Privacy Policy

This Privacy Policy explains how Nested Learning Ltd collects, uses, stores and shares personal data.

It applies to our website, enquiries, customer communications, AI-assisted learning tools, consultancy services, course-related services, and related digital products.

This is a working privacy notice. It should be reviewed periodically as our services, suppliers and institutional contracts develop.

Privacy-by-design

Nested Learning treats privacy as a design principle rather than a compliance exercise. We aim to minimise unnecessary personal data, reduce reliance on directly identifying information, and embed privacy considerations throughout product design, development and governance as the platform evolves.

Who we are

Nested Learning Ltd operates the website at: www.nestedlearning.uk

For website, marketing, enquiry, direct customer and commercial administration purposes, Nested Learning Ltd is the data controller.

Contact for privacy matters:

info@nestedlearning.uk

Registered office:

148 Rose Bowl, Portland Crescent, Leeds, England, LS1 3HB

Company number:

16741692

Institutional deployments

Where Nested Learning provides AI Tutor, learning analytics, reporting or related services to a university, college, training provider, employer or other organisation, the data-protection role may differ.

In those cases:

the institution will usually be the data controller for learner records, learner access, learning activity and institutional reporting
Nested Learning may act as a data processor, processing personal data only on the institution’s instructions
the relevant contract, data-processing agreement or pilot agreement will define the exact roles, purposes, retention periods, access controls and support arrangements

This Privacy Policy covers our general public website and direct services. Institutional deployments may also be covered by a separate data-processing agreement or service-specific privacy notice.

Where AI Tutor is used through a university, college, training provider, employer or other host institution, core institutional records normally remain within the institution’s own systems. This may include learner names, email addresses, enrolment records, assessment records, course records, tutor records, VLE records and formal student-support records.

Nested Learning does not need to receive learner names or email addresses to create an AI Tutor session where pseudonymous launch is enabled. The institutional handoff can use pseudonymous session or user identifiers, organisation identifiers, course context, rulebook settings and learning-mode settings instead.

The host institution remains responsible for its own learner records, VLE records, assessment records and internal student-support records. Nested Learning processes only the information needed to provide the AI Tutor service, generate tutor responses, support reporting where enabled, maintain security and provide technical support.

Personal data we collect

We collect only the personal data needed to provide, secure, support and improve our services.

The data we collect may include the following.

Website and technical data

When you visit our website, we may collect:

IP address
browser type and version
device type
operating system
time-zone setting
pages visited
referring pages
interaction patterns
error logs
security logs

We use this information to maintain website security, diagnose problems, prevent abuse, understand service performance and improve the website.

Comments

If comments are enabled and you leave a comment, we may collect:

the information you enter in the comment form
your IP address
browser user-agent details
information needed for spam detection

An anonymised hash of your email address may be shared with the Gravatar service if that feature is active. If your comment is approved, your profile image may appear beside your comment.

Forms, enquiries and account interactions

When you complete a form, contact us, register interest, request support, sign up for updates, book a service, create an account or ask about a product, we may collect:

name
email address
phone number, if supplied
organisation, if supplied
role or job title, if supplied
location, if relevant to the service
enquiry details
service preferences
account details
information you choose to provide

We use this information to respond to your request, provide the service, manage the relationship, administer accounts, provide support and keep appropriate records.

Course, learning and consultancy services

If you use a Nested Learning course, learning product, consultancy service, pilot, demo, trial or advisory service, we may collect information relevant to that service, such as:

service access records
learning activity
submitted responses
progress information
feedback records
support requests
attendance or participation information
customer or organisation details
billing and service administration records

We collect this information only where needed to provide the service, manage the customer relationship, support users, improve the product and meet legal or contractual obligations.

AI-assisted learning tools

If you use an AI-assisted learning tool, chatbot, AI Tutor, mock examiner, feedback assistant or similar service, we may collect:

prompts, questions or responses you submit
AI-generated responses
uploaded or pasted text, where enabled
session timestamps
usage logs
learning-mode or rulebook settings
session summaries or reports, where generated
pseudonymous user or session identifiers, where supported
organisation identifiers, where relevant
course or service context, where relevant
technical logs needed for security, troubleshooting and abuse prevention

AI Tutor interactions are processed on Nested Learning’s servers. This may include the learner’s submitted text, AI-generated responses, timestamps, pseudonymous session identifiers, learning-mode settings, rulebook settings, technical logs, generated summaries and session-analysis outputs.

Some information remains with the host institution and some information is processed by Nested Learning. The host institution normally holds the formal learner identity and institutional record. Nested Learning processes the AI Tutor session data needed to run the service.

