The short version
- Prismwell Group owns Yumio, our GCSE revision product at yumio.co.uk. This website, prismwell.group, is the group site. It does not have student accounts.
- Yumio collects what it needs to run: your account, your learning progress, your answers and uploads, and your conversations with our AI.
- We build our own AI models from existing open-weight foundation models. We fine-tune those models and inject curated knowledge into them, so they can teach, explain and mark more accurately for GCSE study. We also improve existing models and develop new ones.
- We retain the prompts and messages you send, together with the AI’s replies, so we can provide your history and so we can fine-tune, improve and create those models.
- Most of the time, generating an answer runs on servers we operate, using our adapted models and our own data. Sometimes we route a request to an existing hosted model.
- We do transfer relevant data outside England, particularly when that is needed to improve our AI and when a hosted model or another provider processes a request.
- We do not sell your data. We do not show adverts. We do not use your personal data to train third-party AI models.
- Yumio does not use your microphone and does not record or transcribe your voice.
- You can download your data or delete your Yumio account in Settings, and you can complain to the Information Commissioner’s Office (ICO).
1. Who we are
1.1 Prismwell Group is the group that owns Yumio. Yumio is our student-facing GCSE revision product. This website describes the group. The data controller for the personal data in this policy is Alexandro Ghanem, a sole trader trading as Prismwell Labs, in England and Wales (“we”, “us”, “our”). That means we decide how and why personal data is used, and we are responsible for protecting it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1.2 Our details:
- Postal address: Radcliffe, Greater Manchester, UK
- Group email: contact@prismwell.group
- Careers: careers@prismwell.group
- Privacy questions about Yumio: support@yumio.co.uk
- Legal notices and requests from courts, the police or regulators: legal@yumio.co.uk
- ICO registration number: registration pending
1.3 Transfer to Prismwell Labs Ltd. Alexandro Ghanem is operating as a sole trader until a limited company called Prismwell Labs Ltd is incorporated in England and Wales. When that happens, Yumio, your account, your subscription and your personal data will transfer to Prismwell Labs Ltd, which will become the data controller. It will continue to use your data only in the ways described in this policy. We will tell you before, or as soon as reasonably possible after, the transfer, and we will update this policy with the company’s details. The legal basis is our legitimate interest in continuing to provide the service through a company, and it is also necessary to keep providing the service under our contract with you.
1.4 We do not have a formal Data Protection Officer. Alexandro Ghanem is responsible for data protection and can be contacted at support@yumio.co.uk or contact@prismwell.group.
2. This website
2.1 prismwell.group is a public group website. It does not ask you to create an account, and it does not collect student learning data. If you email contact@prismwell.group or careers@prismwell.group, we receive whatever you send in that email.
2.2 When you visit this website, our hosting provider and, where used, our DNS and content delivery provider may process technical information such as your IP address, browser type, the pages you view and the time of the visit. We use this to deliver the site, keep it secure and understand that it is working. We do not use advertising or analytics cookies on this website.
2.3 This website loads fonts from Google Fonts. Google may see your IP address when your browser requests those fonts.
2.4 Prismwell Group also works on games and other AI systems. This policy covers the personal data we actually collect today through this website and through Yumio. If a future product collects personal data in a new way, we will update this policy before that happens.
3. Who Yumio is for
3.1 Yumio is made for UK GCSE students. Most users are aged 13 to 19, including students in Years 10 and 11 and students aged 17 to 19 who are resitting GCSEs.
3.2 If you are 13 or over, you can sign up yourself. We ask whether you are under 13, and we use your age band to set the right privacy settings.
3.3 If you are under 13, you can only use Yumio with the verified consent of a parent or carer. We ask for their email address, which must be different from yours, and send them a link to confirm the account. Until they confirm, social and interactive features are switched off. If they do not confirm within 14 days, we close the account and delete its data. A parent or carer can withdraw consent and ask us to delete the account at any time.
3.4 If we learn that a child under 13 is using Yumio without parental consent, we will suspend the account and delete the data unless consent is given.
