Privacy Policy

Effective Date: 4 December 2024

Last Updated: 13 November 2026

1. Introduction

SENResource is operated by MycoBloom Ltd (“we”, “us”, “our”), a company registered in England and Wales. We are committed to protecting your personal data and handling it transparently, lawfully, and securely in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations 2003 (PECR)
• ICO (Information Commissioner's Office) guidance

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights in relation to it.

Data Controller: MycoBloom Ltd, senresource.com

Contact: charlotte@mycobloom.co.uk

If you have a complaint about how we handle your data, you have the right to contact the ICO at ico.org.uk or by phone on 0303 123 1113.

2. Personal Data We Collect

2.1 Data You Provide Directly

• Email address – collected when you create an account (via Auth0), use the Contact Us form, or subscribe to our newsletter.
• Newsletter sign-ups – some free tool exports offer the option to join our newsletter. This is always optional: you only join if you enter your email and tick the consent box, and you can choose “No thanks” to continue without giving your email. Assessment results never require an email address.
• Records of consent – when you join the newsletter we record the wording you agreed to, the form you used, and the date and time, so we can show that you consented. When you send a Contact Us message we record the privacy statement you agreed to alongside it.
• Contact messages – content you submit via the Contact Us form, including your name (if provided) and email address.
• User-generated content – any information you provide when creating or submitting resources, blog posts, community posts, games, services, or job listings. This includes usernames, descriptions, images, and any other text or files you submit.
• Service and job listing details – if you post a service or job listing, we collect business name, contact details (email, phone, website), and location information including address, city, region, postcode, country, and geographic coordinates (latitude and longitude). This data may be visible to other users.
• AI Resource Generator inputs – when using the AI Resource Generator, we collect the parameters you provide: topic, age group, SEN focus area (e.g. autism, ADHD, dyslexia), difficulty level, teaching framework, optional notes, and an optional child's first name. These inputs are transmitted to Anthropic, Inc. to generate the resource (see Section 7). Please do not enter full names, dates of birth, or other directly identifying information about any child.
• Subscription and billing information – your subscription tier, status, and billing period dates are stored in our database. Payment card data is handled solely by Stripe (see Section 7). We store a Stripe Customer ID and Subscription ID to manage your account.

2.2 Data Collected Automatically

When you visit or use the Service, the following data may be collected automatically:

• IP address – our servers record the IP address of each request in their request logs, and we store it on some entries in our user action log (for example failed sign-in or permission checks, rate-limit hits, blocked spam submissions, and newsletter unsubscribes) so we can detect and investigate abuse.
• Device type, operating system, and browser
• Approximate geographic location (derived from IP address; not precise)
• Pages visited, time on page, and navigation paths
• Referral source (how you arrived at the site)
• Cookie consent preferences
• User action log – we maintain an internal audit log of account actions (such as creating, updating, or deleting content). This log is used for security, support, and platform integrity.
• Engagement data – content you like or interact with (such as liking a blog post or resource) is stored against your account.
• Link and resource click tracking – we track interactions with certain links and resources to understand usage patterns and improve the Service.
• AI generation usage – we track your monthly AI Resource Generator usage count to enforce subscription limits. This resets on the first day of each calendar month.

This data is used for security, analytics, and improving the Service. It is processed by Vercel and Render (our hosting providers), by Vercel Analytics where you have consented, and, where applicable, by advertising services.

2.3 Special Category Data

When you use the AI Resource Generator and select a SEN focus area (such as autism, ADHD, dyslexia, or speech and language needs), this may constitute information relating to a child's health or disability — which is special category data under UK GDPR Article 9. We process this data solely on the basis of your explicit provision of it for the purpose of generating an educational resource, and it is transmitted to Anthropic, Inc. only to fulfil that request. We do not use this data for any other purpose such as profiling, advertising, or sharing with third parties beyond what is necessary to generate the resource.

We encourage you to use only a child's first name (if any name at all) and to avoid including any information that could directly identify a specific child.