We use this information to provide the AI service, generate responses, support learning activity, create reports where enabled, monitor safety, detect misuse, diagnose technical issues and improve service quality.

Where reporting is enabled, Nested Learning may generate session summaries, learning-support indicators or reports from AI Tutor interactions. These reports may be made available to the host institution, depending on the service configuration and agreement.

Where possible, AI Tutor services are designed to reduce the use of directly identifying personal data. Users should avoid entering unnecessary personal data, names, email addresses, student numbers, health details, financial details, immigration details or confidential information unless the service explicitly requires it.

AI outputs are generated for learning, support and advisory purposes. They should not be treated as final academic, legal, medical, immigration, financial or professional decisions.

Partner, referral and student-recruitment interactions

If you request partner introductions, programme matching, student-recruitment support, referral services or affiliate-linked services, we may collect information needed to respond to that request.

This may include:

contact details
education background
course interests
career interests
location or preferred study destination
eligibility information
information you voluntarily provide

We will share this information with third parties only where this is necessary to provide the requested service, where you have consented, or where another lawful basis applies.

Where a university, college, broker, agent, visa adviser, affiliate partner or other third party receives your data as an independent controller, that organisation is responsible for its own use of your personal data.

Payments and purchases

Where payments are made, payment processing is handled by third-party payment providers. We do not normally store full payment card details.

We may keep transaction records, invoices, order details, licence records and support records for accounting, legal, contractual and customer-service purposes.

Special category data

We do not normally ask for special category data.

Special category data includes information about health, ethnicity, religion, political opinions, trade union membership, genetic or biometric data, sex life or sexual orientation.

If you voluntarily include this type of information in a form, uploaded document, AI prompt, message or support request, we will handle it carefully and only where we have a lawful basis and, where required, a separate condition under data-protection law.

You should not submit special category data unless it is clearly necessary for the service being requested.

How we use personal data

We use personal data to:

respond to enquiries
provide requested services
operate AI-assisted learning tools
create learning reports or session summaries where enabled
administer accounts and access
provide customer support
manage pilots, trials, courses and consultancy work
process orders, invoices and payments
send service messages
send marketing only where legally permitted
manage referrals or partner introductions where requested
improve website and product performance
monitor security and prevent misuse
diagnose technical issues
maintain records
meet legal, regulatory and contractual obligations

We use AI Tutor session data to provide tutor responses, support learner feedback, generate reports where enabled, troubleshoot technical issues, monitor service performance, prevent abuse, and support authorised institutional review where agreed.

We may generate learning summaries, session analyses or inferred learning-support indicators from tutor interactions. These are used to support feedback, reflection, reporting, service improvement and tutor or institutional insight where enabled. They should not be treated as formal assessment decisions unless a separate service agreement says otherwise.

We do not treat AI Tutor telemetry as a formal institutional assessment record. Formal assessment, enrolment, progression and student-record decisions remain the responsibility of the host institution unless a separate agreement states otherwise.

We do not sell personal data.

We do not use learner AI interactions for unrelated marketing.

We do not use personal data to train a general-purpose AI model unless this is clearly explained, lawful, and supported by an appropriate lawful basis.

Lawful bases for processing

We rely on different lawful bases depending on the activity.

Contract or steps before a contract

We use this basis where processing is needed to provide a service, respond to a service request, administer an account, deliver a course, manage a consultancy relationship, provide technical support, process a purchase or take steps before entering into a contract.

Consent

We use consent for optional marketing, newsletters, some cookies, optional partner communications, optional affiliate communications, and any other activity where consent is the most appropriate lawful basis.

You can withdraw consent at any time.

Legitimate interests

We may use legitimate interests for website security, fraud prevention, service monitoring, product improvement, customer support, internal administration, analytics based on appropriate safeguards, and maintaining business records.

Where we rely on legitimate interests, we consider whether our interests are overridden by your rights, freedoms and reasonable expectations.

Legal obligation

We use this basis where processing is needed to meet legal duties, maintain statutory records, respond to lawful requests, manage tax and accounting obligations, or comply with applicable regulation.

Cookies and similar technologies

Our website may use cookies and similar technologies.

These may include cookies, scripts, tags, tracking pixels, web storage or other technologies that store information on, or access information from, your device.

Essential cookies

Essential cookies are needed for the website to work. They may support:

page navigation
log-in sessions
account access
security
load balancing
form protection
consent management
fraud prevention

These cookies do not require consent.

Non-essential cookies

Non-essential cookies are used only where legally permitted and, where required, after you give consent.

