Last updated: 8 November 2026
Who is responsible?
Bitesize Education is a UK sole-trader business providing online educational resources. The individual who trades as Bitesize Education is responsible for the personal information used for these services (the data controller). For privacy questions, to request the controller's full legal details and business correspondence address, or to make a complaint, email hello@bitesize-education.com.
What information we collect
Adult accounts: We use the email address, adult role, sign-in and verification activity, account status and secure session records that are needed to provide and protect Spelling Arcade access. We also record any optional marketing choice and associated consent evidence.
Classroom, home and guest sessions: We use short-lived class-code records, pseudonymous device-session identifiers, timestamps and a signed guest-trial cookie to control access. Children do not need to give us their name, email address or create a Bitesize account. Pupil scores and coins are stored in the browser used for gameplay rather than being uploaded to the adult-account database. On shared devices, an adult should clear temporary gameplay data between users.
Website visits and enquiries: The hosting provider may process technical data such as IP addresses, timestamps, device/browser details and error logs. If you contact us, we use the information in your message to respond. External resources and downloadable tools may have their own additional privacy information.
Why we use information and the lawful bases
- Provide and secure adult access: legitimate interests in operating, securing and preventing misuse of a free educational service, balanced against users' privacy rights.
- Run adult-authorised classroom, home and guest sessions: legitimate interests in delivering the requested learning activity while limiting the information collected about children.
- Handle questions, requests and complaints: legitimate interests in responding and maintaining appropriate records; legal obligation where data protection law requires a response.
- Send optional newsletters, giveaways and offers: consent. This is separate from account access, never required to play, and can be withdrawn through the unsubscribe link or by contacting us. Signing in again does not automatically re-subscribe you.
For the legitimate-interests activities, we consider the need to provide the service, the limited information used and the potential impact on adults and children. You may object to processing based on legitimate interests, subject to applicable legal exceptions.
Who receives information
We use Fasthosts for website and database hosting and Sender for sign-in emails and, if separately agreed, marketing. Their services may involve their own sub-processors. A feedback form or resource provided by Tally or another external provider, when you choose to open it, is governed by the information shown there. Links to Teachers Pay Teachers and YouTube take you to third-party services.
Our video previews on the homepage and Videos page do not load YouTube's embedded player until you select “Load YouTube video”. At that point your browser contacts YouTube, which may process device and usage information and set or read cookies or similar technologies. Opening an external YouTube or Teachers Pay Teachers link likewise connects you directly to that service.
Some service providers may process information outside the UK. Where international-transfer rules apply, we must verify the destination and legal transfer mechanism (for example UK adequacy regulations or appropriate safeguards). You can request the relevant details from us. We do not sell personal information to advertisers.
Cookies and browser storage
Spelling Arcade uses cookies necessary for sign-in and access security, plus browser storage for local gameplay progress. It uses a time-limited session cookie, a secure adult-login cookie if you sign in, a signed trial cookie for guest access, and a temporary learner-session cookie for adult-managed class or home sessions. Local game progress may disappear when browser data is cleared. These functions do not require an advertising profile.
We do not intentionally use advertising or non-essential analytics cookies on these website pages. If such features are added later, we will assess whether consent or another lawful exception is required before enabling them. Third-party sites may use their own technologies when you choose to open or activate them.
Retention — what happens to records?
Verification links stop working after 20 minutes; ordinary adult access sessions can last up to two hours, and a remembered private-device session up to 30 days. The signed guest-trial cookie can remain for up to 30 days. Class/home access codes expire within four hours or earlier if ended by the supervising adult. Expiry prevents access but does not itself erase the database record. Old link, session, rate-limit and class-code records are subject to periodic retention reviews and deletion when no longer needed.
Adult accounts are flagged for review after 365 days without sign-in; they are not automatically deleted then. Consent evidence may need to be held longer to demonstrate marketing permission or a later withdrawal. Service providers may have their own backup and technical-log retention periods. We review information against its purpose, security needs and applicable legal obligations. You can ask about or request deletion of a particular record by emailing us.
Your rights and choices
Depending on the circumstances, you can ask for access, correction, deletion, restriction and portability of your personal information. You can object to processing based on legitimate interests, and you can withdraw consent for marketing at any time without losing access to Spelling Arcade. We will explain if an exception applies to a request and normally respond to a rights request within one calendar month.
Complaints
If you are concerned about your information, email hello@bitesize-education.com with “Privacy complaint” in the subject. We will acknowledge a data-protection complaint within 30 days, investigate as appropriate, keep you informed and explain the outcome without undue delay. You may also complain to the Information Commissioner's Office (ICO).
Updates
We review this notice when our services or information handling changes, and update it as required. Material changes may be communicated to affected people where appropriate.