Privacy Policy

Who we are

Class4 Ltd, trading as BookBand.co.uk ("we", "us") operates the BookBand service at bookband.co.uk — an AI-assisted book band finder for UK teachers. We are the data controller for the personal data described in this policy. You can contact us at info@class4.co.uk.

What we collect

• Account data — your email address and sign-in credentials when you create an account (directly or via Google sign-in).
• Library data — books you save, favourites and tags you add.
• Usage data — searches you make. For visitors who are not signed in, we store a one-way hashed (anonymised) form of your IP address to enforce the daily free-search limit; we cannot recover your IP address from it.
• Support messages — anything you send us when you contact us.

Payment details (card numbers, billing address) are collected and processed by our payment provider Paddle, not by us. We never see or store your card details.

How we use your data and our legal basis

• Providing the service (contract performance): running your account, saving your library, processing searches.
• Security and abuse prevention (legitimate interests): enforcing usage limits and protecting the service.
• Customer support (legitimate interests): responding to your requests.
• Legal obligations: keeping records where the law requires it.

We do not sell your data and we do not use it for advertising.

Who we share it with

• Paddle — our Merchant of Record, for payments, subscription management, tax compliance and invoicing.
• Hosting and database providers — who store the service's data on our behalf.
• Google — if you choose to sign in with Google.
• Open Library — book searches are looked up against their public catalogue; only the book title/author you search for is sent.
• Authorities — where required by law.

International transfers

Some of our service providers process data outside the UK/EEA. Where this happens we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

Retention

We keep your account and library data while your account is active. If you delete your account we delete or anonymise your personal data within a reasonable period, except where we must keep records by law. Hashed IP usage records are kept only as long as needed to enforce daily limits.

Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to our processing of your personal data, and the right to data portability. You can withdraw consent where processing is based on consent. To exercise any of these rights, email info@class4.co.uk — we respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO).

Security

We use appropriate technical and organisational measures, including encryption in transit and access controls, to protect your data.

Cookies

We use only essential cookies/storage needed to keep you signed in and run the service. We do not use analytics or marketing cookies.

Changes

We may update this policy from time to time. The "last updated" date at the top shows the current version.