Privacy policy

Who we are

CS Ninja is a computer science homework and practice service for schools. When a school signs up, the school is the data controller for its pupils' and staff information, and CS Ninja acts as the data processor on the school's written instructions, in line with the UK GDPR and the Data Protection Act 2018.

You can reach our privacy team at privacy@csninja.co.uk.

What we collect

• Staff details: name, school email address, role and the school they belong to.
• Pupil details: name, school email address, class membership and, where the school uploads one, a roster entry before the pupil first signs in.
• Learning records: homework and practice attempts, answers, marks, feedback, experience points, streaks and badges.
• Account and security data: sign-in method, timestamps and technical logs needed to keep the service running securely.
• School billing data: plan, billing frequency, licence status and the payment references held by our payment provider.

Why we use it

• To provide the service: setting and marking homework, tracking progress and showing results to teachers.
• To administer school accounts, licences, trials and billing.
• To send service and billing emails to school staff.
• To keep the service secure, diagnose faults and prevent misuse.

For pupil data we act on the school's instructions; the school decides the lawful basis, which is normally a public task or legitimate interests. For school staff and billing information we rely on the contract with the school and on our legitimate interests in running the service. We do not use pupil data for advertising, profiling or training third-party AI models.

Children's data

Pupil accounts are created by the school, not by children signing themselves up. We collect the minimum needed for schoolwork, we never sell pupil data, and we never send pupils marketing.

Who we share it with

• Our hosting and database provider, which stores the service data.
• Our email provider, which delivers service and billing emails.
• Our payment provider, which handles school subscriptions; card details never reach us.
• AI marking providers, on the Ninja AI plan only, to mark exam-style answers. Answers sent for marking are not used to train their models.
• Law enforcement or regulators where we are legally required to do so.

Every provider is bound by a written processing agreement. Where data is transferred outside the UK, it is protected by UK adequacy regulations or standard contractual clauses.

How we protect it

Data is encrypted in transit. Names and email addresses are additionally encrypted in our database, and access is restricted by role so a school can only ever see its own information. Access to production systems is limited to the people who need it.

How long we keep it

We keep school data for as long as the school holds an active licence or trial. If a licence ends and is not renewed, the school account becomes read-only, is marked for deletion after six months, and is permanently erased 30 days after that warning unless the school subscribes again. Schools can also ask us to delete their data sooner.

Your rights

Pupils, parents and staff have the right to access, correct, erase, restrict or object to the use of their personal data, and to data portability. Requests about pupil data should go to the school in the first instance; we will help the school respond. You can contact us at privacy@csninja.co.uk, and you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

We only use cookies and similar storage that are strictly necessary to keep you signed in and to remember basic preferences. We do not use advertising or third-party tracking cookies.

Changes to this notice

If we make a material change we will tell school administrators by email and ask them to accept the new version where the change requires it. This notice is version 2026-09-10, last updated 10 September 2026.