top of page
< Back

Privacy Policy

DRAFT – placeholder text for Mario's approval. Not legal advice. Items in [square brackets] still need confirming.


Effective date: [CONFIRM — date it goes live; store dates on hold until Renato's gateway date]

Applies to: the LifeGap app on Android and iOS, and live.lifegap.org.


1. Who we are

LIFEGAP LTD ("LifeGap", "we") is the controller of your personal data.

Units 16/17, 14 Balloo Avenue, Bangor BT19 7QT, Northern Ireland.

Privacy contact: it@lifegap.org. [CONFIRM — the live policy and terms use support@lifegap.org; pick one, or list both.]

Company number NI665100 [CONFIRM — Grants bid entity LifeGap Ltd NI665100, not LIFEGAP UK LTD NI724961]. ICO registration number ZB906820 (data controller LIFEGAP LTD, registered at 25 Stonebridge Square, Conlig, Newtownards BT23 7QU; valid to 1 June 2027). Contact address for this policy: Units 16/17, 14 Balloo Avenue, Bangor BT19 7QT (Mario, 22 Oct). Data Protection Officer: Mario Visser, mario@lifegap.org.


2. Who LifeGap is for

LifeGap is for people aged 16 and over, mainly 16–24. You must be 16 or older to create an account. [CONFIRM — the live Terms say 15+ with parental consent under 18; the app has no age check at sign-up, and the profile age list still offers "0-15".] If you are under 16, please do not use the app. If we learn an under-16 has an account, we will delete it.


3. What we collect and why


3.1 Your account (stored on LifeGap's servers)
  • First name, last name, email, username, password: Sign-up, Required
  • School/organisation licence code: Sign-up or later, Optional
  • Your consent choices (data use, marketing, surveys): Sign-up, Data use consent is required to register; marketing and surveys optional
  • Course progress, lesson completion, quiz and test answers, time spent, scores: As you learn, Required to use courses
  • Certificates (your name, course, date) and GapTokens: When you complete a course, Created automatically


3.2 Optional profile details (stored on LifeGap's servers)

You can choose to add: phone number, postcode, date of birth, age group, gender, ethnicity, household income band, education level, employment status, and accessibility needs (which can include mobility, visual, hearing, cognitive, neurodivergent or mental-health needs).

  • Ethnicity and accessibility/health needs are special category data under UK GDPR. We only use them with your explicit consent, and every field has "Prefer not to say".
  • Why we ask: to report the reach of our programme to schools, funders and partners in anonymised or aggregated form, and to tailor support. [CONFIRM — exact purposes; whether any of this is shared with schools that issued a licence code, funders or partners at an individual level.]


3.3 MyLifeGap — stays on your phone

MyLifeGap lets you keep reminders (for example MOT, dentist, bills, birthdays, insurance), items (savings goals, receipts, documents, CV, job search, meal plans, wellness notes), photos you attach, and your GapCoach set-up and "what's hard right now" answers.

  • Reminders, items and photos are stored only on your device. They are not uploaded to LifeGap's servers.
  • Exceptions that do leave the phone (v1 / gateway Phase 0):
    • (a) If you turn on "Let GapCoach use my answers" (intake_sharing consent), your struggle-intake answers are saved on our servers so GapCoach can personalise help. You can withdraw that consent and we delete the server copy.
    • (b) When GapCoach suggests a reminder or life item, the suggestion is a proposed action. Nothing is written until you tap Add; then it is saved locally on your phone. We may send up to 5 upcoming reminder titles/dates with a chat message so GapCoach can answer "what's coming up?" — that context is used for that reply only and is not stored on the server (gateway proposal).
  • On Android MyLifeGap data is excluded from Google cloud backup. On iOS it may be included in your own iCloud/device backup, which LifeGap cannot access. [CONFIRM with Renato — iOS backup exclusion is not set in code.]
  • Photos: on Android you can take a photo with the camera or pick one from your gallery. Only the photo you choose is copied into the app's private storage. The app does not get access to your whole photo library. (Photo attachments are not yet available on iOS.)
  • Reminders and notifications: reminders are scheduled locally on your phone. We ask your permission before sending notifications. We do not use push notification servers. You can turn notifications off in your phone's settings.
  • GapCoach recommendation cards in v1 come from our AI gateway first; the phone still builds offline fallbacks.
  • To remove this data: delete items in the app, or uninstall the app. [CONFIRM with Renato — in the current build, logging out or deleting your account does not yet clear MyLifeGap data or photos from the phone. R&D must fix this before launch so the published policy can say "Deleting your account also clears MyLifeGap data from this phone."]


