Privacy Policy
How we collect, use, and protect your personal data.
Last updated: August 2026
```AIXO EDU (“we”, “our”, or “us”) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, share, and protect information when you visit our website, contact us, subscribe to our newsletter, purchase digital products, or use our services. We operate in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
AIXO EDU is a British digital educational resources provider. We provide digital educational resources, printable learning materials, and custom digital education projects. Our Data Controller contact details are available upon request. You may contact us at hello@aixoedu.com.
2. Information We Collect
We may collect and process the following categories of personal data:
- Contact information: your name, email address, and any message details when you submit a contact form, project enquiry, newsletter sign-up, or customer support request.
- Project information: information you provide in a custom project brief, such as project requirements, age range, learning goals, child-related details supplied by a responsible adult, or other information needed to complete the project.
- Order and transaction data: order details, purchased products, order references, payment status, delivery records, and payment references. We do not store full card numbers on our website; payments are processed securely by our payment processor.
- Newsletter data: your email address, subscription status, unsubscribe status, and related communication preferences.
- Technical and usage data: our hosting provider may process standard server request data such as IP address, browser information, timestamps, and requested URLs for security and server operation. Our own lightweight analytics system stores anonymous visitor hashes, visit dates, approximate country code where available, page or product paths, and visit counters. It does not store raw IP addresses, raw User-Agent strings, or referral data.
- Communications: records of correspondence if you contact us by email, form, or other support channels.
- AI assisted screening information: where our contact form is protected by our Luna AI-assisted screening system, the text of your message may be analysed for spam, unsolicited commercial outreach, abusive or meaningless submissions, fraud or security concerns, and potentially high-risk content. We may store the resulting classification, spam and risk indicators, and a short explanation alongside the contact message.
3. How We Use Your Information
We use your personal data for the following purposes:
- To fulfil and deliver your digital product orders
- To provide secure download access after successful payment
- To respond to your enquiries and provide customer support
- To review, quote, and complete custom digital education projects
- To send order confirmations, delivery notifications, and service-related messages
- To manage newsletter subscriptions and send marketing emails where you have consented
- To improve our website, products, and services using lightweight first-party analytics
- To detect spam, abusive submissions, fraud, malicious activity, and security risks
- To use AI-assisted screening to help classify and route contact-form messages for administrative review
- To protect our website, our administrators, our users, and our services
- To comply with legal, tax, accounting, and regulatory obligations
4. Legal Basis for Processing
We process your personal data on the following lawful bases:
- Contract: where processing is necessary to fulfil your order, provide download access, deliver a custom project, or take steps at your request before entering into a contract.
- Legitimate interests: where processing is necessary to operate and improve our website, provide customer support, prevent spam and abuse, detect security risks, protect our systems and administrators, understand basic website usage, and manage our services, provided those interests are not overridden by your rights and freedoms.
- Consent: where you subscribe to marketing emails, choose optional preferences, or where consent is required for certain optional cookies or technologies.
- Legal obligation: where we are required to retain or process records for tax, accounting, legal, or regulatory purposes.
5. Children's Data
Our products are designed for children, but our website services are directed at adults, including parents, educators, nurseries, schools, and organisations. We do not knowingly collect personal data directly from children under 13.
Where personalisation information relating to a child is provided, it is provided by a responsible adult purchasing or requesting the product or service. This information is used only where reasonably necessary to fulfil the order or custom project request.
Please do not include unnecessary personal information about a child, special-category data, passwords, payment card details, or other highly sensitive or confidential information in a general contact-form message. Contact-form message text may be subject to the AI-assisted screening described in this Privacy Policy.
6. How We Share Your Data
We do not sell your personal data. We may share limited data with trusted service providers where necessary to operate our website and services:
- Payment processor: payments are processed securely by our payment processor, currently Stripe. We do not store full card details on our website.
- Website hosting and infrastructure providers: to host, secure, monitor, and operate the website.
- Email service providers: to send order confirmations, download notifications, enquiry replies, security alerts, and newsletters.
- AI service provider (OpenAI): to provide AI-assisted screening of contact-form messages. For this screening, our system sends the message body to the AI service. We do not intentionally send the sender's name, email address, IP address, message reference, session information, or other contact-form metadata as part of the AI classification request. However, the message text itself may contain personal information that you choose to include.
- YouTube/Google: where an embedded YouTube player loads or where you play or interact with an embedded YouTube video on a product or content page.
- Vimeo: where an embedded Vimeo player loads or where you play or interact with an embedded Vimeo video on a product or content page.
- TikTok: where an embedded TikTok player loads or where you play or interact with an embedded TikTok video on a product or content page.
- Legal, tax, or regulatory authorities: where required by law or where necessary to protect our legal rights.
All third-party processors and service providers are expected to handle personal data in accordance with applicable data protection law and their applicable privacy and data-processing terms.
7. Lightweight Website Analytics
We use lightweight first-party analytics to understand basic website visits and improve the website experience. This helps us see approximate visitor numbers, popular pages or products, repeated page views, possible bot or crawler noise, and general country-level information when available from trusted hosting or proxy headers.
Our analytics system does not store raw IP addresses, raw User-Agent strings, or referral data. It may use request information temporarily to create an anonymous visitor hash, but the raw IP address and raw User-Agent are not stored in the analytics database.
