Security and data
Built to protect educators and learners
Everything a leader, data protection officer or procurement team needs to know in one place. The short version: no learner records, no recordings kept, educators own their reports, and we name every provider that touches your data.
What happens to a session
From recording to report, step by step
Lessons are recorded on your device. When you stop, the recording is uploaded, transcribed and deleted as soon as your report is written. We don't keep lesson recordings.
Your report and its transcript stay with your account until you or your organisation delete them. Leaders only see your reports if you choose to share them.
Our commitments
- 01
No learner records
We never ask for learners' names, class lists or registers. Feedback is about the teaching.
- 02
No recordings kept
Lessons are recorded on your device. When you stop, the recording is uploaded, transcribed and deleted as soon as your report is written. We don't keep lesson recordings.
- 03
Educators own their reports
Reports are private by default. Leaders only see a report if the educator shares it.
- 04
What leaders see
Who's recording, so they can offer support, but never how anyone's lessons went. Team trends are anonymous and need five or more teachers.
- 05
Encrypted and access-controlled
Data is encrypted in transit and at rest, access is role-based and every request is authenticated.
- 06
UK company, UK law
EducAitor Ltd, registered in England and Wales. UK GDPR applies, with the ICO as regulator (registration ZC270792).
Who processes your data
Sub-processors
- Amazon Web Services
Hosting, database, file storage, sign-in and email for the EducAitor app. Stored in the EU (AWS Ireland).
- Groq, Inc.
Transcribes lesson audio. United States. Not permitted to train on your content.
- OpenAI
Writes feedback reports and powers the AI coach; transcribes if Groq is unavailable. United States. Not permitted to train on your content.
- Google and Apple
Push notifications, and sign-in if you choose to use them.
- Sentry
Error and performance monitoring, hosted in the EU.
- Vercel and Resend
This website and the emails its forms send.
Retention
How long we keep things
- Lesson audio
Deleted as soon as the report has been written. A recording that cannot be processed is deleted automatically.
- Reports, transcripts and development records
For as long as the account is active, or until the educator or organisation deletes them.
- Deleted accounts
Removed from live systems straight away; backup copies are overwritten within 35 days.
- International transfers
Where a provider processes data outside the UK we rely on UK adequacy regulations or the UK International Data Transfer Addendum.
For your due diligence
What we can provide
- A data processing agreement for organisation accounts
- Support completing your data protection impact assessment
- A description of our security controls and sub-processors
- Our AI use statement, naming every provider and what the AI does not do
- A named contact for data questions: support@educaitor.ai