4. The personal data we collect
On Yumio we collect the following types of personal data.
4.1 Account information. Your email address, password (stored as a secure hash, never in plain text), display name, age band, the date you accepted our terms, and two-factor authentication or remembered-device settings if you turn them on. Sign-in may use an email code. For under-13 accounts, the parent or carer’s email address and whether they have confirmed consent.
4.2 Profile information (optional). Your year group, school, subjects, exam boards, tiers, target grades, study goals and email preferences, if you choose to add them.
4.3 Learning data. Lessons you complete, quiz and flashcard activity, worksheets, mock exams, timings, marks, grade estimates, streaks, your revision plan, and the data held in Memory (the mistake tracker), such as the topics and question types you find difficult.
4.4 Your answers and uploads. Answers you type, handwriting and drawings on screen, whiteboard content, and photos, PDFs or other files you upload for help or marking.
4.5 Prompts, messages and AI responses. We store the prompts and messages you send to Yumio AI, together with the AI’s responses. This includes Ask Yumio, Teach me (including whiteboard steps), and marking requests (the question, your answer or uploaded work, and the mark and feedback returned). We also store short facts you ask the AI to remember about you. We retain this data to provide your history and to fine-tune, improve and develop our models, as explained in sections 6 and 7.
4.6 Voice and audio. Yumio does not use your microphone and does not record, store or transcribe your voice. There is no voice-call feature. Some features can read text aloud (text-to-speech), using your device’s built-in voice or our text-to-speech provider, ElevenLabs. Only the text to be read aloud is sent to that provider, never any audio from you. If the provider is not configured, the page uses the browser’s own voice on your device.
4.7 Paper Together and ranked mode. Your display name, room activity, answers, scores, whiteboard content and chat messages in Paper Together rooms. In ranked mode, your rating, results and match history.
4.8 Parent reports and emailed results. Where a parent report is set up, the parent or carer’s email address and the progress information included in the report. The email address that results are sent to.
4.9 Safety and support. Reports and blocks you make or that are made about you, messages flagged by our safety filters, messages you send to support, and bug reports (including any screenshots).
4.10 Payment information. If you buy a paid plan, our payment provider, Stripe, collects and processes your payment card details. We do not see or store your full card number. We receive a customer reference, your plan, payment and subscription status, billing country, and renewal or end dates.
4.11 Device and usage data. Your IP address, browser and device type, sign-in times, pages and features used, error logs, and counters of how much you use AI features (used to apply plan limits and fair use).
4.12 Search and media you ask us to look up. If you ask Yumio to search the web, we send the search query to our search providers. If you ask Yumio to make flashcards from a YouTube video, we fetch the public captions for that video. We do not download the video itself.
4.13 Information you should not give us. Please do not put sensitive or private information into chats, uploads or Paper Together, such as your home address, phone number, passwords, health information or private details about other people. If you mention sensitive information, it will be stored as part of your chat history, but we use it only to respond to you and, where needed, to keep you safe. We take reasonable steps not to use information of that kind for model development.
5. How we use your data
UK data protection law says we need a lawful basis for each way we use personal data. We rely on contract, legitimate interests, consent, legal obligation and, in rare cases, vital interests.