Where trusted hosting or proxy headers provide country-level information, we may record an approximate country code. If this information is not available, visits are counted as “Unknown”. Analytics data is used only to understand website performance, visitor interest, and basic product/page engagement.
8. AI-Assisted Contact Screening Luna Shield
Our Contacts service may use an AI-assisted screening system known as Luna Shield. Luna Shield helps us identify spam, unsolicited commercial messages, meaningless or abusive submissions, possible scams, and potentially high-risk or threatening content.
For Luna Shield screening, only the contact message body is intentionally submitted to our AI service provider. The screening request does not intentionally include your name, email address, IP address, internal contact reference, or session information. Because a message body may itself contain information capable of identifying you or another person, you should include only information reasonably necessary for your enquiry.
The AI system may return a classification, spam indicator, risk indicator, and a short explanation. These results may be used to determine how a message is presented to our administrators, whether it requires manual review, and whether an ordinary email notification or a safer security notification is generated. Messages identified as spam, uncertain, or high risk may be held for review within our administrative system rather than being forwarded in full by email.
Luna Shield is intended as an administrative security and message-triage tool. We do not use it to determine your eligibility for our products or services, to determine payment or contractual rights, or to make solely automated decisions about you that produce legal or similarly significant effects. Messages and AI assessments can be reviewed by an authorised administrator.
OpenAI API data sharing
At the time of this policy, the OpenAI API project used for our Luna Shield contact screening participates in OpenAI's optional API input and output data-sharing programme. OpenAI states that data shared through this programme may be used to identify usage patterns, measure model quality, and inform future evaluation and training of its models.
This means that the message text submitted for Luna Shield screening, together with the AI-generated screening output, may be shared with OpenAI under those programme settings. We therefore strongly recommend that you do not include unnecessary sensitive personal information, passwords, payment card information, confidential credentials, or unnecessary personal information about children in a general contact-form message.
OpenAI's API data-sharing settings may change in the future. If we materially change how contact messages are processed or shared, we will update this Privacy Policy accordingly.
9. Embedded YouTube, Vimeo, and TikTok Videos
Some product and content pages may include embedded videos from YouTube, Vimeo, or TikTok. When an embedded player loads, the relevant provider may receive information about your device, browser, IP address, the page containing the video, and your interaction with the player according to its own privacy practices. This may occur when the player loads, even if you do not press play.
Embedded video content remains hosted and controlled by the relevant third-party provider. AIXO EDU does not control how YouTube/Google, Vimeo, or TikTok processes information collected through its player, or whether a particular video remains available.
You can manage cookies and tracking technologies through your browser or privacy settings. Blocking third-party content may prevent embedded videos from displaying or playing, while the rest of the product page should remain available.
For more information, please refer to Google's Privacy Policy, Vimeo's Privacy Policy, and TikTok's Privacy Policy.
10. Cookies and Similar Technologies
Our website uses cookies and similar technologies where necessary for website functionality, consent preferences, accessibility preferences, payment processing, embedded content, and basic analytics. For full details of the cookies and similar technologies we use and how to manage them, please see our Cookie Policy.
11. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy:
- Order and transaction records: normally retained for up to 7 years for tax, accounting, and legal compliance.
- Enquiry and correspondence records: normally retained for up to 3 years unless a longer period is required for legal, support, security, or business reasons.
- AI-assisted screening records: classifications, spam/risk indicators, and related screening metadata stored by AIXO EDU are normally retained with the relevant contact message and follow the applicable enquiry or correspondence retention period.
- Newsletter subscriptions: retained until you unsubscribe or request deletion, subject to any suppression records needed to honour unsubscribe requests.
- Custom project information: retained only for as long as needed to complete the project, provide support, and maintain appropriate business records.
- Lightweight analytics data: retained only for as long as needed to understand website usage and maintain basic reports. We may periodically delete or aggregate older analytics data.
Information processed by third-party service providers may also be retained in accordance with their applicable contractual terms, privacy policies, security requirements, and data-control settings.
12. Your Rights
Under UK GDPR, you have the following rights:
- Right of access: you may request a copy of the personal data we hold about you.
- Right to rectification: you may request correction of inaccurate or incomplete data.
- Right to erasure: you may request deletion of your data in certain circumstances.
- Right to restrict processing: you may ask us to limit how we use your data.
- Right to data portability: you may request your data in a machine-readable format where applicable.
- Right to object: you may object to processing based on legitimate interests.
- Right to withdraw consent: where we rely on consent, you may withdraw it at any time.
To exercise any of these rights, please contact us at hello@aixoedu.com. We will respond within one calendar month where required by law. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
13. Security
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include secure HTTPS connections, restricted administrative access to personal data, payment processing through secure third-party payment infrastructure, automated spam and risk screening where enabled, and regular review of website security.
14. International Transfers
We primarily operate from the United Kingdom. Some service providers, including payment processors, email providers, hosting infrastructure, AI service providers, YouTube/Google, Vimeo, TikTok, or other embedded content providers, may process data outside the UK or European Economic Area.
Where personal data is transferred internationally and the transfer is subject to UK data protection restrictions, we expect appropriate safeguards or other lawful transfer mechanisms to be used in accordance with applicable data protection law.
15. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy on our website with a revised “Last updated” date. Where required by law, we will notify you directly of material changes.
16. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
AIXO EDU
Email: hello@aixoedu.com