Privacy Policy

The legal seller and operator of BoardBurst is trading as BoardBurst. For any privacy question or request, email boardburstsupport@gmail.com. BoardBurst acts as the data controller for account, subscription, security and community-operation data, including publishing permission records. For content processed solely on a school's documented instructions, BoardBurst acts as a processor where applicable. For school-directed homework records, the school determines the purpose and lawful basis and BoardBurst processes records on its documented instructions. These roles depend on actual use, not this notice alone. A written data-processing agreement must be agreed with the school before real pupil data is used; contact us to arrange this. This privacy notice is not that agreement.

• Account data: your email address, password (stored only as a secure hash) and display name.
• Registration safety details: your age at registration, school or workplace (or your declaration that you are an independent adult), adult confirmation, and the date and version of the Terms and Privacy Policy you acknowledged. Age and workplace are private account information and are not displayed in quizzes or community discussions. These are self-declared details, not verified identity or employment.
• Content you create: quiz questions, answers, uploaded images, audio, video, YouTube links and optional clip start/end times. Selecting a clip controls playback; it does not remove the rest of the uploaded file.
• Community publishing record: the publishing permission version and date when you explicitly agree to a permanent approved Discover copy. Community copies are labelled BoardBurst and do not copy your account email, display name, age or workplace into their author label.
• Classroom data: homework you share with other Pro teachers, and resource requests or comments you post.
• Student homework: a shared homework access code, student-entered name and class name, assignment details, selected answers, submission time and scores. Students do not need email addresses or accounts. Names, classes and results are accessible only to the assigning teacher, who can organise and export them by class.
• Billing data: handled entirely by our payment provider, Paddle. We never see or store your card details; we only receive your plan status, subscription ID and billing period.
• Technical data: error reports and basic usage logs needed to keep the service running.

• Contract: to provide your account, the quiz tools, and the Pro subscription you buy.
• Legitimate interests: to keep the service secure, support our adult-only registration rules using age and workplace declarations, prevent abuse and fix problems.
• Legal obligation: to keep basic billing records where the law requires it.
• Consent: for any optional communications, which you can withdraw at any time.
• School-directed pupil records: the school identifies and documents its lawful basis; BoardBurst processes these records on its instructions under the agreed processing agreement. Registration acceptance is not pupil consent or a separate lawful basis for the school.
• Community publishing and agreement records: to provide the requested publishing service under contract and retain evidence of the licence and policy agreement for legitimate interests in accountability and resolving disputes. A publishing licence is not consent to every use of personal data.

Students may complete assigned homework at home on their own phone, tablet or computer without registering. Everyone completing the same assignment uses one shared homework link and code, then enters their name and class. The teacher or school determines the lawful basis for collecting these pupil details and must provide appropriate information to pupils and parents before assigning homework. BoardBurst processes these records on the teacher or school's instructions. Teachers should request only the name or identifier and class needed for their school records, distribute access within their class, and keep exported spreadsheets secure. Names and classes are self-declared, not verified identity; anyone with the shared link and code can submit under a name, and a shared code cannot guarantee one attempt per pupil. Students cannot see classmates' identities, answers or results.

The student form accepts one first name or agreed single-word nickname and a class name or set, entered by the student. Do not request surnames, school names, email addresses, birth dates or sensitive pupil information. A first name linked to a class or set, answers and results can still identify a pupil to their teacher and remains personal data even if BoardBurst does not know which school they attend. Limiting the name does not remove UK GDPR responsibilities or school approval requirements. Only the assigning teacher has access to these results through their account; other teachers, Pro members and students cannot view them. Authorised service providers may process the records as needed to operate and support the service under the agreed safeguards.

Before assignment, teachers confirm school approval, lawful basis and privacy information; this confirmation is not identity verification, pupil consent or proof of legal compliance. Schools should involve their data-protection lead, assess whether a data protection impact assessment is required and review the processing agreement before use.

BoardBurst is an adult-operated teaching tool. Accounts are restricted to people aged 18 or over, not students. Age and workplace declarations are not independently verified, so they cannot guarantee that every registrant is an adult or teacher. Teachers may enter player names during a game; avoid identifying pupils unnecessarily, including in exported reports. Please take care not to upload materials that identify individual pupils (for example photos or names of children) unless you have a lawful basis to do so and follow your school's safeguarding policy.

We share personal data only with the providers needed to run BoardBurst:

• Cloud hosting & authentication  - secure hosting of accounts, quizzes and uploaded files.
• Paddle  - payment processing, VAT/sales tax and receipts. Paddle is the merchant of record.
• Service and support providers - operational logging, error reporting and support where necessary, with appropriate access restrictions and contractual safeguards.
• Professional advisers and authorities — legal or accounting advice, compliance with law, and establishing or defending legal claims, sharing only what is necessary.

