Phlo
Try Phlo AI free

Phlo Privacy Policy

Last updated: 25 June 2026

1. Who we are

Phlo ("we", "us", "our") provides AQA Biology tutoring through two services: Phlo AI, an AI biology tutor, and Phlo Tutoring, one-to-one tutoring. Phlo is operated by Olivia Koleczek as a sole trader based in the United Kingdom.

For any questions about this policy or your data, contact us at hello@phlobio.ai.

We are the "data controller" for the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO), registration number C1968123.

2. A note about children

Phlo is used by students studying GCSE and A-Level Biology, many of whom are under 18. We take the privacy of children seriously and aim to follow the UK's Age Appropriate Design Code (the Children's Code). Students can create an account themselves. We apply privacy-protective settings by default and collect only the data we need to provide the service. The minimum age for using Phlo without parental involvement is 13; if you are under 13, please ask a parent or guardian to set up and manage your account. Parents and guardians can contact us at any time at hello@phlobio.ai about their child's data.

3. The personal data we collect

Depending on how you use Phlo, we may collect:

  • Account information: your name and email address, collected when you sign up (handled via our authentication provider, Clerk).
  • Payment information: when you pay for a subscription or tutoring, payments are processed by Stripe. We do not store your card details; Stripe handles these securely. We receive limited information such as confirmation of payment and your billing details.
  • Phlo AI conversation data: the questions and messages you send to the Phlo AI tutor, and its responses. We use these only to provide the service (to generate answers and run your account). We do not use them to train or improve the AI model.
  • Booking information: when you book tutoring, details needed to schedule the session (handled via Cal.com and your calendar).
  • Tutoring information: notes or information relevant to delivering one-to-one lessons.
  • Usage and technical data: how you interact with the site, device and browser information, and information collected through cookies and similar technologies (see our Cookie Notice).

4. How we use your data, and our lawful bases

We use your data to:

  • provide and run Phlo AI and Phlo Tutoring (lawful basis: performance of a contract);
  • take payment for subscriptions and tutoring (contract);
  • communicate with you about your account, bookings, and support (contract / legitimate interests);
  • improve and secure our services (legitimate interests);
  • send marketing only where you have agreed (consent), which you can withdraw at any time;
  • meet legal and safeguarding obligations (legal obligation / legitimate interests).

We do not use the content of your Phlo AI conversations to train or improve the AI model. We use them only to provide the service to you.

5. Cookies

We use essential cookies to run the site (for example to keep you signed in). For analytics we use Vercel Analytics, which is privacy-friendly and does not use cookies or track you across other sites, and we do not run advertising pixels. Any non-essential cookie we introduce in future will be used only with your consent. See our Cookie Notice for full detail and how to manage your choices.

6. Who we share your data with

We do not sell your personal data. We share it with trusted service providers ("processors") who help us run Phlo, only as needed:

  • Clerk (account sign-in and management)
  • Stripe (payment processing)
  • Supabase (database and storage)
  • Cal.com (tutoring bookings)
  • Vercel (website hosting and privacy-friendly, cookieless analytics)
  • Google Workspace (email and business tools)
  • Anthropic (the AI provider powering the Phlo AI tutor; your messages to Phlo AI are processed by this provider to generate responses)

We may also share data where required by law, or to protect the safety of a child or other person.

7. International transfers

Some of our providers are based outside the UK, including in the United States. Where your data is transferred outside the UK, we rely on appropriate safeguards (such as UK-approved transfer mechanisms) to protect it. We keep these arrangements under review as our providers' terms change.

8. How long we keep your data

We keep personal data only as long as needed for the purposes above, or as required by law. As a guide: we keep your account and conversation data while your account is active and for up to 12 months after it is closed; booking and payment records are kept for up to 7 years where needed to meet tax and accounting obligations.

9. Your rights

Under UK data protection law you have the right to: access your data; have inaccurate data corrected; have your data erased in certain circumstances; restrict or object to processing; data portability; and to withdraw consent where we rely on it. To exercise any of these, email hello@phlobio.ai. You also have the right to complain to the ICO (see section 12).

10. Children's data

We design Phlo to be appropriate for younger users. We collect the minimum data necessary to provide the service, apply privacy-protective settings by default, do not use children's data for marketing, do not sell or share it except with the service providers listed above or where needed to protect a child, and do not use conversation data to train the AI. Parents and guardians can contact us at hello@phlobio.ai to review, correct, or delete their child's data, or to ask how it is used. A plain-language version of this notice written for younger users is available at /privacy-for-students.

11. How we protect your data

We use appropriate technical and organisational measures to keep your data secure, and we work with providers who do the same. No system is completely secure, but we take reasonable steps to protect your information.

12. Complaints

If you have concerns about how we handle your data, please contact us first at hello@phlobio.ai. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new "last updated" date.