These may include:

analytics cookies
performance cookies
personalisation cookies
embedded media cookies
marketing cookies
affiliate-tracking cookies

You can accept, reject or change non-essential cookie choices through the cookie-consent tool where available.

We do not rely on implied consent. Continuing to use the website is not treated as consent to non-essential cookies.

Embedded content and third-party tools

Pages may include embedded content or third-party tools, such as videos, course catalogues, AI widgets, forms, analytics tools, social-media posts or external learning resources.

Embedded content may behave as though you have visited the third-party website directly. Those third parties may collect data, set cookies or track interactions according to their own privacy policies.

You should review the privacy information provided by those third parties.

AI service providers

Some AI-assisted services may rely on third-party AI, hosting, infrastructure or analytics providers.

Free-text learner input submitted to AI Tutor may be sent from Nested Learning’s servers to third-party AI providers so that a response can be generated. Where this happens, Nested Learning aims to minimise unnecessary personal data and uses appropriate contractual and technical safeguards.

Where AI service providers process personal data for us, we use appropriate contractual, technical and organisational safeguards. These may include data-processing terms, access controls, data minimisation, pseudonymous identifiers and restrictions on unnecessary personal data.

We do not design AI Tutor sessions to require directly identifying learner information. In institutional settings, tutor sessions may be associated with pseudonymous identifiers, organisation identifiers, course context, rulebook settings or learning-mode settings rather than names or email addresses.

Where an institutional customer uses our AI Tutor or related services, the relevant contract or data-processing agreement may provide further details about AI providers, processing roles, retention settings, reporting access and security controls.

Marketing and communications

We may send service messages where needed to provide a service, administer an account, manage a purchase, support a trial, or respond to a request.

We send marketing emails only where legally permitted.

This may be:

where you have given consent
where the soft opt-in applies because you bought, requested or expressed interest in similar products or services and were given a clear chance to opt out
where business-to-business marketing rules permit contact, subject to your right to opt out

Every marketing message will include a way to unsubscribe or object to further direct marketing.

We do not treat all enquiries as open-ended marketing permission.

Affiliate and partner communications

We may send affiliate, referral or partner-related communications only where legally permitted.

This may include information about:

partner services
relevant courses
discount codes
referral opportunities
educational products
limited offers
related services

We will use consent where required. You can unsubscribe or withdraw consent at any time.

Sharing personal data

We may share personal data with the following categories of organisations where necessary and lawful:

hosting providers
website and security providers
email and communications providers
CRM and customer-support systems
analytics providers, where permitted
payment processors
professional advisers
AI service providers
educational partners, where requested
referral or affiliate partners, where permitted
universities, colleges or training providers, where requested
regulators, courts, public authorities or law-enforcement bodies where required by law

Where AI Tutor is provided for a host institution, session reports, summaries, safeguarding alerts, support information or diagnostic information may be shared with authorised contacts at that institution where this is necessary for the service, learner support, security, safeguarding, troubleshooting or contractual reporting.

Where safeguarding, serious-risk, abuse-prevention or incident-response features are enabled, relevant information may be shared with a configured authorised recipient or responsible organisation. This may include the user’s message content and technical information needed to understand the concern. This sharing is limited to situations where it is necessary and lawful.

Nested Learning does not routinely share AI Tutor session content with unrelated third parties for marketing. AI Tutor session content is used for service delivery, support, safety, reporting where enabled, security and product improvement, subject to the relevant agreement and lawful basis.

We share only the information needed for the relevant purpose.

Third-party organisations must handle personal data lawfully. Where they act as processors for us, they must process personal data only under appropriate contractual controls.

International transfers

Some suppliers or service providers may process personal data outside the United Kingdom.

Where this creates a restricted transfer under UK data-protection law, we use appropriate safeguards where required.

These may include:

UK adequacy regulations
the UK International Data Transfer Agreement
the UK Addendum to the EU Standard Contractual Clauses
another lawful UK transfer mechanism
a data protection test or transfer risk assessment where required
additional technical and organisational protections

Retention

We keep personal data only for as long as needed for the purpose for which it was collected, unless a longer period is required by law, contract, dispute management, accounting, security or legitimate business needs.

Typical retention periods are:

comments: retained while comments remain published or needed for moderation
website logs: retained only as long as needed for security and operational purposes
enquiry records: normally up to 24 months unless the relationship continues
customer and account records: retained while the account or service relationship continues
course, pilot or learning-service records: retained according to the relevant service terms, customer agreement or institutional agreement
AI interaction records: retained only as needed for service delivery, safety monitoring, reporting, support, product improvement or contractual obligations
AI Tutor transcripts, session summaries, learning reports, telemetry and diagnostic records: retained according to the relevant service configuration, customer agreement, pilot agreement or data-processing agreement
marketing-consent records: retained until consent is withdrawn or the record is no longer needed
payment, invoice and contractual records: normally retained for statutory accounting periods, usually up to six years

Where an institutional customer controls learner data, retention may be defined by the institutional contract or data-processing agreement.

