Privacy Policy

For the account data described below, the data controller is COMMA COLLECTIVE PTE. LTD., a privately owned company registered in Singapore (UEN 202607437W) at 160 Robinson Road, #14-04, Singapore Business Federation Center, Singapore 068914, which provides SchoolGPT. You can reach us about anything in this policy at [email protected].

When a teacher uses SchoolGPT on behalf of a school, the school usually decides why and how its pupils' information is used. In that case the school is the controller for the roster and class notes, and we process them on the school's instructions. Schools can ask for a Data Processing Agreement at [email protected].

Your teacher account holds your name, email address, a hashed password or your Google sign-in identifier and profile picture, your teaching profile (grade, subjects, curriculum, output language, tone and school name), your plan and subscription status, and the sessions that keep you signed in.

When you use the class workflow, we store the classes you create and, for each learner, the alias or first name you enter, optional pronouns, and the observations you write. We also store your chats, tool inputs, generated drafts, saved resources, favourites, tool requests and any files you upload, so you can come back to your work later.

For security and abuse prevention we process technical data such as your IP address, the country it resolves to, browser and device type, usage counts and error logs. With your permission (see Cookies below) we also collect analytics about which pages and tools are used.

SchoolGPT is built so that you never need to give a student's full identity to an AI company. We recommend entering an alias, initials or first name only, and keeping observations to what you would write in a report anyway. Please do not enter student ID numbers, home addresses, health or disability details, or disciplinary records.

Before anything reaches the AI model, roster names are replaced with placeholders, and they are restored only in your own document. The model sees your observations and the placeholder, not the name. Students only use SchoolGPT directly if their teacher turns on student spaces or their parent sets up a profile; that is covered in Students and children below.

If information about a student was entered by mistake, you can delete it from the class page at any time, or contact [email protected] and we will help.

We use your account, classes and content to provide the service you signed up for: storing your work, generating drafts, and handling your plan. Under the GDPR this is necessary to perform our contract with you (Article 6(1)(b)).

We use technical data to keep SchoolGPT secure, prevent abuse and fraud, limit automated misuse, and fix bugs. This relies on our legitimate interest in running a safe and reliable service (Article 6(1)(f)). We keep billing and tax records because the law requires it (Article 6(1)(c)).

Now and then we may email account holders about important changes and new features in SchoolGPT, similar to what they already use. We do this on the basis of our legitimate interest in keeping our users informed (Article 6(1)(f)). Every such email has a one-click unsubscribe link, and you can also opt out by writing to [email protected]. Account and safety emails are not affected.

Analytics cookies in the EEA, UK and Switzerland are used only with your consent (Article 6(1)(a)), which you can withdraw at any time. Where a school is the controller for pupil information, the school determines its own lawful basis, and we act on its instructions.

We use strictly necessary cookies to keep you signed in, remember your language, and remember your cookie choice. These do not need consent.

We also use Google Analytics, PostHog and Ahrefs Web Analytics to understand how the site is used. If you visit from the EEA, the UK or Switzerland, PostHog and Ahrefs are not loaded and Google Analytics runs in consent mode with storage denied until you choose "Accept" in the cookie banner. You can change your choice at any time with the "Cookie settings" link in the footer. Rejecting analytics does not change anything else about how SchoolGPT works.

We also keep our own first-party product analytics on our servers: which pages and features are used (for example, that a lesson plan was generated or a class was created), the referring site, your country and whether you use a phone, tablet or computer. It never includes your IP address, your browser details, what you type, your students' names or anything SchoolGPT writes for you. With analytics allowed, two first-party cookies (a random visitor id kept for 180 days and a 30-minute session id) let us see how a visit continues. Without consent in the EEA, the UK or Switzerland, we count anonymous page views with no cookie or identifier for visitors who aren't signed in. If you have a SchoolGPT account and are signed in, we record these in-app events against your account even without analytics consent, but without the visitor and session cookies. We do this on the basis of our legitimate interest (Article 6(1)(f)) in understanding where teachers get stuck so we can help them and improve SchoolGPT; you can object at any time by writing to us, and we will stop. We remember which in-app tips you have already seen or dismissed in your browser, so we don't show them again.

We share data only with providers that help us run SchoolGPT, and only what each one needs. They process it on our behalf under contract.

