Bombe
    ← Back

    Privacy Policy

    Effective date: 2 March 2026
    Last updated: 2 March 2026

    1. Who We Are

    Bombe ("Bombe", "we", "us", or "our") is an educational software platform designed for use by teachers and educational professionals.

    Bombe is operated by:

    HEARTHLIGHT LABS LIMITED

    Registered in England and Wales
    Company number: 17062062
    Registered office: 34 Long Lane, London, SE1 4NN

    Email: privacy@usebombe.com

    For the purposes of UK data protection law, we act as the data controller for personal data collected through the Bombe platform.

    2. Scope of This Policy

    This Privacy Policy explains how we collect, use, and protect personal data when you:

    • Visit our website
    • Register for and use the Bombe platform
    • Participate in a pilot programme with us

    Bombe is currently provided to teachers and educational professionals on a pilot basis.

    3. The Personal Data We Collect

    3.1 Account Information

    When you create or use an account, we may collect:

    • Full name
    • Email address
    • School or organisation name
    • Role or job title (if provided)
    • Authentication information (via Firebase Authentication)

    3.2 Teacher-Created Platform Content

    We store content created within the platform, including:

    • Question papers
    • Individual questions
    • Planning notes or term planning entries
    • Drafts and edits
    • Associated timestamps and metadata

    This content is created by teachers as part of using the platform.

    3.3 Usage and Technical Data

    We may collect limited technical information, including:

    • Login activity
    • Pages accessed
    • Feature usage
    • IP address
    • Device and browser type

    This information helps us operate, secure, and improve the platform.

    4. What We Do Not Collect

    Bombe is designed for use by teachers.

    We do not:

    • Require or request student names
    • Collect pupil assessment records
    • Provide student accounts
    • Intentionally process personal data relating to children

    Teachers should not upload identifiable student personal data to the platform.

    5. How We Use Personal Data

    We use personal data to:

    • Provide and operate the Bombe platform
    • Store and manage teacher-created content
    • Support planning and question paper creation features
    • Maintain platform security
    • Improve and develop new features
    • Communicate important service updates

    We do not sell personal data and do not use personal data for advertising purposes.

    6. Legal Basis for Processing

    Under UK GDPR, our lawful bases for processing personal data are:

    • Contract – where processing is necessary to provide access to the platform
    • Legitimate Interests – to improve, secure, and maintain the service

    Where required by law, we will rely on additional lawful bases.

    7. Data Sharing and Sub-Processors

    We use trusted third-party service providers to operate Bombe, including:

    • Google - Authentication and data processing provider
    • Supabase - Storage provider
    • Vercel - Hosting provider

    These providers process data on our behalf under contractual safeguards.

    We do not sell or rent personal data to third parties.

    A full current list of sub-processors is available upon request.

    8. International Data Transfers

    Some of our service providers operate internationally.

    Where personal data is processed outside the United Kingdom, we ensure appropriate safeguards are in place in accordance with UK data protection law.

    9. Data Retention

    We retain personal data only for as long as necessary to:

    • Provide the platform
    • Support pilot partnerships
    • Comply with legal obligations

    Account data and platform content are generally retained while your account remains active.
    Data may be deleted or anonymised following account closure or the end of a pilot programme.

    10. Security

    We implement appropriate technical and organisational measures to protect personal data, including:

    • Encrypted connections (HTTPS)
    • Secure cloud infrastructure
    • Role-based access controls
    • Restricted internal access

    No system can be completely secure, but we take reasonable steps to protect data.

    11. Your Data Protection Rights

    Under UK data protection law, you have the right to:

    • Request access to your personal data
    • Request correction of inaccurate data
    • Request deletion of your data
    • Object to certain processing
    • Request restriction of processing

    To exercise your rights, contact us at privacy@[yourdomain].com.

    You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
    https://ico.org.uk

    12. Children’s Data

    Bombe is intended solely for use by teachers and educational professionals.

    We do not knowingly collect personal data directly from children.

    13. Changes to This Policy

    We may update this Privacy Policy from time to time.

    Where appropriate, we will notify users of material changes. The latest version will always be available on our website.

    14. Contact Us

    If you have any questions about this Privacy Policy or how we handle personal data, please contact:

    privacy@usebombe.com

    Privacy Policy·Terms of Use