Privacy Notice

Last updated: 5 November 2026.

This notice explains what personal data we collect when you use this site, why we collect it, and the rights you have over it. It covers every part of totorex.ai: Toto-Rex's Study Corner, the UK & EU, US & Canada, Asia and Global editions, the Glossary, the Classroom and the app preview. We have tried to write it the way Toto-Rex writes everything: plainly, and without forty pages of throat-clearing.

1. Who we are

Toto-Rex's Study Corner is published by Maqutt Studio Ltd ("we", "us", "our"), the data controller for the personal data described here.

Maqutt Studio Ltd (company no. 17154771)
71–75 Shelton Street, Covent Garden, London WC2H 9JQ
Email: hello@maqutt.studio
ICO registration reference: ZC189558

Because this site is read across the UK and the EU/EEA, this notice is written to meet both the UK GDPR and the EU GDPR. We are not required to appoint a Data Protection Officer and have not appointed one: the address above reaches the person accountable for data protection. We have not appointed a representative in the EU: our processing for readers there is limited to a free email note and occasional enquiries, which we assess as occasional and unlikely to put anyone at risk (Article 27(2) of the EU GDPR). We will appoint one, and name them here, before we offer any service aimed at readers in the EU.

2. The data we collect, and why

AI-literacy note sign-up

To subscribe to the AI-literacy note you give us your email address. Your name, organisation, reason for interest and the perspective you read from (business; legal and compliance; both; general interest) are optional; we ask for them only to pitch the note, and any training, at the right level, and a person reads them: nothing is scored. With each sign-up we record the date and time, the page and its language, whether you ticked the separate box for news of our training, courses and events, and whether you have confirmed your address. We email you a link to confirm the address and send nothing else until you do; unconfirmed sign-ups are deleted after 30 days. The note goes out when there is something worth teaching, in English, and every email has an unsubscribe link.

Business enquiries

If you use the “Work with Toto-Rex” form, we receive your name, work email address, organisation, topic and message, and use them only to answer you. The enquiry is written to the same private Google Sheet and emailed to us.

Messages you send us

If you write to us by email, we receive your name, email address and message, so that we can read it and reply.

Browsing the site

We do not use analytics, advertising or cross-site tracking. The site stores functional data in your own browser, including display and language preferences, the optional learner name you enter, lesson completion, quiz grades, XP, study-card progress, notebook entries, personal notes and game progress. This lets the learning tools remember where you stopped. It stays on that device, is not submitted to us, and can be erased through your browser's site-data controls. See our cookies & storage policy for the full list.

The site's display assets, including its typefaces, are self-hosted. Language dictionaries and any baked translations are static site files applied in your browser. The production site does not send page text, or anything you type, to a translation service. If a translation is not available, the English text remains visible and is marked as such, rather than triggering an external translation request.

Serving the pages

The site is published as static files on a content-delivery network (Cloudflare). To send you a page, and to keep the site available, our host necessarily processes the technical data in your request, including your IP address, the page requested, the time, and your browser's user-agent string. It may also set a short-lived, first-party security cookie to tell human traffic from automated traffic. We do not receive visitor-level reports from it, do not use it to identify or profile you, and do not combine it with anything else.

The music video

The music video on the front pages is a YouTube player in its privacy-enhanced mode (youtube-nocookie.com). Nothing loads from YouTube until you press play; from then on, YouTube (Google) may set cookies and receive data from your device under its own privacy policy.

Children

The site is written for adults at work and in study. We do not knowingly hold personal data about anyone under 13; if you believe a child has sent us personal data, tell us and we will delete it.

3. Our lawful bases (UK GDPR and EU GDPR)

• Consent: for the AI-literacy note and, separately, for news of our training if you ask for it. Keeping a record of when and how you consented, and a short suppression record after you unsubscribe, is in our legitimate interests, because it lets us show that we respect your choice.
• Legitimate interests: for reading and replying to messages you choose to send us, and for keeping the site secure and working. We have weighed this against your interests and consider it proportionate.

