Privacy Notice

Leo’s Study Lab (“we”, “us”, “our”) operates the study platform at leosstudylab.com. Leo’s Study Lab is the data controller for the personal information described in this notice, which means we decide why and how that information is used.

• Account details — your first name, email address, and an encrypted version of your password. Used to create your account, sign you in, and personalise your dashboard. Legal basis: performance of our contract with you.
• Membership and order records — your plan, membership status, order references, and cash payment confirmations. Used to give you access to Study Lab+ and to support you. Legal basis: performance of our contract with you. All payments are made in cash, in person at school — we never collect or store card or bank details.
• Study activity — your progress and saved resources as those features become available. Used to provide the study experience. Legal basis: performance of our contract.
• Support messages — anything you send us through the contact page or by email. Used to answer you. Legal basis: legitimate interests in supporting our users.
• Technical and usage data — IP address, device and browser information, and basic usage logs. Used for security, fraud prevention, troubleshooting, and improving the product. Legal basis: legitimate interests in keeping the Service safe and working well.
• Marketing communications — if you opt in, we may email you product updates. Legal basis: consent, which you can withdraw at any time.

• Service providers — hosting, database, authentication, email delivery, and error-monitoring providers who process data on our instructions.
• Payment processors — none. We do not process online payments. Every purchase is paid in cash and handled in person at school, so no payment information is ever shared with a third party.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where we are required to disclose information by law, or to protect our rights and the safety of users.

We do not sell your personal information.

Our providers may process data outside your country, including in the United States. Where data leaves the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

We keep account and membership information for as long as your account is active, and for up to 24 months after you close it so we can handle disputes and support requests. Records we must retain for tax and accounting reasons are kept for the period the law requires (typically up to 7 years). Support messages are kept for up to 24 months. When information is no longer needed, we delete or anonymise it.

Depending on where you live, you have the right to access your personal information, correct it, delete it, restrict or object to how we use it, receive a portable copy, and withdraw consent where we rely on it. You can also complain to your local data protection authority. To exercise any of these rights, contact us through the contact page. We respond within one month.

We use appropriate technical and organisational measures to protect your information, including encryption in transit, encrypted password storage, row-level access controls on our database, and limiting staff access to what is necessary. No system is perfectly secure, but we work to keep risk low and to respond quickly if something goes wrong.

We use essential cookies and local storage to keep you signed in and to keep the site secure — these are required for the Service to work. We do not use advertising cookies. You can clear or block cookies in your browser settings, though signing in will not work without the essential ones.

Leo’s Study Lab is designed for students. If you are under the age required for consent in your country, please use the Service with a parent or guardian’s permission. If you believe a child has given us information without that permission, contact us and we will delete it.

We will update this notice as the Service develops and will change the date at the top of this page. Questions about privacy can be sent through the contact page at any time.