2.4 Children's Data

The Service is for adults only (18+) – teachers, parents, carers, and professionals. It is not directed at children, and children and young people under 18 must not use it themselves. Before starting an assessment you are asked to confirm that you are 18 or over and completing it for yourself or as a parent, carer, or professional supporting a child. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Users must be at least 18 years old to create an account, consistent with our Terms and Conditions.

3. Cookies and Tracking Technologies

We use cookies and similar technologies as described in our Cookie Policy. In summary:

• Essential cookies – required for login, security, and core site functionality. Cannot be disabled.
• Analytics cookies – help us understand how visitors use the site (e.g. via Vercel Analytics). Require your consent.
• Advertising cookies – used by Google AdSense to serve contextual or personalised advertisements. Require your explicit consent, which in the UK, EEA and Switzerland is collected through Google's certified consent message (IAB Transparency & Consent Framework).

You may withdraw cookie consent at any time via the Cookie Settings and Ad Privacy Choices links in the site footer.

4. How We Use Your Personal Data

The table below sets out each purpose for which we process your personal data and the legal basis we rely on under UK GDPR Article 6 (and Article 9 where special category data is involved):

• Account creation and management – Contract (Art. 6(1)(b))
• Authentication via Auth0 – Contract (Art. 6(1)(b))
• Responding to contact form enquiries – Legitimate interests (Art. 6(1)(f))
• Processing subscription payments via Stripe – Contract (Art. 6(1)(b))
• Providing and limiting the AI Resource Generator feature – Contract (Art. 6(1)(b)); where SEN focus data is involved, explicit provision by you for educational resource generation (Art. 9(2)(a))
• Transmitting AI Resource Generator inputs to Anthropic – Contract (Art. 6(1)(b))
• Storing engagement data (likes, activity log) – Legitimate interests (Art. 6(1)(f)) – to maintain platform integrity and personalise your experience
• Tracking resource and link interactions – Legitimate interests (Art. 6(1)(f)) – to understand usage and improve the Service
• Publishing service and job listings with location data – Contract (Art. 6(1)(b))
• Sending newsletters (where opted in) – Consent (Art. 6(1)(a)), given by ticking the newsletter consent box. Joining is never a condition of using a tool or seeing assessment results.
• Keeping records of consent – Legal obligation (Art. 6(1)(c)) – to demonstrate consent as required by UK GDPR Art. 7(1)
• Analytics and site improvement – Legitimate interests (Art. 6(1)(f))
• Displaying advertisements (AdSense) – Consent (Art. 6(1)(a)) via our cookie banner or Google's certified consent message
• Security and fraud prevention, including recording IP addresses in server request logs and on security-related entries in our user action log – Legitimate interests (Art. 6(1)(f)) – to keep the Service secure, prevent spam and abuse, and investigate incidents
• Legal and regulatory compliance – Legal obligation (Art. 6(1)(c))

We do not sell, rent, or trade your personal data to any third party.

5. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our general retention periods are:

• Account data – retained for the life of your account plus up to 2 years after account deletion, unless a longer period is required by law.
• Contact form messages – retained for up to 2 years.
• Subscription and payment records – retained for 7 years in accordance with UK tax and accounting obligations.
• AI-generated resource content – retained for the life of your account and deleted when you delete the resource or close your account.
• AI generation inputs – stored as metadata associated with the generated resource. Deleted when the resource is deleted.
• User action audit log – retained for up to 2 years for security and support purposes. IP addresses stored on these entries are automatically removed after 90 days.
• Server request logs (which include IP addresses) – kept by our hosting providers (Vercel and Render) for no longer than 30 days and then automatically deleted.
• Newsletter subscriptions and their consent records – retained until you unsubscribe. Unsubscribe requests are processed within 24 hours.
• Contact form consent records – kept with the message they relate to (up to 2 years).
• Stripe webhook events – retained for 90 days and then automatically deleted.
• Analytics data – aggregated and anonymised data may be retained indefinitely.

You may request deletion of your personal data at any time (see Section 9).