3.4 GapCoach AI chat
  • How it works: the app talks only to LifeGap's AI gateway on https://live.lifegap.org/api/ai/... with your normal login token. The app never holds AI keys and never sends a user id in the body. The gateway works out who you are, your age band and tier, adds context, runs safety checks, calls the model, saves the reply (with a stable message id) and streams it back (SSE, or JSON fallback).
  • v1 scope (gateway Phase 0): GapCoach chat, struggle intake (with separate consent), server recommendations, report-a-reply, credits, and delete-my-AI-data. Mock interview and AI CVs / cover letters / job matches are later phases and are not in v1.
  • AI providers (our processors):
    • Main: Anthropic Claude via Amazon Web Services (AWS Bedrock), London (eu-west-2). The faster chat model (Haiku) uses AWS's EU inference profile (EU + London).
    • Backup, only if the main service fails: OpenAI (EU project, zero retention) or Google Gemini on Vertex AI (Belgium, europe-west1).
    • A safety (moderation) check of messages and replies. [CONFIRM — OpenAI moderation or a Claude classifier; name it here.]
    • [CONFIRM — data processing agreements in place with AWS, and with OpenAI/Google if fallback is switched on.]
  • What is sent to the AI model: your message, about the last 10 messages, and a short profile summary from data we already hold: first name, age band, postcode district (not full postcode), courses completed, scores and GapTokens, and accessibility preferences such as short steps. We do not send your email, phone number, full date of birth, surname or full address. Career profile and generated documents are later phases.
  • No training: your chats are not used to train AI models, by us or by the providers. AWS Bedrock does not store prompts or outputs for training (confirm Bedrock terms at set-up). [CONFIRM — Bedrock terms; Vertex retention if fallback is on.]
  • Consent: GapCoach needs an ai_coach consent. Struggle intake needs a separate intake_sharing consent. Under-16s cannot use AI (age_restricted). You can withdraw consent in the app.
  • Safety: input and output are checked on the server. On a crisis match the model is not called; GapCoach shows a crisis card (999, Samaritans 116 123, text SHOUT to 85258, NHS 111). [CONFIRM — also show Childline 0800 1111 for 16–17.] Flagged messages and reports are logged with restricted access (safeguarding lead Mario Visser and IT admin). Harmful reports also alert Mario. Email alerts carry no chat text.
  • Replies are labelled AI-generated (ai_generated: true) and can be wrong — not professional advice (see Terms). Each assistant reply is reportable in-app (POST /api/ai/messages/{id}/reports; reasons: harmful / wrong / inappropriate / other). If the report call fails, the app falls back to email to it@lifegap.org so Play's in-app reporting rule is still met.
  • Chats are not cached on the phone; history is loaded from the gateway each time, so server retention is the only retention.
  • Do not share passwords, bank details or health details in the chat.
  • Staff do not read chats routinely. We may look at a chat you report, or one flagged by the safety check.
  • Usage records: we log which AI feature you used, the model, size and cost (no message content) to run credit limits; kept 24 months as billing evidence (gateway spec §6).


3.5 Analytics and crash data (Google Firebase)
  • We use Firebase Analytics (Google) to understand which screens and lessons are used. Events include screen views, sign-up and login success/failure, lessons completed (lesson ID, course ID, minutes spent) and account deletion. Firebase also collects an app-instance identifier, device model, OS version, and approximate location from IP (country/region). You can turn analytics off in Settings > Share usage analytics; that calls setAnalyticsCollectionEnabled(false) and is reapplied on each launch.
  • We use Firebase Crashlytics to receive crash reports (stack trace, device model, OS, app version, an installation ID). Crashlytics is not controlled by the analytics switch and stays on so we can fix crashes.
  • Google acts as our processor for this. [CONFIRM — Firebase "data sharing" settings in the console are off; Google Signals is off.]
  • On Android the advertising ID may still be collected by Firebase unless disabled. [CONFIRM with Renato — switch off advertising-ID collection; recommended.]
  • On iOS the app currently shows Apple's tracking prompt and only turns analytics on if you allow it. [CONFIRM — recommended Option A: remove the tracking prompt and advertising-ID libraries; LifeGap does not track you across other companies' apps.]
  • We do not use advertising or ad networks, and we do not sell your data.


