Privacy
Last updated 7 November 2026.
Enigma Media Ltd ("we"), Triq Claire Engel 79, M1, STJ1815 St Julians, Malta, is the data controller.
What we store
About the parent: email address, password (hashed, never readable by us), name, payment records (handled by Stripe; we never see the card number), the emails we send you.
About each child: first name, year group, planned SEC subjects, login name, course progress, time spent on the platform per day per course, every answer given (typed text and photographs of handwritten work), the marks and written feedback on those answers, test and mock scores, and the devices the login is used on.
Why
To run the course, mark the answers, show the parent dashboard, send the weekly email, and keep the account secure. From 2027, with your separate consent, to collect and publish aggregated SEC results.
Who sees it
- You, in the parent dashboard.
- Your child, inside the course.
- Anthropic PBC, the provider of the AI that marks answers. Each answer, together with the question and the marking pattern, is sent to Anthropic for marking. Anthropic's commercial terms do not permit it to train on this data.
- Stripe for payments and Resend for email delivery.
- Us, to run the service and respond to support requests.
Nobody else. We do not sell data, do not run advertising, and do not share data with schools, MATSEC or anyone else.
Where
On our server with Hetzner in the European Union, backed up nightly. Anthropic and Stripe process data under EU data-transfer agreements.
Children
Student accounts are created by, and under the responsibility of, a parent or legal guardian, who consents at sign-up to the storage and marking described here. Students never enter payment details.
How long
Until 30 September of the student's exam year plus 12 months, then deleted, unless you ask earlier. Payment records are kept as long as Maltese tax law requires.
Your rights
You can ask to see, correct, export or delete everything we hold about you and your children. Email us from your account email. You can complain to the Information and Data Protection Commissioner (idpc.org.mt).
Cookies
One session cookie to keep you logged in. No tracking cookies, no analytics that identify you.