Skip to main content
Skip to main content
Early bird: £149 once, everything until SATs week.21 days left
SATs 2027: 29 weeks left at school to go See the published dates and expected paper order →

Trust and transparency

Privacy Policy

How SATs Arcade protects your privacy and your children's data, what we collect, why we collect it, and how you stay in control.

Last updated: 6 September 2026
Jump to section

1. Who We Are

Arcade Learning Group Ltd, trading as SATs Arcade ("we", "us", "our"), is the data controller responsible for the personal information processed through this website and platform. Arcade Learning Group Ltd is registered in England and Wales under company number 17441494, with its registered office at 66 Paul Street, London, EC2A 4NA. We operate the website satsarcade.co.uk and the SATs Arcade application, a KS2 practice and SATs preparation platform for children in Years 3 to 6.

If you have any questions about this privacy policy or how we handle your data, please contact us.

Note for parents: Only adults (18 or over) may create SATs Arcade accounts. Children use the service through a profile created by a parent or teacher on their behalf. We do not knowingly allow children to register accounts directly.

2. Data We Collect

We collect the following categories of personal data:

Account data

When you register, we collect your display name, email address, hashed password, and account role (parent or teacher). For school accounts, we also collect school name and contact details.

Child profile data

When you create a child profile we collect the child's first name (or nickname) and year group. We do not ask for the child's date of birth, address, or any other identifying information.

Practice and progress data

We record every question a child answers, whether it was correct, how long they took, their XP, streaks, and overall performance across subjects and topics. This is the core of the service.

Payment and billing data

When you subscribe, payment is processed by our payment provider (Stripe). We store your subscription plan, status, and invoice records. We do not store your card number — your payment provider handles that.

Usage and attribution data

When you first visit our site, we capture the page you landed on and any UTM marketing parameters in the URL (e.g. utm_source, utm_medium, utm_campaign). We also capture your browser's referrer header. This is used to understand how users discover SATs Arcade.

Technical data

Our servers log standard web server information including your IP address and browser type. To keep you signed in we use a short-lived access token held in your browser's local storage, together with a refresh token stored in an HTTP-only cookie that JavaScript cannot read.

3. How We Use Your Data

  • Providing the service: Authenticating your account, serving practice questions, tracking progress, generating reports.
  • Subscription management: Processing payments, managing your plan, sending billing receipts.
  • Service communications: Sending you important information about your account or subscription (e.g. payment failures, plan changes). We will not send marketing emails without your explicit consent.
  • Improving SATs Arcade: Understanding which topics pupils find hardest, identifying bugs, and improving our question bank and adaptive algorithm.
  • Marketing attribution: Understanding which channels (e.g. Google, social media, word of mouth) bring new users to SATs Arcade, so we can invest our marketing budget sensibly.
  • Safety and fraud prevention: Protecting the platform from abuse.

5. Children's Data

Protecting children's privacy is a priority for us. Our service is designed for children in Years 3 to 6 (typically aged 7 to 11), and we take the following steps to safeguard their data:

  • Only adults (parents or teachers) may create accounts. Children cannot register themselves.
  • We collect only the minimum data needed for a child profile: a first name or nickname, and year group.
  • Practice and progress data is linked to the child's profile and is only visible to the registered parent or teacher, and to school staff if the school has a licence.
  • We do not display children's real names publicly on leaderboards — only display names chosen by the parent.
  • We do not serve targeted advertising to children or use their data for any commercial profiling.
  • If you believe a child has registered an account without parental consent, pleasecontact us and we will delete the account promptly.

6. Data Sharing

We do not sell your data. We share it only in the following limited circumstances:

  • Payment processors: When you subscribe, your payment data is processed by Stripe. Stripe's privacy policy applies to payment processing.
  • Hosting and infrastructure: Our servers and databases are hosted with reputable cloud providers. These providers process data on our behalf under data processing agreements.
  • School staff: If your child is in a class linked to a school licence, the teacher and school admin can see your child's progress data within SATs Arcade. This is the intended function of the school plan.
  • Legal obligations: We may disclose data if required by law, court order, or to protect the safety of our users.

