TicknClick Privacy Policy

Operator: Cold Boot Ltd (“we”, “us”). Effective date: 22 October 2026. Last reviewed: 22 October 2026.

1. Who is responsible

Cold Boot Ltd operates TicknClick at ticknoflick.com. For account, billing, security and website data we decide why and how personal information is used and act as controller. A teacher or school will ordinarily decide why student work is marked and which work is uploaded. Where we handle that work only to provide the teacher’s instructions, we act as processor for the school or teacher, who must have authority to provide it. If we use submitted work for our own service improvement or model training, we may determine a separate purpose and act as a controller for that use. Roles depend on the actual processing, not this label.

Contact: j.k.dingsdale@gmail.com · 2A Westbourne Road, Southport, PR8 2JU.

2. Information we handle

We handle teacher account details (username, email address, password hash and account settings); uploaded student work and mark schemes; extracted text; generated suggested marks, feedback and uncertainty flags; teacher edits, review history, marking-set details and exports; and credit balance, purchase and payment-reference information. Pro features may also contain class lists, student names and email addresses, results and teacher-authored messages.

We receive account details from you. Student information normally comes from the teacher or school that uploads or enters it. Payment status and references come from Stripe; we do not receive or store full card numbers. Technical logs and security records may include IP address, request time and authentication events. Do not upload special-category information unless the school has assessed and authorised that use.

3. What we use information for and our legal grounds

We use teacher account and service data to create and secure accounts, provide marking and review, save results, support exports, manage credits and respond to requests. This is necessary to provide the service contract. We use necessary access and security records for legitimate interests in operating and protecting the service, subject to individuals’ rights. We retain billing records where required by law and use transaction data to administer purchases and prevent fraud.

Our current service sends each student's work and its mark scheme to the OpenAI API to generate draft marks and feedback, as instructed by the teacher. OpenAI says API data is not used to train or improve its models by default, unless the customer opts in. OpenAI may retain API content in abuse-monitoring logs for up to 30 days by default, subject to stated exceptions. Cold Boot Ltd will not opt in to provider model training using student submissions. See OpenAI's API data controls. Contact us for current supplier and transfer information before uploading student work.

Service improvement and model training

We may use submitted work, mark schemes, generated outputs and teacher corrections to assess, debug and improve TicknClick, including by training or fine-tuning models for this service. This is a separate use from marking a set. We will use identifiable student work for this purpose only where we have documented a valid lawful basis, clearly informed the responsible school or teacher and affected people as required, and obtained the school’s express written authorisation for this additional use. A privacy-policy statement or a teacher’s ordinary upload authorisation alone does not provide that permission or establish a lawful basis. Until those conditions are met, identifiable submissions will not be used to train or fine-tune models. Where possible, we will use genuinely anonymised or synthetic material. Pseudonymised data remains personal data. We will not sell student work, use it for advertising, or permit an AI provider to use it for its own model training. Any provider used for this improvement activity must be contractually restricted to our documented instructions and comply with applicable law.

This improvement use will not begin until a documented assessment, suitable school/customer terms, provider restrictions and clear notices are in place. Where consent is the selected lawful basis, it must be freely given, specific, informed, withdrawable and obtained from the person legally able to give it; additional rules apply when children’s information is involved. You can contact us to ask whether this use is active and to object or exercise applicable rights.

4. Sharing

We share the minimum necessary information with: OpenAI through its API for marking requests; Stripe for credit checkout, payment processing and invoices; infrastructure and hosting providers that store or transmit the application and its data; and email providers if Pro feedback-email delivery is enabled. We may disclose information when legally required or to protect the service and people using it. We do not sell personal information or share it for advertising.

The teacher or school controls whether exports or feedback are downloaded or sent to students. A teacher who emails feedback is responsible for checking the recipient and having a suitable basis to send it. We do not currently operate Pro email delivery on production.

5. International transfers

Some suppliers may process information outside the UK. Before any such transfer, we will identify the destination and ensure a valid UK transfer mechanism and any required risk assessment or supplementary safeguards are in place. Contact us for current supplier and transfer information.

6. How long we keep information

We keep account information while an account is active and as needed to administer it. We do not currently offer self-service deletion or a fixed automatic deletion period for marking submissions. Contact us to request closure of your account or deletion of its data. We will remove data we no longer need, subject to legal requirements and the time needed for secure deletion from backups and supplier systems. Purchase and credit-ledger records may be retained as needed for accounting, tax, fraud prevention and disputes. Security throttling records expire after their short configured window.

7. Security

We use account authentication, access controls, encrypted HTTPS connections, security monitoring and restricted server access. No internet service is completely secure. Teachers must protect account credentials and upload only information they are authorised to provide. Contact us promptly if you suspect unauthorised access.

8. Your rights and requests

Depending on the circumstances and our role, individuals may have rights to access, correct, erase, restrict or object to processing, data portability, and to complain to the UK Information Commissioner's Office. Where we act as a school’s processor, we will refer requests to the controller and assist it as required by our agreement. Where we act as controller, contact us using the details above. If processing relies on consent, that consent can be withdrawn for future processing; withdrawal does not affect prior lawful processing.

9. Children and school data

Teachers and schools must have authority to use the service and share student work for marking. Remove student names and other identifying information where they are not needed. The service does not identify students from handwriting and does not make final educational decisions: a teacher must check all suggested marks and feedback. Uncertainty flags can miss errors. Schools should consult their data protection lead, assess the AI provider, explain the use to students and families, and put an appropriate data-processing agreement in place before use.

10. Cookies and changes

The service uses cookies required for sign-in, security and session management. We do not currently use advertising cookies. If this changes, we will update this policy and obtain consent where required. We may update this policy to reflect service or legal changes. We will post the new version and effective date here and give direct notice where a material change requires it.

11. Contact

For privacy questions, rights requests or complaints, contact j.k.dingsdale@gmail.com or write to Cold Boot Ltd, 2A Westbourne Road, Southport, PR8 2JU.