| What we do | Data used | Lawful basis |
|---|---|---|
| Create and manage your account, sign you in, keep it secure | Account information, device data | Contract; legitimate interests (security) |
| Check age and obtain parental consent for under-13s | Age band, parent or carer email, consent status | Legal obligation and legitimate interests (protecting children); consent of the parent or carer |
| Provide lessons, quizzes, flashcards, worksheets and mock exams | Learning data, answers | Contract |
| Provide Teach me, Ask Yumio, marking and revision plans | Messages, transcripts, answers, uploads, learning data | Contract |
| Store your prompts and AI replies so you can see your history | Prompts, messages, AI responses, marking requests | Contract |
| Fine-tune our models, improve existing models and develop new ones | Retained prompts, messages and AI responses, de-identified where possible | Legitimate interests (improving and building our models), with your right to object |
| Run Paper Together and ranked mode | Display name, answers, scores, chat, whiteboard content | Contract |
| Send parent reports and results you have asked for | Learning data, relevant email addresses | Consent or legitimate interests, as explained in section 9; contract for results you request |
| Take payment and manage subscriptions | Payment information | Contract; legal obligation (tax and accounting records) |
| Moderate content, handle reports and safeguard users | Messages, prompts and AI responses, reports, account information | Legitimate interests (safety); vital interests where someone is at serious risk |
| Apply usage limits and prevent abuse | Usage counters, device data | Legitimate interests |
| Send optional revision reminders and product updates | Email address, preferences | Consent |
| Transfer Yumio to Prismwell Labs Ltd on incorporation | All relevant data | Legitimate interests; contract |
6. How we build and use AI
6.1 Yumio uses artificial intelligence to explain topics, run Teach me sessions and the whiteboard, answer questions in Ask Yumio, read photos of your work, mark answers, help build flashcards and revision plans, and suggest what to study next.
Our own models
6.2 We develop and operate our own models. We do not rely only on a general-purpose system owned by someone else.
6.3 We start from existing open-weight foundation models. An open-weight model is a model whose learned parameters are published, so we can adapt it ourselves rather than only calling it as a black box.
6.4 We then fine-tune those models: we continue their training on data we select, including retained prompts and responses from Yumio, so the model becomes better at teaching, explaining, marking and staying on the kind of work GCSE students actually do.
6.5 We also use knowledge injection. That means we add curated subject knowledge into the model stack, so the model can draw on material we have prepared rather than depending only on whatever a general model already happens to know. We use this to improve accuracy, grounding and usefulness for GCSE study.
6.6 We use this work both to improve the models we already run and to develop new models of our own.
Where an answer is generated
6.7 Most of the time, inference (the step that generates an answer) runs on servers we operate, using our adapted models and our own data.
6.8 Sometimes we route a request to an existing hosted model. We do this when a specialised capability is needed, such as reading a photo, handwritten work or a diagram, when a fallback is needed, or when a hosted model is the better tool for that request.
6.9 When a request is routed to a hosted model, we send it through OpenRouter, which may pass it to providers such as DeepSeek, Google (Gemini) and Qwen. We send only what is needed for that request, such as your question, the relevant part of the conversation, the work you want marked, or the image you uploaded. We aim not to send your email address or other account details with these requests.
6.10 Where the provider allows it, we configure hosted text requests so the provider is not permitted to use that data to train its own models. Image requests may not always carry the same restriction, because of how those hosted services work. We do not use your personal data to train third-party AI models, and we do not share it with anyone so that they can train theirs.
6.11 Some Ask questions that need live facts may be sent to web search providers (Serper and DuckDuckGo, and sometimes a hosted model with a web tool). If you ask Yumio to use a YouTube video, we fetch the public captions. Those providers receive the query or the video address you gave us, not your password or card details.
6.12 We may use OpenAI’s moderation service, when it is switched on, to help detect harmful content in messages. That service receives the text being checked.
6.13 Automated decisions. Some things happen automatically, such as AI marking, ranked matchmaking and ratings, usage limits, and safety filters. None of these produces a legal effect on you or a similarly significant effect. An AI mark is not an official grade and does not affect your real exams. You can ask for a person to review any automated mark or decision by contacting us.
6.14 Profiling. Yumio uses your learning data to personalise your revision, for example to track mistakes and suggest topics. This stays inside Yumio. We do not use it for advertising.
6.15 AI can make mistakes. Marks and feedback are guidance, not official grades. If an AI output contains wrong information about you, you can ask us to correct it.
7. Stored prompts and model development
7.1 When you use Yumio AI, we store the prompts and messages you send, along with the AI’s responses. This covers Ask Yumio, Teach me (including whiteboard steps), and marking requests.