We do not share your data with advertisers, data brokers, or any third party for marketing purposes.

7. Schools & Data Processing Agreements

When a school signs up for SATs Arcade, the school acts as the data controller for its pupils' data, and Arcade Learning Group Ltd (trading as SATs Arcade) acts as a data processor on the school's behalf. This relationship is governed by a Data Processing Agreement (DPA) which we enter into with every school customer.

Schools are responsible for obtaining any necessary consents from parents before enrolling pupils on the platform. If you are a school and have questions about our DPA, please contact us.

8. Data Retention

  • Active accounts: We keep your data for as long as you have an account with us.
  • Deleted accounts: When you delete your account, we delete your personal data within 30 days. Anonymised, aggregated statistics may be retained.
  • Financial records: Invoice and payment records are retained for 6 years to comply with UK tax law.
  • Backups: Data may persist in encrypted backups for up to 90 days after deletion before being permanently purged.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access: You can request a copy of all personal data we hold about you and your child.
Right to rectification: You can ask us to correct inaccurate or incomplete data.
Right to erasure: You can ask us to delete your data ("right to be forgotten"). Some exceptions apply (e.g. legal obligations).
Right to restriction: You can ask us to limit how we use your data in certain circumstances.
Right to data portability: You can ask for your data in a machine-readable format.
Right to object: You can object to processing based on our legitimate interests.
Right to withdraw consent: Where processing is based on consent (e.g. marketing emails), you can withdraw it at any time.

To exercise any of these rights, contact us. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

10. Security

We take reasonable technical and organisational measures to protect your data, including:

  • All data transmitted between your browser and our servers is encrypted using HTTPS (TLS).
  • Passwords are hashed using bcrypt — we never store plain-text passwords.
  • Access to personal data is restricted to authorised personnel only.
  • Our databases are not publicly accessible.

No system is 100% secure. If you believe your account has been compromised, please contact us immediately.

11. Cookies & Local Storage

We use one essential cookie — an HTTP-only cookie holding your refresh token, which is what keeps you signed in between visits. It is not readable by JavaScript and is cleared when you sign out. We also use browser local storage for your accessibility preferences (such as dark mode and font size), for keeping your session active while you browse, and for recording your cookie choices.

Optional analytics (Google Analytics 4 and PostHog) and first-party campaign attribution run only if you switch them on in the cookie banner or through Cookie settings; they start off. We do not use advertising or retargeting cookies, and no analytics is ever attached to a child profile. For the full list and how to change your choices, see our Cookie Policy.

12. Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will notify you by email or by displaying a prominent notice in the app. The "last updated" date at the top of this page will always reflect the most recent revision.

13. Personalised (Adaptive) Practice

When you switch on Personalised Practice for a child, SATs Arcade analyses which questions that child answers correctly and incorrectly to build a private, per-topic estimate of how secure they are on each skill, and uses that estimate to choose the next question and to show you a readiness overview in your parent dashboard.

  • This is a form of profiling. It is off by default and only happens after you, the parent, switch it on for an individual child on an active premium plan.
  • We use only that child’s own practice answers (which question, right or wrong, and when). We never use it for advertising and never share it.
  • You can switch it off at any time in your parent dashboard. When you do, we stop the analysis immediately and delete the derived estimates.
  • We do not produce a predicted SATs score — we show topic-level readiness as a guide, not a prediction.
  • Lawful basis: Your consent (Article 6(1)(a) UK GDPR). You can withdraw it at any time without affecting anything else.

14. Contact Us

If you have any questions, requests, or concerns about this policy or your data:

Arcade Learning Group Ltd, trading as SATs Arcade

Company number 17441494 · Registered office: 66 Paul Street, London, EC2A 4NA

[email protected] · Contact form

If you are not satisfied with our response, you have the right to complain to the ICO at ico.org.uk/make-a-complaint.