Privacy Notice

Theorio is a study service for the UK driving theory test, operated by Arda Future Limited. This notice explains what personal information we collect, why we use it, who we share it with, how long we keep it, and what rights you have.

We are the data controller for the personal information we process about you. We comply with the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

In short: we use your information to run your account and adapt your practice, we do not sell it, we do not run advertising tracking, and we do not currently send marketing emails. If we ever do, it will only be because you asked us to.

Theorio is available on our website and as iOS and Android apps. Paid plans bought on our website are processed by Stripe. If you subscribe inside our iOS app, the purchase is made through the Apple App Store using Apple In-App Purchase. If you subscribe inside our Android app, the purchase is made through Google Play using Google Play Billing. Purchases made in either app are checked and managed for us by RevenueCat. Section 3 and section 8 explain what each of these involves and what is — and is not — shared. Our mobile apps contain no advertising or analytics software, and we do not use the information they collect to track you across other companies' apps or websites (see section 7).

Theorio is operated by Arda Future Limited, a company registered in England and Wales. Arda Future Limited is the data controller.

Data controller: Arda Future Limited
UK Company Number: 17133300
Registered office: 24 Bishops Close, Richmond, London TW10 7DF, United Kingdom
Privacy contact: info@theorio.co.uk

We collect and use the following categories of information:

Under UK GDPR Article 6, we rely on the following legal bases:

• Contract (Art. 6(1)(b)) — to create and run your account, provide the practice questions and adaptive learning features, send the service emails described in section 5, and provide and bill a paid subscription if you choose one — including verifying a subscription bought through the App Store or Google Play so that you get the access you paid for.
• Legitimate interest (Art. 6(1)(f)) — to detect and diagnose errors, to keep the service and our servers secure, to prevent fraud and abuse, and to understand and improve how the service works. We balance this against your interests, and you can object (see section 11).
• Consent (Art. 6(1)(a)) — for optional analytics cookies, and — if we ever introduce them — for optional marketing emails. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to keep the records we are required to keep, for example for tax and accounting purposes, and to respond to lawful requests.

Service emails are the messages we have to send so that your account works. They are not marketing. We send them on the basis of our contract with you, and you cannot opt out of them while you have an account — but you can close your account.

• confirming your email address when you register;
• resetting your password when you ask us to;
• a welcome message when your account is set up;
• a reminder if your email address has not been confirmed;
• telling you if a subscription payment has failed, so you can fix it.

Theorio does not currently send optional marketing emails.

We are describing this here so you know in advance what would happen if we introduce them. If we do:

• We would only send them to people who have actively opted in by ticking an unticked box or turning on a setting. Silence is never consent.
• We would not rely on the “soft opt-in” exception for existing customers, even though the law allows it in some cases.
• Having an account, having a subscription, practising questions, or completing the 28-question check is not consent to marketing, and we would never treat it as such. Your setting for service emails is not marketing consent either.
• If we hold no record that you opted in, we treat that as no. We would never add existing users to a marketing list by default.
• You could withdraw your consent at any time, and it would be as easy to withdraw as it was to give.
• Every marketing email would carry an unsubscribe link that works without signing in — no password, no account needed. The link would stay valid for 90 days.
• When you unsubscribe, we would keep a minimal do-not-contact record so we can honour your choice — see below.

We use two categories of cookies:

• Functional cookies — set by Supabase to keep you logged in. These are necessary for the service to work and are set without consent under the PECR “strictly necessary” exemption.
• Analytics cookies — set by Google Analytics only after you explicitly accept them. Until you accept, the Google Analytics script is not loaded at all. We use Google’s consent mode: all consent signals start as denied, and accepting analytics cookies grants only analytics_storage. Advertising storage, advertising user data and advertising personalisation are never granted in this app, and we run no advertising tags. We do not use analytics for advertising profiling.

If you accept analytics cookies and you then complete a purchase, a purchase event — the amount, the currency and the opaque reference described in section 3 — is included in what Google Analytics receives from your browser, so that completed purchases can be counted. If you do not accept, nothing about that purchase is sent to Google: there is no server-side route that reports purchases to Google Analytics on your behalf, and none of the analytics consent signals are granted.

You can change or withdraw your choice at any time using the Cookie settings control in the site footer. Withdrawing stops further analytics collection and removes Google Analytics cookies (_ga, _ga_*) from this browser on a best-effort basis. Cookies set by other providers for sign-in or payments are not affected.

Analytics information is kept in line with the retention settings configured in the analytics account, and we review those settings periodically.

We use the following providers, and each only receives the information it needs for its part of the service. We do not sell your personal information.

Where a provider processes personal information on our behalf and on our instructions — as a processor, sometimes called a service provider — the data protection terms required by UK GDPR Article 28 are in place with that provider, and those terms are linked below where the provider publishes them.

Apple acts as the merchant of record and an independent controller for App Store purchases. Apple processes payments under its own terms and privacy policy, and is not acting on our behalf or under our instructions. Section 3 explains what that means for your payment details.

Google processes payments for purchases made through Google Play under Google's own terms and privacy policy. Section 3 explains what that means for your payment details.