7.2 We retain this data to:
- Provide the service: so the AI can reply in context, mark your work, and continue a session where you left off (contract).
- Show your history: so you can look back at past chats, sessions and marked work (contract).
- Keep users safe: so our safety systems, and where needed a person, can detect and deal with harmful content, misuse and safeguarding concerns (legitimate interests; vital interests where someone is at serious risk).
- Check quality: so we can review answers, explanations and marks for accuracy and fix problems (legitimate interests).
- Fine-tune, improve and create models: we retain prompts and the AI’s replies so we can fine-tune our models, improve existing models and develop new ones, including through the open-weight adaptation and knowledge injection described in section 6 (legitimate interests).
7.3 When we use prompts for model development, we remove or replace names, email addresses and other direct identifiers where possible, limit access to authorised people, and do not use the data for advertising. We do not share it with third parties to train their models.
7.4 Your right to object. You can object to us using your prompts and AI responses to fine-tune, improve or create models by emailing support@yumio.co.uk. If you object, we will stop using your prompts and replies for that purpose and will remove them from active model-development datasets, unless we have compelling legitimate grounds, which in practice we do not expect to apply to model improvement. This will not affect your use of Yumio.
7.5 You can delete individual chats and sessions in Yumio where the product allows this. You can also ask us to delete your stored prompts and AI responses at any time by emailing support@yumio.co.uk. When you delete them, we remove them from your history and from our active systems within 30 days, they are removed from backups within a further 35 days, and we stop using them for quality review and model development. A model that has already been trained cannot be changed to remove what it learned, but we will not use your deleted data to train any further. Deleting your account deletes all of your stored prompts and AI responses in the same way.
8. Safeguarding
8.1 Our systems check messages in Ask Yumio, Teach me and Paper Together for signs that a user may be at risk of harm, and for harmful or abusive content. If a message suggests that you or someone else may be in danger, Yumio may show you support information, including Childline (0800 1111), Samaritans (116 123) and the advice to call 999 in an emergency.
8.2 Yumio is not an emergency service. In rare cases, where we believe there is a serious risk to someone’s life or safety, we may share relevant information with the emergency services, the police or other appropriate bodies, without asking first. We would do this only where necessary and proportionate, relying on vital interests or, where it applies, the safeguarding provisions of the Data Protection Act 2018.
8.3 A small number of authorised people may review flagged or reported content. Access is limited and logged.
9. Children’s data
9.1 We follow the ICO’s Age Appropriate Design Code (the Children’s Code). Our default settings for children include high privacy by default, limited sharing for under-16s, no location tracking, no adverts, no selling of data, optional emails off by default, and no design tricks to encourage children to share more data.
9.2 Profiles of users under 18 are private. School, year group and subjects are not shown to other students. Leaderboards show users under 16 anonymously. In Paper Together, free-text sharing may be limited unless everyone in the room is on the user’s friends list. If we do not know a user’s age, we treat them as under 16.
9.3 For users under 13, we rely on the consent of a parent or carer for the processing that requires consent. The parent or carer can review, change or withdraw consent and ask us to delete the account at any time.
9.4 Parent reports are optional. For users under 13, the parent or carer who gave consent can receive reports. For users aged 13 and over, reports are only sent if the student sets this up or agrees to it, and the student can see that reports are being sent.
9.5 In the UK, children aged 13 or over are usually considered mature enough to exercise their own data protection rights. A parent or carer can also make a request on behalf of a child where the child agrees, or where the child is not mature enough to understand their rights. We will always consider what is in the child’s best interests.
10. Who we share data with
10.1 We do not sell your personal data. We share it only when needed to run our services, when the law requires it, or to keep someone safe.
10.2 We use trusted providers who process data on our behalf, under written contracts that require them to protect it and use it only on our instructions. The providers used by the current products are:
- Supabase: database, authentication and file storage for Yumio.
- Railway: website and server hosting for Yumio and for this website.
- Cloudflare: DNS and delivery for prismwell.group, when that connection is in use.