• Hetzner Online (Germany): application hosting, database and cache.
• OpenAI (United States): generates drafts from your prompts, with student names replaced by placeholders, and, for student spaces and family profiles, generates tutor replies and runs safety moderation on children's messages after personal details are removed. OpenAI does not use API data to train its models.
• Postmark (United States): sends email to adults, such as account emails and safety alerts to teachers and parents. Children never receive email from us.
• Cloudflare (global network): network security, bot protection (Turnstile), IP-based country detection, and file storage (R2) for uploads.
• Google (United States): optional Google sign-in, and Google Analytics with your consent where required.
• PostHog (United States): product analytics, with your consent where required.
• Ahrefs (Singapore): website analytics, with your consent where required.
• Polar (United States): checkout, subscriptions and invoicing as merchant of record.
• Crisp (France): in-app support chat for signed-in teachers.

Our application and database are hosted in Germany. Some providers above are based in, or access data from, countries outside the EEA, notably the United States. Where that happens we rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified recipients, or on the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data), together with the providers' security measures.

We keep your account, classes and content for as long as your account is open, so your work is there when you return. When you delete your account, we delete your account, classes, students, chats, generated content, saved resources, preferences, usage records and uploaded files from our production systems straight away. Copies in our database backups are overwritten within 30 days.

Learner chats and other children's data follow shorter, separate periods, set out in Students and children below. Sign-in sessions expire automatically. Billing records are kept by us and by Polar for as long as tax law requires. Our own first-party analytics events are deleted after 13 months. Data in Google Analytics, PostHog and Ahrefs is kept according to each provider's retention setting.

You can access and download all of your data at any time from the Account page with "Download my data", which gives you a JSON file of everything stored in your account. You can correct your profile and teaching details in Settings, delete individual classes, students and content, and delete your whole account from the Account page.

Under the GDPR you also have the right to restrict or object to processing based on our legitimate interests, to withdraw consent at any time, and not to be subject to decisions based solely on automated processing (SchoolGPT does not make such decisions; you review every draft). To exercise any right, email [email protected] and we will respond within one month.

You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work. In the UK this is the Information Commissioner's Office, and in Switzerland the Federal Data Protection and Information Commissioner.

This section explains, in plain English, what happens when a child uses SchoolGPT. It applies to student spaces set up by a teacher and to family profiles set up by a parent or guardian. If anything here is unclear, write to us at [email protected] with the subject "Children's privacy".

How children use SchoolGPT

Children cannot create accounts themselves. A teacher adds them to a class, or a parent or guardian creates a profile for them. They sign in with a class or family code, tap their name, and enter a picture password or a 4-digit PIN. They do not need an email address, and an adult resets a forgotten password or PIN. The tutor tells children it is an AI, and the screen reminds them that their teacher or grown-up can see their chats.

What we collect from children, and why

• A first name or nickname, an avatar, an age band (such as 8 to 10) and, optionally, a year group. We use these to show their profile and to pitch the tutor's language and safeguards at the right age. We do not ask children for a surname, date of birth, home address, phone number, email address, photo or location.
• Their chat messages and the tutor's replies. We use them to tutor the child and so that their teacher or parent can see what happened. Before a message is stored or sent to the AI, we remove personal details we can detect, such as phone numbers, email addresses, street addresses, social media handles and links.
• The result of our safety checks on each message, and any safety alert created for a teacher or parent. We use these to spot when a child may need help and to tell the adult responsible for them.
• Daily usage (minutes and number of messages), the time of last activity and failed sign-in attempts. We use these to apply time limits and quiet hours, and to lock a profile for ten minutes after five wrong tries.
• Short-lived sign-in sessions (eight hours) so a child stays signed in during the school day.
• For adults who give consent or confirm they are authorised by a school, a record of who, when and how, with a scrambled (hashed) version of their IP address.

Children cannot upload files or images, and the tutor does not browse the web. If a child uses the microphone button for dictation, the speech recognition is provided by their browser or device, which may send the audio to the browser maker under its own privacy terms. We never receive or store the audio, only the text. We do not use location services.

Who processes children's data

• OpenAI (United States) generates the tutor's replies and checks messages and replies for safety (moderation). It receives the redacted message and the recent conversation, never the child's name. OpenAI does not use API data to train its models, though under its API terms it may keep data for a short time to monitor for abuse.
• Postmark (United States) delivers email to adults, such as account emails and safety alert notices to the teacher or parent. Children never receive email.
• Hetzner Online (Germany), our hosting provider, stores the database that holds children's profiles and chats. Cloudflare provides network security for all traffic to SchoolGPT.

We do not run Google Analytics, PostHog, Ahrefs, the support chat or advertising scripts on pages children use, and we do not show the cookie banner there. Children's chats and profiles are never part of our product analytics.