4. Who we share it with

We don't sell your data. We share it only with the service providers ("processors") that help us run the site, and only so they can do that job:

• Cloudflare, Inc. (United States, with a global network): hosting, content delivery, DNS and security for the site, and routing for our email domain. It processes the request data described in section 2.
• Google: both forms send to a Google Apps Script service, which writes to a private Google Sheet in our Google Workspace account and emails us a copy; Google also sends the confirmation email. Our Workspace contract is with Google Cloud EMEA Limited (Dublin, Ireland), and Google LLC in the United States may process the data. When you press Subscribe or Send, your browser sends the form straight to Google, so Google also receives your IP address and browser details for that request.
• YouTube (Google), only if you press play on the music video (section 2).
• Our mailbox provider, which carries and stores messages you send us and our replies.

We may also disclose data where the law requires it. Each processor is bound by a contract to protect your data and use it only on our instructions.

5. International transfers

We do not need to move your data abroad for any purpose of our own, and we never do so for marketing. Two things nevertheless involve processing outside the United Kingdom, and it would be wrong to tell you otherwise.

• Serving pages. A content-delivery network answers your request from the data centre nearest to you, so a request from outside the UK is handled, and logged, outside the UK.
• Forms and email. Google, and our mailbox provider, may store and process what you send us on servers outside the UK, including in the United States.

For transfers from the UK we rely on UK adequacy regulations where they cover the country in question. For the United States we rely on the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge): Google LLC is certified under it, and we checked its listing on 5 November 2026. Otherwise we rely on the ICO's International Data Transfer Agreement or the EU standard contractual clauses with the UK Addendum, together with a transfer risk assessment. If you are in the EU/EEA, your data reaches us in the United Kingdom under the European Commission's adequacy decision for the UK, renewed on 19 December 2025 and valid until 27 December 2031. You can ask us which safeguard applies to a particular provider.

6. Keeping your data secure

The site is served only over HTTPS. There is no login, no database of readers and no server-side copy of your learning records. Access to the mailbox and the Google Sheet is limited to the people who need it and protected by two-factor authentication. If a breach is likely to put people at risk, we tell the ICO within 72 hours of becoming aware of it, and we tell the people affected without undue delay where the risk to them is high.

7. How long we keep it

• AI-literacy note: until you unsubscribe or ask us to remove you; unconfirmed sign-ups are deleted after 30 days. When you unsubscribe, we keep only your address and the dates, as a suppression record, so that you are not added again by mistake.
• Enquiries: deleted 12 months after they arrive, or sooner once the matter is closed.
• Messages: for as long as needed to deal with your enquiry, and normally no more than 24 months afterwards.
• Server logs held by our host: short-lived, and kept by the provider under its own retention schedule rather than copied into our systems.
• Google's own logs: Google keeps technical logs of the form service for a limited period under its own terms.
• Learning and preference data in your browser: until you clear this site's data. We do not receive or retain a server-side copy.

8. Your rights

Under the UK GDPR, and under the EU GDPR where it applies to you, you have the right to access your data; to have it corrected or erased; to object to or restrict its use; to data portability; and to withdraw consent at any time. To exercise any of these, email hello@maqutt.studio. You can also object at any time to any use of your data for direct marketing. There is no charge, and we will respond within the statutory time limit (one month, extendable by two further months for complex requests).

9. Automated decisions, profiling and AI

We do not make any decision about you by automated means, and we do not profile you. Quiz marking, XP and flashcard scheduling run in your own browser, affect nothing outside the site, and are not reported to us. This site is about AI; it does not use AI on you.

We do use AI tools in producing the site's writing and its translations, which is a separate question from your personal data. How that works is set out in section 3 of our terms of use.

10. Complaints

We would rather hear from you first so we can put things right. Under section 164A of the Data Protection Act 2018 you can complain to us directly, by email to hello@maqutt.studio or by any other means that suits you. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay. You also have the right to complain to a data protection regulator. In the UK that is the Information Commissioner's Office, at ico.org.uk/make-a-complaint (Wycliffe House, Water Lane, Wilmslow SK9 5AF; helpline 0303 123 1113). If you are in the EU/EEA, you may instead complain to the supervisory authority where you live, work, or where the issue arose; you can find yours via the European Data Protection Board.

11. Changes to this notice

If we change how we handle your data, we update this page and the "last updated" date above. We tell subscribers about material changes in the note itself.