• Supabase — account authentication and database hosting. Data processing addendum.
• Stripe — payment processing and subscription management for our paid plans purchased on the website. Checkout and the billing portal are hosted by Stripe, so card details are entered on Stripe’s pages and not on ours. Stripe is not used for purchases made in our iOS or Android apps. Stripe also acts as a controller in its own right for some purposes, such as fraud prevention and legal compliance. Data processing agreement.
• Apple — purchases made inside our iOS app through Apple In-App Purchase. Apple processes App Store purchases under Apple's own terms and privacy policy. You can see and manage those subscriptions in your Apple Account settings: apps.apple.com/account/subscriptions.
• Google Play — purchases made inside our Android app through Google Play Billing. Google processes Google Play purchases under Google's own terms and privacy policy. You can see and manage those subscriptions in Google Play: play.google.com/store/account/subscriptions.
• RevenueCat — subscription verification and management for purchases made in our iOS and Android apps. RevenueCat acts as our processor for subscription verification and management. Its Data Processing Addendum incorporates the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. RevenueCat receives only the information listed in section 3: a randomly generated app user ID, product and subscription event and metadata, the store and environment, and subscription status and period. It does not receive your Supabase account identifier, your email address or your card details.
• Resend — delivery of the service emails listed in section 5. Receives the recipient address, the message, and the account context the message needs. It is not used for marketing. Data processing agreement.
• Sentry — error and performance monitoring. See section 3 for what a technical record contains, and below for how we reduce what is sent.
• Anthropic — the Claude large language model, used to generate the study coach summary. The learning context needed to write the summary may be sent. We do not send payment information or marketing preferences to Anthropic.
• Google Analytics — usage analytics. The Google Analytics script is only loaded after you explicitly accept analytics cookies; before that, no request is made to Google.
• Hostinger — hosting and infrastructure provider for the servers that run the site. Privacy policy.

Some of our providers operate outside the United Kingdom, and your information may be processed outside the UK — in particular by providers based in, or with operations in, the United States.

Where information leaves the UK, we rely on the safeguards approved for UK transfers — the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses — or on a UK adequacy or data bridge finding where one applies to that provider. The exact mechanism is set out in each provider’s data processing agreement, linked in section 8.

For the store-subscription providers described in section 8, the transfer mechanism is the one set out in that provider's own data processing terms. RevenueCat's Data Processing Addendum incorporates the UK International Data Transfer Addendum to the EU Standard Contractual Clauses for restricted transfers subject to UK data protection law. RevenueCat Data Processing Addendum.

Apple's handling of App Store purchases is governed by Apple's own terms and privacy policy, as described in section 8.

Google's handling of Google Play purchases is governed by Google's own terms and privacy policy, as described in section 8.

You can ask us for more information about the safeguards in place by emailing info@theorio.co.uk.

We keep information for as long as we need it for the purpose we collected it for. Where we cannot give a fixed period honestly, we give the criteria we use instead.

Under UK GDPR you have the following rights in relation to your personal information:

• Access (Art. 15) — request a copy of the information we hold about you.
• Rectification (Art. 16) — correct inaccurate or incomplete information.
• Erasure (Art. 17) — ask us to delete your information.
• Restriction (Art. 18) — ask us to limit how we use your information.
• Portability (Art. 20) — receive your information in a common format.
• Objection (Art. 21) — object to processing we carry out on the basis of legitimate interest.
• Objection to direct marketing (Art. 21(2)) — an absolute right. If you object to direct marketing we must stop, with no exceptions and without you giving a reason.
• Withdrawing consent (Art. 7(3)) — where we rely on your consent, you can withdraw it at any time, and it must be as easy to withdraw as it was to give.

Withdrawing consent stops the processing going forward. It does not make what we did before you withdrew unlawful.

Not every right applies in every situation — which rights you can use depends on the legal basis we rely on for that particular processing, and some rights have exceptions in law. If a right does not apply we will tell you why.

To exercise any of these rights, email info@theorio.co.uk. We will respond within one month. You can also request deletion of your account through our public deletion page, or delete it yourself where the Delete account option is available in your Profile, as described in section 10. We may need to ask you for information to confirm your identity before we act, so that we do not disclose your data to someone else.

We use your practice results, your topic scores and your diagnostic results to automatically choose which questions and suggestions you see next, and to generate an AI study summary after a mock test. This is automated personalisation, and it is profiling in the sense the law uses that word.

It is not a decision with a legal or similarly significant effect on you. It does not set your price, decide whether you can have an account, decide anything about your driving theory test, or affect any legal right. All it changes is what the app shows you next.

You can ask us to explain how it works, and you can object to it — email info@theorio.co.uk.

Theorio is for people aged 16 and over. Learner drivers aged 16 and 17 are a real part of who this service is for, and this notice is written to be understood by them.

We aim not to collect information from anyone under 16. To be straightforward with you: we ask you to confirm your age in our Terms, but we do not currently run an age check when you register, and we do not have a parental consent process. If you are under 16, please do not create an account. If you think a child under 16 has created one, email info@theorio.co.uk and we will delete it.

We do not send marketing emails to anyone, and that includes young people. Marketing is not switched on for any age group.

We may update this notice from time to time. When we do, we will change the “Last updated” date at the top and, where changes are material, notify account holders by email. If we ever start using your information for something new, we will tell you before we do it.

If you are not satisfied with how we have handled your personal information, please tell us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office, and to seek a remedy through the courts.

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
ico.org.uk