Loading…
For schools
Schools trust us with student data, so here's exactly how we handle it, what we store, where it lives, and the rights you keep. No jargon.
Student data is used only to run the platform for your school. We never sell it, and we never share it with advertisers or third parties for marketing.
We do not use student work to train AI models, and our AI provider does not train on anything sent through its API. Answers are processed only to give the student feedback.
The school remains the data controller. You can ask us to export or delete your data at any time, and we action deletion requests within 30 days.
We collect only what the platform needs: name, email, the papers a student completes, marks and progress. No home address, no phone number, no unnecessary personal data.
We show no advertising and use no third-party advertising or social-media trackers. Our analytics is privacy-first and cookieless.
Encrypted in transit (HTTPS) and at rest, access-controlled by role, with two-factor authentication available on every account.
Their name and email, the school and classes they join, the papers they open and complete, their marks, grades and progress, and any answers or questions they submit for AI marking or the tutor. Nothing more, no home address, no phone number, and no student payment details on a school plan.
No. When a student submits an answer for marking or asks the tutor a question, it is sent to our AI provider (Anthropic) purely to generate that response. It is not used to train their models or ours, and it is never used for advertising or sold on.
They are processed to produce feedback and stored with the student's own record so they can see their history and progress. They are not shared, sold, or used to train models.
Yes. There is no advertising, no behavioural profiling and no data selling. Parents/guardians get read-only access, and a student only needs a name and email to take part.
Our database and application are currently hosted in the United States (AWS, US-East) via our infrastructure providers Neon and Vercel. Where data is transferred outside the UK/EEA, we rely on the European Commission's Standard Contractual Clauses to protect it. We're happy to discuss EU-region hosting for a school that requires it.
The student, their teacher(s) for the classes they're in, a linked parent/guardian (read-only summary), and the school's head admin. SuperExams staff access data only for support and only when needed.
We use a small set of providers to run the service: Neon (database), Vercel (hosting), Stripe (payments), Google Workspace (email), and our AI model provider (Anthropic) for marking and tutoring. Each is bound by its own data-protection terms.
We notify the affected school promptly and, where legally required, the relevant supervisory authority within 72 hours of becoming aware, in line with GDPR.
Yes. Through your branded school portal you can limit which subjects appear and manage who is a member, so students only see what you want them to.
Yes. We can provide a short data-processing agreement covering what's stored, where, retention and your rights, for your head or DPO to sign before a pilot.
While the account is active. When a student leaves, their account unlinks from the school. On a deletion request we remove personal data within 30 days. If you don't continue after a pilot, we delete the school's student data on request, nothing is kept or repurposed.
Want the data-processing agreement, or EU-region hosting for a pilot?
We'll sort it before you start. Founder-led, reply within one working day.
Book a demoSee also our privacy policy and terms.