What we never do with children's data

• We never show ads, including targeted ads.
• We never sell, rent or trade it.
• We never use it to train AI models, ours or anyone else's.
• We never build behavioural profiles of children, or use their data for anything other than running the learning service for their school or family.
• We never use tricks to keep a child chatting. There are no leaderboards or streak pressure, and the tutor is told to suggest breaks and to point children to a trusted adult when they are upset.

Who can see a child's chats

For a class, the teacher who runs it can read every chat and receives safety alerts. The teacher can pass an alert to their school's safeguarding lead. For a family profile, the parent or guardian can read every chat and receives alerts. SchoolGPT staff do not read children's chats as a matter of routine. We may look at them only to investigate a safety or security problem, to fix a fault, or when the school or parent asks us for help.

When our safety checks suggest a child may be at risk of harm, the tutor stops tutoring, gives a short, kind message encouraging the child to speak to a trusted adult, shows a helpline for their region, and alerts the teacher or parent. These checks help, but they are not perfect and are not a substitute for adults paying attention.

How long we keep it

• School classes: chats and messages are deleted 180 days after they were written. A school can choose a different period between 30 and 365 days in its safeguarding settings.
• Family profiles: chats and messages are deleted after 90 days.
• Daily usage counts follow the same period as chats. Sign-in sessions end after eight hours, and expired ones are deleted.
• Safety alerts stay until an adult reviews them, and reviewed alerts are deleted after 13 months.
• A child's profile (name, avatar, age band) is kept while the class or family account is active. If a teacher removes a child or class, or a parent deletes a profile or account, we delete the profile and all of its chats and alerts from our production systems straight away. Copies in database backups are overwritten within 30 days.

Rights for parents, guardians and schools

Parents and guardians can review everything we hold about their child, export it, delete it, and withdraw consent at any time. Withdrawing consent means we stop collecting information about the child, and we delete the profile and its data. You can do these things from your family dashboard, or write to us and we will act within one month. Parents can also ask the school, which can contact us on their behalf.

Teachers and schools can review, export and delete a learner's records or a whole class, and pause or remove a learner's access, from the class page. Children can ask their teacher or grown-up to use these rights for them, or write to us themselves.

Our legal basis for children's data

US schools (COPPA). When a school uses SchoolGPT for an educational purpose, the school can authorise the collection of children's information on behalf of parents. A teacher confirms they are authorised to do this for their school before they turn on student access, and we record that confirmation. We use children's data only for the school's educational purposes, and for no commercial purpose. Schools should tell parents that their class uses SchoolGPT, and parents can contact the school or us to review or delete their child's information or to stop further collection.

US families (COPPA). A child profile is not active until a parent or guardian has given consent, and we record when and how they gave it.

FERPA and state laws. When SchoolGPT holds personal information from a school's education records, we act as a "school official" with a legitimate educational interest, under the school's direct control over how we use and keep that information. We do not disclose it again except to the providers named above that help us run the service. Our practices follow the commitments that state student privacy laws, such as California's SOPIPA, New York Education Law 2-d and the Illinois Student Online Personal Protection Act, ask of providers: no targeted advertising, no non-educational profiling, deletion on request and prompt notice of a breach. Schools in these states can request a data processing agreement at [email protected].

UK and EU. For classes, the school is the controller (usually relying on its public task or legitimate interests) and we process the data on its instructions. For family profiles we are the controller and rely on the parent's consent; in the UK, a child under 13 needs a parent's consent for an online service like this. We have built the child experience with the ICO's Children's Code in mind: high-privacy settings by default, no location tracking, no nudging, and clear on-screen notice that a grown-up can see chats and what the parent controls are.

Contact

For any question or request about a child's information, write to [email protected] with the subject "Children's privacy". If you are in the UK or EU, you can also complain to your data protection authority, such as the Information Commissioner's Office in the UK.

We use HTTPS, hashed passwords, access controls that scope every record to its owner, and rate limits. No online service can promise perfect security, so please keep student details to the minimum your writing needs.

Schools and districts can request a Data Processing Agreement or a privacy review by contacting [email protected]. Teacher tools and class jobs are designed so that student names are replaced before anything reaches the AI. Student spaces do collect children's information, and Students and children above explains how we handle it, including our role as a "school official" under FERPA and the school authorization basis under COPPA.

We will update this policy when SchoolGPT changes, and the date at the top shows the latest version. If a change materially affects how we use your data, we will tell you in the app before it takes effect.

Questions can be sent to [email protected].