notify you within 3 business days and will not respond to it (other than to acknowledge receipt) except on your instruction, or where the request concerns data for which Zero Gravity is the controller. We will assist you in fulfilling your obligation to respond within one month. Requests and instructions should be sent to data@zerogravity.co.uk.

3. I'm an employer partner

Your role as data controller

When your organisation shares recruitment outcome data with Zero Gravity — such as the name of a candidate, the role they applied for, and their application stage or outcome — you and Zero Gravity are each independent data controllers in respect of that data. Each party is independently responsible for complying with data protection law in respect of its own processing activities.

What data you share with us

The only data we receive from employer partners in connection with recruitment is: the candidate's name, the role applied for, and their application stage and outcome.

Why we use this data

Zero Gravity uses recruitment progress data to deliver our service to students, to measure and evidence our social impact, and to improve our platform.

Our legal basis

Zero Gravity processes this data on the basis that it is necessary to perform our contract with students, or on the basis of our legitimate interest in measuring the effectiveness of our Services.

Who we share this data with

Recruitment outcome data may be shared on an aggregated and anonymised basis with funders, partners and stakeholders for impact reporting. Individual candidate data will not be shared with any third party in an identifiable form except where required by law.

How long we keep this data

Zero Gravity retains recruitment progress data for as long as we maintain an ongoing relationship with the relevant student as a Zero Gravity user, plus any applicable legal limitation period and an additional two months.

Your obligations as data controller

As an independent data controller, you are responsible for:

• Ensuring you have a lawful basis to share candidate data with us
• Ensuring your own privacy notice informs candidates that their application status may be shared with Zero Gravity

Our use of this data is governed by the employer partner agreement.

4. I'm a university partner

Your role as data controller

When your organisation uses our Services to support student access, widening participation, or student success outcomes, you and Zero Gravity Tech Ltd are each independent data controllers. Each party independently determines the purposes for which it processes personal data and is independently responsible for complying with data protection law in respect of its own processing activities. This arrangement is documented in our University Agreement, which includes a data sharing schedule setting out the categories of data shared between us, the purposes of sharing, and the obligations of both parties. If you do not yet have a signed University Agreement, please contact us before allowing students to access the service.

What data we may share

The specific categories of personal data shared between Zero Gravity and university partners vary depending on the nature of the partnership. Data sharing may include one or more of the following, as set out in the applicable partnership agreement:

• Zero Gravity user data shared with you — such as identifiers, interest flags, event attendance, or engagement data — to support outreach, access, and widening participation activity
• Aggregate or anonymised outcome data shared with you — to support impact reporting, Access and Participation planning, or student success evaluation
• Aggregate outcome data shared by you with Zero Gravity — such as application, enrolment, continuation, awarding, or graduate outcomes data — to enable Zero Gravity to measure and evidence its social impact

Where person-level data is shared, this will be limited to the minimum necessary for the agreed purpose. The specific fields, purposes, lawful bases, retention periods, and safeguards applicable to your partnership are set out in your data sharing agreement with Zero Gravity.

Our legal basis

Zero Gravity processes personal data shared with university partners on the basis of its legitimate interests in delivering its services, measuring social impact, and improving its platform.

Your obligations as data controller

As an independent data controller, you are responsible for:

• Ensuring you have a lawful basis to share any personal data with Zero Gravity
• Ensuring your own privacy notice informs individuals that their data may be shared with Zero Gravity where relevant
• Complying with any obligations set out in your data sharing agreement with Zero Gravity

Data subject rights

If an individual submits a data subject rights request in connection with data shared under your partnership with Zero Gravity, please contact us at data@zerogravity.co.uk. We will respond within one month.