Who we are
A Cubed Education (“A3”, “we”, “us”) is an IGCSE revision service operated by Amanah, registered at Sharjah Publishing City Free Zone Business Centre, Sharjah, United Arab Emirates. We are the data controller for the information described here, which means we decide what is collected and what happens to it.
You can reach us about anything in this policy at support@acubededu.com.
We are based in the UAE and this policy is written to meet Federal Decree-Law No. 45 of 2021 (the Personal Data Protection Law). Many of our students are in the UK and the EU, so we also honour the rights the UK GDPR and the EU GDPR give them, and we apply those rights to everyone rather than only to the people who can demand them.
What we collect and why
We collect the following, and nothing else. Each row gives the reason we are allowed to hold it under data protection law.
| Information | When | Why we may hold it |
|---|---|---|
| Your name, email address and password | You create an account | To perform our contract with you. The password is stored only as a bcrypt hash, so we cannot read it. |
| Whether you want update emails | You tick the box at signup | Your consent, which you can withdraw at any time. |
| Session and sign-in tokens | You log in | To perform our contract. Without them we cannot keep you signed in. |
| Which subjects you have access to, and until when | You subscribe | To perform our contract. |
| Your answers and your annotations — the pen and highlighter strokes you draw on a question, and any text you type into a text box on it | You use the annotation tool | To perform our contract. This is saved so your work is still there when you come back, and it drives the progress bars on the topic list. |
| Billing records: your Stripe customer and subscription identifiers, the plan you bought, the amounts charged, invoice references and renewal dates | You subscribe or change plan | To perform our contract, and to meet our tax and accounting obligations. |
| Your name, email, message, IP address and browser user-agent string | You send us feedback | Our legitimate interest in answering you and in tracing abuse of the form. |
| Your email address, IP address and user-agent | You join the waiting list | Your consent, plus our legitimate interest in preventing repeat submissions. |
| Your name, email, phone number and its country code, IP address and user-agent | You register for a live event | To perform our contract with you for that event, and to send you the joining details. |
| A counter tied to your IP address and a one-way hash of your email | You log in, or request a code | Our legitimate interest in stopping password guessing and email flooding. |
Giving us your name and email is a requirement of having an account. If you do not want to provide them, you can still browse the site and download past papers without registering.
What we do not do
There is no analytics on this site. No Google Analytics, no advertising or social media pixels, no session recording, no behavioural profiling, and no automated decision-making. We do not sell personal data, and we do not share it for anyone else's marketing.
The site also loads nothing from a third-party content network. Every font, script, stylesheet and image comes from our own servers, so reading a page does not hand your IP address to anyone else. The single exception is the checkout page, where the payment form is supplied by Stripe — and you only reach it by choosing to buy something.
Payments and card details
Your card number never reaches our servers. The payment form on our checkout page is supplied and hosted by Stripe, and your card details go straight from your browser to Stripe.
What comes back to us, and all we ever store, is the card brand, the last four digits and the expiry date, so we can show you which card is on file. We also keep the identifiers Stripe gives us for your customer record, your subscription and your invoices, along with the amount and currency of each charge.
Stripe handles your card details as a data controller in its own right, under its own privacy policy at stripe.com/privacy.
Where your data is held
Our database and files sit on Hostinger servers, and everything the site serves you comes from there. Stripe processes payments in the United States and Ireland, which may be outside your country.
Where data leaves the UK or the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses, which Stripe incorporates into its customer terms. Under UAE law, transfers are made to countries or organisations with an adequate level of protection, or under contractual safeguards, as Article 22 of the Personal Data Protection Law requires.
How long we keep it
| Data | Kept for |
|---|---|
| Your account, and the answers and annotations attached to it | As long as the account exists. We delete it within 30 days of you asking us to. |
| Sign-in tokens | Until they expire, or immediately when you log out. We keep at most two active sessions per account; a third signs out the oldest. |
| Billing and invoice records | 7 years after the transaction, because tax and accounting law requires it. These survive account deletion. |
| Feedback messages | 24 months |
| Event registrations | 12 months after the event |
| Waiting list entries | Until the relevant feature launches, or until you unsubscribe |
| Rate-limiting counters | 24 hours |
| Verification codes | 10 minutes, then discarded |
How we protect it
Passwords are stored as bcrypt hashes and are never written down in readable form, which is also why we can never tell you your password and can only reset it. The whole site is served over HTTPS.
Sign-in is rate limited: five failed attempts lock that account and address for fifteen minutes, and requests for verification codes are capped per hour by both email address and IP address. Session identifiers are regenerated when you log in, and an account may hold no more than two sessions at once. Video files are stored outside the public web directory and can only be reached through a script that re-checks your session and your subscription on every single request.
No system is completely secure. If a breach ever affects your personal data and creates a real risk to you, we will tell you and the relevant regulator without undue delay.
Your rights
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong, which for your email you can also do yourself in your account settings;
- delete your account and the data attached to it, subject to the billing records we are required to keep;
- restrict or object to what we are doing with your data, including anything we do on the basis of legitimate interests;
- send your data to another service in a portable format.
Where we rely on your consent, as we do for update emails, you can withdraw it at any time. Turn the newsletter setting off in your account, or use the unsubscribe link in any such email. Withdrawing consent does not affect anything we did before you withdrew it, and it does not stop the essential account emails such as verification codes and receipts, which we send because they are part of providing the service.
Email support@acubededu.com to exercise any of these. We will reply within 30 days. We do not charge for this, and we may ask you to confirm your identity first so that we do not hand your data to somebody else.
Students under 18
The site is built for students taking IGCSEs, so we expect many of our users to be under 18.
You must be at least 13 to hold an account. If you are under 18, a parent or guardian must have read this policy and our Terms and agreed to them on your behalf before you register or subscribe.
We do not knowingly collect data from anyone under 13. If you are a parent or guardian and believe a child under 13 has created an account, email us and we will delete it and the data attached to it.
A parent or guardian can exercise any of the rights in section 9 on behalf of a child in their care, on the same terms.
Changes to this policy
When we change this policy we update the date at the top of the page. If a change materially affects what we do with your data, we will email account holders before it takes effect rather than relying on you to notice the date.
Contact and complaints
Write to support@acubededu.com
If you are not happy with how we have handled your data or your request, you can complain to a data protection regulator. In the UAE that is the UAE Data Office. In the UK it is the Information Commissioner's Office at ico.org.uk. In the EU it is the supervisory authority for the country you live in. We would rather you came to us first so we have a chance to put it right, but you do not have to.
A Cubed Education is an independent educational resource platform and is not affiliated with or endorsed by Cambridge International. See the Terms and Conditions for the rules that govern your use of the site.