Privacy Policy

Last updated: 28 July 2026

This Privacy Policy explains how CERNO GROUP LTD ("Cerno", "we", "us", "our") collects, uses, shares and protects your personal information when you use the Cerno website at cerno.group, the Cerno mobile app, and related services (together, the "Service"), including when you join a waitlist, sign up, subscribe, or contact us.

We are the controller of your personal information.

• Company: CERNO GROUP LTD, a private limited company registered in England & Wales, company number 16882401.
• Registered office: 167-169 Great Portland Street, Fifth Floor, London, United Kingdom, W1W 5PF.
• Contact for privacy matters: info@cerno.group

If you are under 18, there is a shorter, plain-language version of this notice written for you in our Children's Privacy Notice. Please read that as well.

1. At a glance

• We collect the information you give us (like your email and account details), information about how you use the Service (like your progress and streaks), and some technical information about your device.
• We use it to run the Service, deliver what you pay for, keep the Service safe, improve it, and — only with your permission — send you updates.
• We do not sell your personal information, and we do not use it to target advertising at you. For users under 18, we never sell, share, profile for advertising, or run behavioural advertising.
• You have strong rights over your information, including to access it, correct it, and delete it. You can exercise them any time at info@cerno.group.
• We use trusted service providers to run parts of the Service, and some of them process data outside the UK under legal safeguards.

2. Who this policy is for, and our age rules

Cerno is intended for users aged 13 and over. You must be at least 13 to create an account. We ask your age when you sign up and block accounts for anyone under 13. If we learn that we have collected information from a child under 13, we will delete it and close the account.

If you are 13–17, we apply extra protections by default: your privacy settings start at the most protective level, we minimise what we collect, we do not profile you for advertising, and we do not sell or share your information. We are building a parent/guardian dashboard; when it launches, we will update this policy and tell you clearly what a parent or guardian can and cannot see.

Depending on where you live, the age at which you can agree to our use of your data on your own varies (for example, it is 13 in the UK, but higher in some other countries). Where the law requires it, we will seek a parent or guardian's consent — see the region-specific sections below.

3. The information we collect

Information you give us

• Waitlist / email signup: your email address (and name, if you give it).
• Account: your name or username, email address, password (stored in hashed form), age or date of birth, and your preferences.
• Contact forms and support: your name, email, and whatever you choose to tell us in your message.
• Payment: if you subscribe, your payment is handled by our payment providers. We receive confirmation of payment and limited billing details (such as the last four digits of a card, billing country, and subscription status). We do not store your full card number.

Information we collect automatically when you use the Service

• Usage and learning data: the exercises you complete, your answers, scores, streaks, words learned, reading speed and comprehension metrics, and other progress information — this is core to how Cerno works.
• Device and technical data: device type, operating system, app version, language, general location inferred from your IP address (country/region level only — we do not collect precise GPS location), and diagnostic/crash data.
• Cookies and similar technologies: see our separate Cookie Policy.

Information from third parties

• If you sign up or pay through the Apple App Store or Google Play, we receive limited account and transaction data from them.
• If a parent or guardian sets up or manages an account (once the parent dashboard launches), we may receive information from them about you.

We do not collect special category data (such as health, religion, or ethnicity) and ask that you do not send it to us through contact forms.

4. How and why we use your information — and our legal bases

Under UK and EU data protection law we must have a "lawful basis" for each use. Here is what we do and why:

Where we rely on legitimate interests, we have weighed our interest against your rights, and you can object at any time (section 9). Where we rely on consent, you can withdraw it at any time without affecting anything we did before you withdrew it.

We do not use your personal information to make solely automated decisions that produce legal or similarly significant effects about you. Your progress metrics are used to personalise your learning experience within the app, not to make consequential decisions about you.

5. Marketing and communications

We will only send you marketing emails (product news, launch updates, tips) if you have opted in, or where you are an existing customer and the law allows us to send you information about our own similar products with a clear opt-out.

Every marketing email has an unsubscribe link. You can opt out at any time there, in your account settings, or by emailing info@cerno.group. We keep a suppression list so we honour your choice.

We will still send you service messages you can't opt out of while you have an account — for example, payment receipts, security alerts, renewal reminders, and important changes to the Service. These are not marketing.

If you are under 18, we are especially careful: we only send you communications that are appropriate, and we do not use manipulative design to push you into sharing more data or spending money.

6. Cookies and similar technologies

We use cookies and similar technologies on our website and limited analytics/diagnostic tools in our app. Non-essential cookies are only used with your consent, which you can change at any time. Full details, including a cookie table and how to manage your choices, are in our Cookie Policy.