The host institution may set or agree retention periods for AI Tutor session data, reports and summaries where it controls the deployment. Nested Learning retains AI Tutor data only for as long as needed for service delivery, support, reporting, safety monitoring, security, legal obligations or the relevant customer agreement.

Security

We use technical and organisational safeguards to protect personal data.

These may include:

encryption in transit
access controls
admin-limited access
pseudonymous session identifiers where supported
tenant or organisation-level scoping where supported
server-side storage of secrets
short-lived session or access tokens where used
restricted administrative functions
secure hosting arrangements
monitoring and logging
malware and abuse-prevention measures
data minimisation
supplier review
internal security checks
deletion or clean-up of temporary files where relevant

Tenant or organisation-level scoping is used where supported, so that AI Tutor data is associated with the relevant organisation and is not intentionally mixed with unrelated customer environments.

Operational telemetry is designed to reduce unnecessary exposure of learner content. Usage monitoring may record model used, token counts, timing, timestamps, errors and service status rather than full tutor conversation text.

Security and diagnostic features are designed to reduce unnecessary exposure of learner content. Technical monitoring generally focuses on service status, timing, model usage, token counts, error states and access events.

Some AI Tutor records, including submitted text, AI-generated responses and generated summaries, may need to remain readable by authorised systems so the service can provide feedback, reporting, safeguarding review, support or incident investigation. These records are protected through access controls and organisational safeguards rather than being treated as end-to-end encrypted private messages.

No online system can be guaranteed completely secure. We work to reduce risk through proportionate security controls and regular review.

Unless expressly stated, we do not claim to hold Cyber Essentials, ISO 27001, SOC 2, a formal WCAG audit certification, or equivalent external certification.

Your rights

Under UK data-protection law, you may have the right to:

access your personal data
correct inaccurate or incomplete data
request erasure
restrict processing
object to processing
request data portability
withdraw consent
object to direct marketing
complain to the Information Commissioner’s Office

To make a request, contact:

info@nestedlearning.uk

We may need to verify your identity before responding.

If your data is controlled by an institution using Nested Learning services, we may refer your request to that institution or work with them to respond.

Automated decision-making

We do not use AI-assisted learning tools to make solely automated decisions that have legal or similarly significant effects on users.

AI outputs may support learning, feedback, reflection, reporting or tutor insight. Human judgement remains important, especially in educational, assessment, employment, immigration, financial, legal, medical or safeguarding contexts.

AI Tutor outputs may include inferred feedback, confidence indicators, learning needs, suggested next steps or session summaries. These outputs are intended to support learning and human review. They are not intended to make solely automated decisions with legal or similarly significant effects.

Children and young people

Our services are not intended for children unless provided through an appropriate institution, parent, guardian or authorised organisation.

Where services are used by younger learners through an institution, the institution is usually responsible for ensuring that the use of the service is lawful and that appropriate notices, consents or safeguards are in place.

Privacy governance and continual improvement

We review our privacy governance as the platform evolves. This includes the ongoing development of retention schedules, data-processing agreements, subprocessor information, data subject request procedures, privacy impact assessments where required, and supporting assurance documentation.

Changes to this policy

We may update this Privacy Policy to reflect changes in law, technology, suppliers, services or business practices.

The latest version will be published on this website.

Contact

For privacy-related matters, contact:

info@nestedlearning.uk

Nested Learning Ltd

148 Rose Bowl, Portland Crescent, Leeds, England, LS1 3HB

Company number 16741692

Policy last updated: June 2026

Supporting privacy documentation and assurance information may be made available to customers as part of procurement and due diligence processes.

Privacy Principles at-a-glance

Privacy principle	Current approach
Data minimisation	AI Tutor is designed to operate using pseudonymous identifiers where possible, reducing the need for directly identifying learner information.
Purpose limitation	Personal data is processed only where needed to provide, support and improve the requested service.
Institutional control	In institutional deployments, learner identity and formal records normally remain within the host institution’s own systems.
Security and governance	Technical and organisational safeguards are used to protect personal data, with governance arrangements continuing to mature alongside the platform.
Transparency	We aim to explain clearly what information is processed, why it is processed, and the current level of assurance supporting our approach.