- Stripe: payments. Stripe also acts as an independent controller for some payment data, such as fraud prevention, under its own privacy policy.
- Plunk: sending account emails, results, reminders and parent reports.
- OpenRouter: routing some AI requests to hosted models.
- Hosted model providers used through OpenRouter: these may include DeepSeek, Google (Gemini) and Qwen.
- OpenAI: optional content moderation.
- ElevenLabs: text-to-speech, receiving only the text to be read aloud.
- Serper and DuckDuckGo: web and, where used, image search for questions that need live facts.
- YouTube: public captions, only when you ask Yumio to use a specific video.
10.3 Information you share in Paper Together, ranked mode or other social features is visible to the other users in that room or match.
10.4 Where parent reports are set up, we share progress information with the parent or carer, as described in section 9.
10.5 We may share data with the police, courts, regulators or other authorities where the law requires it, or where necessary to protect someone’s safety. Legal requests should be sent to legal@yumio.co.uk.
10.6 Your data will transfer to Prismwell Labs Ltd when it is incorporated, as described in section 1.3. If Yumio or Prismwell Group is ever sold or transferred to another organisation, your data may be transferred with it, and they will be bound by this policy.
11. International transfers
11.1 We do transfer relevant personal data outside England. This happens in particular when we improve our AI, including fine-tuning, knowledge injection and the development of new or existing models, and when a hosted model or another provider processes a request on infrastructure outside the United Kingdom. Some providers store or process data in the European Economic Area, the United States or other countries.
11.2 Our database is hosted by Supabase. You can ask us which region it is in by emailing support@yumio.co.uk.
11.3 When personal data is transferred outside the UK, we make sure it is protected by at least one of the following:
- a UK adequacy decision, where the UK government has decided the country protects personal data to an adequate standard, including the UK Extension to the EU-US Data Privacy Framework for certified US organisations;
- the UK International Data Transfer Agreement (IDTA); or
- the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
11.4 You can ask us for more information about these safeguards by emailing support@yumio.co.uk.
12. How long we keep your data
We keep personal data only for as long as we need it.
| Data | How long we keep it |
|---|---|
| Prompts, messages and AI responses, including data used to fine-tune, improve and develop our models | Until you delete them or your account, or you object to model-development use as described in section 7, whichever is sooner. Removed from active systems within 30 days of deletion and from backups within a further 35 days. |
| Account, profile, learning data, answers, uploads, Memory data, revision plan | While your account is open. Deleted within 30 days of you deleting your account, and removed from backups within a further 35 days. |
| Accounts that are not used | Deleted after 2 years without a sign-in. We will email you a warning first. |
| Under-13 accounts without parental confirmation | Closed after 14 days and deleted. |
| Paper Together rooms (including chat and whiteboard content) | Up to 90 days after the room was last used, then deleted, unless a message has been reported or flagged for safety review. |
| Ranked match records | A short record of matches is kept for 14 days. Your rating and recent results are kept while your account is open. |
| Unfinished drafts of mock exams | Up to 14 days. |
| Sign-in records (time, IP address, device) | 14 days. |
| Daily AI usage counters | 2 days. |
| Safety reports, flagged messages and blocks | Blocks last while your account is open. Reports and flagged messages are kept for 12 months after they are closed, or longer if needed for safety or legal reasons. |
| Support messages and bug reports | 24 months. |
| Payment and transaction records | 6 years after the end of the tax year they relate to, as required by tax law. |
| Emails you send to our group or careers addresses | As long as needed to reply and, if relevant, to manage a hiring or business enquiry. |
| Technical logs for this website | Only as long as needed to operate and secure the site. |
Where the law requires us to keep data for longer, or where it is needed for a legal claim or safety investigation, we may keep it for longer than shown above. Data that has been fully anonymised, so it can no longer identify you, is no longer personal data and may be kept after these periods.
