How do I manage my privacy and data?

How do I manage my privacy and data?

Your data is yours. The platform is built to be fully GDPR-compliant, and you have clear controls for everything from cookie consent to full account deletion.

GDPR data requests

At /data-request you can submit four types of request:

• Data export — receive a copy of everything we hold on you, in a portable format
• Data access — see exactly what data is linked to your account
• Data correction — request correction of inaccurate data
• Data deletion — request full erasure of your account and data

Requests are reviewed and actioned within the GDPR-mandated 30-day window. Most are handled much faster. Signed-in users can see the status of their own requests on the same page.

Account deletion

Full account deletion is a two-step flow that requires you to type DELETE and enter your password to confirm. Before you hit confirm, you'll see a warning explaining what will be deleted:

• Your profile and sign-in details
• Your booking history and lesson notes
• Your saved searches, favourites, goals, practice log
• Any GPS sessions and tracked data
• Your certificates issued by schools

Once deleted, the data is gone and cannot be restored. Bookings with past lessons are anonymised rather than deleted outright, because schools need accurate records for their own compliance.

Cookie consent

A cookie banner appears the first time you visit, with granular controls. You can accept all, reject non-essential cookies, or pick and choose. Change your preferences any time from the Cookie Policy page.

Essential cookies — the ones needed for the platform to work at all, like signing you in — are always on. Analytics and marketing cookies only load if you consent.

Two-factor authentication

Turn on two-factor authentication (2FA) for extra security on your account. See how to turn on two-factor authentication [blocked].

Connected accounts

If you signed in with Google, you can link or unlink that account any time from your account settings. You can also link multiple sign-in methods to one account (email/password plus Google, for example) so you're not dependent on any single provider.

Security

• HTTPS everywhere — every connection is encrypted
• No card data on our servers — payments go through Stripe; your card details never touch our systems
• Bot protection — Cloudflare Turnstile runs invisibly in the background; you'll rarely see a CAPTCHA
• Password strength check — a strength indicator tells you when your password is strong enough

If something happens

If you think your account has been compromised, change your password immediately, turn on 2FA if you haven't already, and email support. We can lock your account and investigate.