7. Who we share your information with

We do not sell your personal information. We share it only with:

• Service providers ("processors") who run parts of the Service for us under contract and on our instructions:
  • Stripe — card payment processing on the website.
  • Apple App Store / Google Play — in-app purchases and subscriptions.
  • Supabase — hosting, database and authentication.
  • An email service provider — sending waitlist and marketing emails, under contract.
  • A privacy-friendly analytics provider — aggregate usage measurement, where we use one.
• Professional advisers (accountants, lawyers, insurers) where needed, under confidentiality.
• Authorities or third parties where we are legally required to disclose, or to establish, exercise or defend legal claims, or to protect the safety of our users.
• A buyer or successor if we sell, merge or reorganise the business — in which case your information may transfer, subject to this policy.

Each processor is contractually bound to protect your data, use it only for the purposes we specify, and apply appropriate security.

8. Sending information outside the UK

Some of our service providers store or process personal information outside the United Kingdom (for example, in the European Economic Area or the United States). When we transfer your information outside the UK, we protect it using a legal transfer mechanism, such as:

• transfers to countries the UK Government has decided offer adequate protection; or
• the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a risk assessment; or, for EEA users, the EU Standard Contractual Clauses.

You can ask us for more information about the safeguards we use by emailing info@cerno.group.

9. Your rights

Wherever you live, you can ask us to help you exercise your rights. Depending on your location, these include the right to:

• be informed about how we use your data (this policy);
• access the personal information we hold about you;
• correct information that is wrong or incomplete;
• delete your information ("right to erasure");
• restrict or object to certain processing;
• data portability — receive your data in a portable format;
• withdraw consent at any time where we rely on it; and
• complain to a regulator.

To exercise any right, email info@cerno.group. We will respond within the time the law requires (generally one month in the UK/EU). Using these rights is free, and we will not treat you differently for doing so. We may need to verify your identity first.

If you are unhappy with how we handle your information, you can complain to us directly at info@cerno.group and we will acknowledge and address it. You also have the right to complain to your data protection regulator — in the UK, the Information Commissioner's Office (ICO), ico.org.uk, helpline 0303 123 1113. We would appreciate the chance to resolve it first.

10. How long we keep your information

We keep your information only as long as we need it:

• Account and learning data: while your account is active, and then deleted or anonymised within a reasonable period after you close it (we aim for within 6 months), unless we must keep some records longer.
• Waitlist / marketing: until you unsubscribe or ask us to delete it.
• Payment and tax records: kept for the period UK tax law requires (currently 6 years).
• Support messages: kept for a reasonable period to help with follow-ups.

11. How we protect your information

We use appropriate technical and organisational measures to protect your information — including encryption in transit, hashed passwords, access controls, and vetting of our service providers. No system is perfectly secure, but we work to protect your data and will notify you and the relevant regulator of a serious data breach where the law requires.

12. Region-specific information

The core of this policy applies to everyone. The additions below apply if you are in a particular region. Some of these will become fully active as we open the Service in each region.

12.1 European Economic Area (EEA)

If you are in the EEA, the EU General Data Protection Regulation (GDPR) applies to our processing of your data. As a UK-based company offering the Service to EEA users, we will appoint an EU representative under Article 27 and name them here before we actively market to EEA users. The digital age of consent varies across EEA countries (13–16); where you are below your country's age, we will seek a parent or guardian's consent for uses that rely on consent. You may complain to your national data protection authority.

12.2 California and other US states

If you are a California resident, the California Consumer Privacy Act (as amended) gives you rights to know, delete, correct, and opt out of the "sale" or "sharing" of your personal information, and to limit use of sensitive information. We do not sell or share personal information as those terms are defined, and we do not use it for cross-context behavioural advertising. For users aged 13–15, we would never sell or share personal information without your opt-in — and as a matter of policy we do not do so at all. We honour recognised browser opt-out signals such as Global Privacy Control. Residents of other US states with privacy laws (including Virginia, Colorado, Connecticut, Texas, Oregon and others) have similar rights; for users under 18 we do not sell data, run targeted advertising, or profile for advertising, which meets those states' heightened protections for minors. To exercise any right, email info@cerno.group. You may appeal a decision by replying to our response.

12.3 Canada

If you are in Canada, we handle your information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, Quebec's Law 25 — including obtaining appropriate consent, allowing access and correction, and notifying you and the regulator of a breach that poses a real risk of significant harm. For Quebec residents, we will name a privacy officer and, for users under 14, seek parental consent, before we actively open the Service in Quebec.

12.4 Australia

If you are in Australia, we handle your information in line with the Privacy Act 1988 and the Australian Privacy Principles, including telling you what we collect and why, and the countries to which we may disclose your information (see section 8).

12.5 Brazil

If you are in Brazil, we handle your information in line with the Lei Geral de Proteção de Dados (LGPD). We will appoint a Portuguese-speaking data protection officer and, for users under 12, obtain and verify parental consent, before we actively open the Service in Brazil.

13. Changes to this policy

We may update this policy from time to time. If we make a significant change, we will tell you (for example, by email or an in-app notice) before it takes effect. The "Last updated" date at the top shows the current version.

14. Contact us

Questions, requests, or complaints about your privacy:

CERNO GROUP LTD 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF, United Kingdom Email: info@cerno.group