13. How we keep your data safe
13.1 We use appropriate technical and organisational measures, including encrypted connections (HTTPS), passwords stored as secure hashes, optional two-factor authentication and sign-in alerts, access controls, limits on repeated actions, checks on uploaded files, and written contracts with our processors.
13.2 No online service can be completely secure. Please use a strong, unique password and turn on two-factor authentication.
13.3 If a personal data breach is likely to result in a risk to people’s rights, we will report it to the ICO within 72 hours of becoming aware of it. If there is a high risk to you, we will tell you (and, for users under 18, where appropriate, a parent or carer) without undue delay.
14. Your rights
14.1 Under UK data protection law, you have the right to access your data, have inaccurate data corrected, have data deleted in certain circumstances, ask us to limit how we use it, object to uses based on legitimate interests (including model development), receive data you gave us in a portable format, withdraw consent where we rely on it, and ask for a person to review an automated decision.
14.2 In Yumio Settings, you can download a copy of your data and delete your account. You can delete individual chats, sessions, notes and flashcard decks where the product allows this. You can object to model-development use as described in section 7. You can email support@yumio.co.uk or write to us at Radcliffe, Greater Manchester, UK.
14.3 We may need to check your identity, or a parent or carer’s authority, before acting. We will respond within one month. If a request is complex, we may extend this by up to two further months, and we will tell you why. Requests are normally free.
15. Cookies and similar technologies
15.1 Yumio uses only cookies and device storage that are strictly necessary for the service to work. Under the Privacy and Electronic Communications Regulations 2003, we do not need consent for these, but we must tell you about them.
15.2 On Yumio these include:
- yumio_session: keeps you signed in;
- yumio_refresh: renews your sign-in when it expires;
- local device storage: your sign-in tokens, theme, whether you have signed in before, your email if you tick “Remember email”, offers you have dismissed, and unfinished drafts so you do not lose work.
15.3 Stripe may set its own strictly necessary cookies on its checkout pages to process payments and prevent fraud.
15.4 We do not use advertising, analytics or tracking cookies on Yumio or on this website. If we ever want to use non-essential cookies, we will ask for your consent first.
15.5 Some pages load fonts or code from other services, which can see your IP address when this happens. This website loads fonts from Google Fonts.
15.6 You can clear cookies and site data in your browser settings. On Yumio, that will sign you out.
16. Emails
16.1 We send emails that are needed to run your Yumio account, such as sign-in codes, security alerts, receipts, renewal reminders, results you have asked for, and important changes to this policy. You cannot opt out of these while you have an account.
16.2 Revision reminders, tips and product updates are off by default. We only send them if you turn them on. You can turn them off in Settings or by using the unsubscribe link.
16.3 We do not send marketing on behalf of other companies, and we do not share your email address with advertisers.
17. Your right to complain
17.1 If you are unhappy with how we have handled your personal data, please contact us first at support@yumio.co.uk or contact@prismwell.group so we can try to put it right. We will acknowledge your complaint within 30 days and respond without undue delay.
17.2 You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:
- Website: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
18. Exams and exam boards
Yumio is not affiliated with, endorsed by or connected to AQA, Pearson Edexcel, OCR, WJEC Eduqas or any other exam board. Yumio marks and grade estimates are guidance, not official results.
19. Changes to this policy
We may update this policy when our products, the law or our providers change, including when Yumio transfers to Prismwell Labs Ltd. The date at the top shows the latest version. If we make an important change, we will tell you in Yumio or by email before it takes effect, and we will explain it in plain language for younger users. Where a change requires your consent, we will ask for it.
20. Contact us
- Data controller: Alexandro Ghanem trading as Prismwell Labs (transferring to Prismwell Labs Ltd on incorporation)
- Group: Prismwell Group, which owns Yumio
- Postal address: Radcliffe, Greater Manchester, UK
- Group email: contact@prismwell.group
- Careers: careers@prismwell.group
- Yumio privacy: support@yumio.co.uk
- Legal notices: legal@yumio.co.uk
- ICO registration number: registration pending
- Websites: prismwell.group and yumio.co.uk