6. How We Store and Protect Your Data

We use the following third-party infrastructure providers. Each is contractually obligated to protect your data and complies with UK GDPR (or equivalent standards):

• Auth0 (Okta, Inc.) – user authentication and account management. Auth0 is certified under GDPR-compliant frameworks and enters into Data Processing Agreements (DPAs).
• MongoDB Atlas – database hosting for user data, contact form submissions, orders, and user-generated content. Data is stored in EU/UK regions where configured.
• Backblaze B2 – image and file storage. Backblaze enters into DPAs and stores data in regions specified at configuration.
• Cloudinary Ltd – image hosting, optimisation, and delivery. Images you upload (such as resource thumbnails or profile and listing images) may be stored and served through Cloudinary, which processes request data (including IP addresses) to deliver them. Cloudinary enters into DPAs compliant with GDPR.
• Stripe, Inc. – subscription and payment processing. Stripe is PCI-DSS Level 1 compliant and processes payment data under its own privacy policy. We do not store full card details.
• Anthropic, Inc. – AI model provider (Claude API) used to generate educational resources via the AI Resource Generator. When you use this feature, your input parameters are transmitted to Anthropic solely to generate the requested content. Anthropic processes this data in accordance with its API usage policies. We do not send your email address or account identifier to Anthropic.
• Vercel, Inc. – website hosting, deployment, and analytics. Vercel processes request logs and analytics data and enters into DPAs compliant with GDPR.
• Render Services, Inc. – hosting for our API servers (EU region). Render processes server request logs, including IP addresses, and enters into DPAs compliant with GDPR.
• GitHub, Inc. – source code hosting and version control. No user personal data is intentionally stored in our code repositories.
• Google AdSense – advertising platform. Google may process data for ad targeting subject to your consent and Google's privacy policy. In the UK, EEA and Switzerland, advertising consent is collected through Google's certified consent management platform (IAB Transparency & Consent Framework).
• OpenStreetMap Foundation – map tiles used to display service and job listing locations. Loading a map on the Service sends your IP address directly to OpenStreetMap's servers. This is processed under OpenStreetMap's own privacy policy, not ours.

We implement appropriate technical and organisational measures including encrypted connections (HTTPS/TLS), access controls, and industry-standard security practices.

7. International Data Transfers

Some of our third-party providers operate outside the UK or European Economic Area (EEA). Where your personal data is transferred internationally, we ensure appropriate safeguards are in place, which may include:

• UK Adequacy Regulations (for countries deemed adequate by the UK government);
• International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs) approved by the ICO; or
• The provider's binding corporate rules or equivalent mechanism.

Specific examples: Vercel, Render, Auth0, Stripe, Cloudinary, and Anthropic are US-based (or US-owned) and rely on SCCs/IDTAs or equivalent mechanisms for UK data transfers.

8. Sharing Your Data

We share personal data only with:

• Service providers (listed in Section 6) – solely to the extent necessary to operate the Service.
• Other users of the Service – location data, contact details, and business information you include in public service or job listings may be visible to other users and members of the public.
• Legal authorities – where required by law, court order, or regulatory authority.
• Business transfers – in the event of a merger, acquisition, or sale of our business, your data may be transferred as part of that transaction. We will notify affected users in advance.

We do not share your data with advertisers directly. Google AdSense processes data independently based on your advertising consent.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access – request a copy of the personal data we hold about you.
• Right to rectification – ask us to correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) – request deletion of your personal data, subject to legal retention obligations.
• Right to restriction – ask us to limit how we process your data in certain circumstances.
• Right to data portability – receive your data in a structured, machine-readable format.
• Right to object – object to processing based on legitimate interests, including for direct marketing.
• Right to withdraw consent – where processing is based on consent (e.g. cookies, newsletter), you may withdraw at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at charlotte@mycobloom.co.uk. We will respond within one calendar month. There is no charge for exercising your rights unless requests are manifestly unfounded or excessive.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33. Where the breach is likely to result in a high risk to individuals, we will also notify affected users directly without undue delay.

11. Updates to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email (if you have an account) or by a notice on the website, and will update the “Last Updated” date above. Continued use of the Service after changes constitutes acceptance.

12. Contact Us

SENResource by MycoBloom Ltd
✉ Email: charlotte@mycobloom.co.uk
🌐 Website: https://senresource.com

A contact form is also available via the footer of the website.