3.6 Contacting us, surveys and marketing

If you email us, we keep the email to answer you. If you opted in, we send updates and surveys (you earn GapTokens). You can opt out at any time. [CONFIRM — which email/survey tool is used.]


4. Lawful bases (UK GDPR)

  • Running your account, courses, progress, certificates: Contract (Art. 6(1)(b))
  • Optional profile details (non-special) and programme reporting: Consent (Art. 6(1)(a)) [CONFIRM — or legitimate interests]
  • Ethnicity and accessibility/health needs: Explicit consent (Art. 6(1)(a) + Art. 9(2)(a))
  • GapCoach AI chat (and later career tools): Consent (Art. 6(1)(a)) — `ai_coach` consent; intake uses separate `intake_sharing` consent. A DPIA draft is in `/workspace/lifegap-store-drafts/LifeGap AI DPIA draft.md` for Mario to review before launch.
  • Safeguarding checks and flagged messages: Legitimate interests / vital interests (protecting young users) [CONFIRM — Mario sign-off on lawful basis wording]
  • Notifications for your reminders: Consent (phone permission)
  • Analytics: Legitimate interests, with an opt-out in Settings > Share usage analytics (on by default). Turning it off calls Firebase `setAnalyticsCollectionEnabled(false)` and reapplies on each launch (R&D, 22 Oct, port branch).
  • Crash reports and security: Legitimate interests (keeping the app working and safe). Crashlytics is not covered by the analytics switch and stays on.
  • Marketing and surveys: Consent
  • Legal and accounting records: Legal obligation


5. Who we share data with

  • Processors acting for us: AWS (Bedrock, Claude models) for GapCoach, with OpenAI or Google (Vertex AI) as backup; a moderation service [CONFIRM]; job listing services such as Reed [CONFIRM — later phase; they receive search terms, not your identity]; Google Firebase (analytics, crash reports), our hosting provider for live.lifegap.org [CONFIRM — provider and server location], email/survey tools [CONFIRM].
  • Your school or organisation, if you joined with their licence code: [CONFIRM — what they see, e.g. progress and certificates].
  • Certificate verification: [CONFIRM — whether a public verify link shows your name and course.]
  • Authorities, where the law requires.
  • We do not sell personal data and do not share it for advertising. Nothing goes to an employer without your consent and a human review (later feature).


6. International transfers

  • GapCoach main provider: processed in AWS London (eu-west-2), so no transfer outside the UK. The faster chat model uses AWS's EU routing, so some requests may be processed in EU countries, which the UK treats as adequate.
  • Backup providers: OpenAI (EU) and Google Vertex AI (Belgium) process in the EU (UK adequacy regulations). OpenAI and Google are US companies; where a US group company could access data we rely on the UK–US Data Bridge or the ICO International Data Transfer Addendum. [CONFIRM — per provider, and that AWS/OpenAI/Google contracts cover this.]
  • Google Firebase may process data outside the UK (UK–US Data Bridge or ICO Addendum). [CONFIRM]


7. How long we keep data

(Aligned to gateway spec §6 and Mario 22 Oct retention decisions.)

  • Account, progress, certificates: While your account is open, then deleted within [CONFIRM — 30] days of account deletion
  • Certificate records: [CONFIRM — e.g. 6 years for CPD audit]
  • Optional profile details: Until you remove them or delete your account
  • AI chats and interview transcripts (18+): While the account is active. Deleted when you delete the chat / your AI data / your account, or after 2 years with no login
  • AI chats (16–17): Each message deleted 30 days after it was created (rolling). The app shows this under the chat
  • Struggle intake (server copy, with consent): Until consent is withdrawn, AI data is deleted, or the account is deleted (or 2 years inactive). [CONFIRM — for 16–17: same, or 30 days like chats?]
  • Server recommendations and proposed actions: 90 days (18+) / 30 days (16–17)
  • Safety-flagged / report message snapshots (content): 90 days, access-restricted, then content stripped. [CONFIRM — OK for 16–17 to keep 90 days for safeguarding, longer than chat retention?]
  • Report and safety-event metadata (no content): 24 months (grant safety incident log)
  • AI usage and credit ledger (no content): 24 months (billing evidence)
  • AI consent records: Kept as a record of your choice
  • CVs, cover letters, interview-prep notes: Not in v1. When added later: until you delete them or your account (or 2 years without login)
  • Job matches: Not in v1. Plan: 12 months then anonymised [CONFIRM when that phase ships]
  • AI providers (AWS Bedrock; OpenAI/Google backup): Do not keep prompts or replies after processing; no training. [CONFIRM — Bedrock terms at set-up; Vertex if fallback on]
  • Firebase Analytics: 2 months
  • Crashlytics: 90 days (not optional; not tied to the analytics switch)
  • MyLifeGap data on the phone: Until you delete it, uninstall, or (once R&D ships the wipe) logout / account deletion
  • Inactive accounts: AI data wiped after 2 years without login (`last_active_at`); account deletion warning email [CONFIRM — 30 days before]
  • Backups: Hard-deleted rows roll off backups within [CONFIRM — Renato: backup window, gateway open Q6]