If you publish a quiz to the community library or share homework with Pro members, that content is visible in the public library or, for homework, to eligible Pro members. Public approved quizzes require an account to access quiz content. Your registration age, school or workplace and email are not published. Teacher-owned community posts may display your display name; approved permanent Discover copies use the BoardBurst author label. Identifying information inside uploaded resources is not automatically removed.

We never sell personal data and never use it for third-party advertising.

School approval must include review of hosting providers, subprocessors, processing locations and any international-transfer safeguards. Those contractual details must be confirmed with BoardBurst before real pupil data is collected; this page does not certify UK-only storage or a completed transfer assessment.

Where personal data is transferred outside the UK or EEA, applicable law requires an appropriate safeguard, such as an adequacy decision or approved contractual clauses (including the UK International Data Transfer Agreement or UK Addendum where appropriate), and any required transfer assessment. The actual providers, countries and safeguards must be confirmed before school-directed pupil processing; this notice does not assert that those arrangements have already been reviewed.

Playing embedded YouTube or other external media can allow that provider to receive your IP address, device information and viewing activity under its own privacy and cookie terms. Check school approval before using external media; clip selection does not prevent that processing.

Support messages, technical logs and agreement records are kept only for as long as necessary for support, security, accountability, applicable legal record-keeping or resolving claims, then deleted or anonymised. Retention is assessed by purpose, sensitivity, legal requirements and any active dispute; exact provider log and backup periods must be confirmed in the school processing arrangements.

Teachers select 7, 30, 60 or 90 days from assignment creation (default 30). Access stops at expiry; a daily cleanup removes the assignment and its names, classes, answers, scores and legacy results within 24 hours. Existing assignments receive a maximum 90-day deadline from 17 October 2026 and require teacher privacy approval before further student access. Teachers can delete assignments or individual submissions sooner and correct student identifiers and class labels. Closing pauses access without deleting results; replacing the link and code revokes previous access. Exported spreadsheets are outside BoardBurst and must be secured and deleted by the school under its retention policy. Removal from the application does not certify immediate removal from provider backups; backup retention and deletion terms must be reviewed in the processing agreement.

Data is stored on secure cloud servers. We keep your account and content while your account is open. Deleting a quiz removes your personal copy. Where you separately agreed to permanent community publishing, the approved Discover copy and its referenced media remain independently of your quiz or account, for as long as BoardBurst makes the resource available, unless withdrawn for legal, safeguarding or copyright reasons. Older submissions without that permission are not automatically retained as permanent copies. We retain the permission version/date to document the publishing licence. If you ask us to delete your account, we delete your profile and personal quizzes and remove unneeded uploads, subject to minimum legally required billing records and the approved resources licensed for retention. This does not override personal-data rights: contact us to review removal or anonymisation of identifying information within a resource.

Under UK GDPR you can ask us to access, correct, export or delete your personal data, restrict or object to its use, and withdraw consent. Email us and we will respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Pupils and parents should first contact the assigning teacher or school's data-protection lead for homework access, correction or deletion requests. BoardBurst assists on the school's instructions and checks authority before releasing information; knowing a shared homework code does not entitle anyone to student results.

Accounts are protected by hashed passwords and secure sessions. Uploaded files are stored in a private, access-controlled storage area. We apply automatic moderation to block inappropriate language in shared content.

Homework results are restricted to the assigning account. Public student access returns questions, not answer keys or peer records. Share links only within the class; close or replace leaked links. Use a strong, unique teacher password and a school-approved device, sign out of shared devices, and never share teacher credentials with pupils. These safeguards reduce risk but do not certify UK GDPR compliance.

We use appropriate technical and organisational safeguards, including access controls and encrypted connections, and investigate reported incidents. No online service is completely risk-free. BoardBurst remains responsible for its own legal duties and will assist schools with incidents and rights requests under the processing agreement, including notifying the controller without undue delay where required. Teachers and schools remain responsible for their own collection, access decisions and exports; accepting the Terms does not waive anyone's data-protection rights.

BoardBurst uses essential browser storage to maintain sign-in sessions and, on the student homework page, an attempt identifier to support safe submission retries. Signing out removes the active sign-in session; you can also clear site data in your browser, which may interrupt sign-in or submission retries. We do not use this storage for advertising. External media providers may use their own cookies or storage under their notices and your browser or provider preferences. Non-essential analytics or marketing cookies, if introduced, require applicable consent and preference controls before use.

We update this policy and its "last updated" date when changes to the service affect how personal data is handled. Material changes will be explained on this page. This policy is a privacy notice, not a request to waive your data protection rights; we will seek fresh consent where legally required.