8. Deleting your account

  • In the app: Settings → Delete account. This deletes your LifeGap account on our servers and signs you out. Account deletion must also run DELETE /api/me/ai-data (gateway spec). [CONFIRM with Renato — the server endpoint hard-deletes account, progress and profile data, and calls the AI wipe.]
  • Delete AI data only: Settings → Privacy → Delete my GapCoach data calls DELETE /api/me/ai-data (conversations, messages, interviews, intake, recommendations, proposed actions; consent history and content-free credit/report metadata stay).
  • Without the app: use [CONFIRM — web deletion page URL, required by Google Play, e.g. https://live.lifegap.org/delete-account] or email mario@lifegap.org from your account email with the subject "Delete my account". We will delete your data and confirm within 30 days.
  • For users aged 16–17, chats are deleted after 30 days anyway.


9. Your rights

You can ask to access, correct, delete, restrict or move your data, object to processing, and withdraw consent at any time (this does not affect processing before you withdrew). Email our Data Protection Officer at mario@lifegap.org. We reply within one month. You can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.


10. Security

Data sent between the app, our servers, our AI providers and Firebase is encrypted in transit (HTTPS). AI provider keys are held only on our servers, never in the app. CVs and letters are stored in a private UK storage bucket and opened with short-lived links. Access to our systems is restricted. [CONFIRM — encryption at rest on live.lifegap.org.] MyLifeGap data stays in the app's private storage on your phone.


11. Cookies (website)

See our Cookie Policy: https://live.lifegap.org/policies/Cookies. The app itself does not use cookies.


12. Changes

We will post changes here and tell you in the app or by email if they are significant.


Partner offers and affiliate links

What we do. LifeGap shows clearly labelled partner offers (affiliate links) in some lessons, in MyLifeGap reminders and, later, in GapCoach answers. If you click one and then buy or switch, the partner may pay us a commission through an affiliate network (Awin, Partnerize, Impact or CJ Affiliate).

Click tracking. When you tap a partner link, your device goes to the network and then to the partner. The link carries a LifeGap publisher ID and an anonymous sub-ID that describes the placement only (for example lg-course-rail-travel or lg-remind-energy). The sub-ID contains no name, email, account ID, date of birth or reminder date. The network and the partner may set their own cookies or similar identifiers on their websites to record the referral. Their own privacy and cookie notices govern that, and you can manage it in your browser or device settings. We receive aggregated reports (clicks, sales, commission by sub-ID), not your identity.

Reminder-based offers (opt-in). If you save a renewal or expiry date in MyLifeGap (for example broadband, energy, insurance or Railcard), we use it to send you the reminder you asked for. Separately, and only if you switch on "Show partner offers with my reminders", we may show a relevant partner offer with that reminder, normally about 30 days before the date. This setting is off by default. You can switch it off at any time in Settings, and your reminders keep working. Lawful basis: consent (UK GDPR Art. 6(1)(a); PECR reg. 22 where the message is electronic marketing). Your dates are never shared with partners or networks.

Under-18s and schools. We do not show partner offers, or use your data to select offers, if you are under 18 (based on the date of birth you gave at sign-up [R&D confirm age source]) or if you use LifeGap through a school licence. Consistent with the ICO Children's Code, profiling and nudges for under-18s are off by default.

What we never promote. Loans, credit, credit cards, overdrafts, buy-now-pay-later, payday or car-finance products. For insurance, LifeGap is not FCA-authorised and links only to FCA-authorised comparison services. It gives no advice and handles no quotes.

Retention. Network reports are kept for [6 years] for accounting. They contain no personal data from LifeGap.

Sample partner offer card: Railcard

30 Oct 2026 (draft)

bottom of page