For schools

Data & privacy, in plain English

Schools trust us with student data, so here's exactly how we handle it, what we store, where it lives, and the rights you keep. No jargon.

We never sell or share student data

Student data is used only to run the platform for your school. We never sell it, and we never share it with advertisers or third parties for marketing.

You own your school's data

The school remains the data controller. You can ask us to export or delete your data at any time, and we'll action deletion requests within 30 days.

Minimal collection

We collect only what the platform needs: name, email, the papers a student completes, marks and progress. No unnecessary personal data.

Secure by default

Encrypted in transit (HTTPS) and at rest, access-controlled by role, with two-factor authentication available on every account.

Questions heads & IT ask

Where is the data hosted?

Our database and application are currently hosted in the United States (AWS, US-East) via our infrastructure providers Neon and Vercel. Where data is transferred outside the UK/EEA, we rely on the European Commission's Standard Contractual Clauses to protect it. We're happy to discuss EU-region hosting for a school that requires it.

Who can see a student's work?

The student, their teacher(s) for the classes they're in, a linked parent/guardian (read-only summary), and the school's head admin. SuperExams staff access data only for support and only when needed.

What about sub-processors?

We use a small set of providers to run the service: Neon (database), Vercel (hosting), Stripe (payments), Google Workspace (email), and our AI model provider (Anthropic) for marking and tutoring. Each is bound by its own data-protection terms.

Can we get a data-processing agreement?

Yes. We can provide a short data-processing agreement covering what's stored, where, retention and your rights, for your head or DPO to sign before a pilot.

How long is data kept?

While the account is active. When a student leaves, their account unlinks from the school. On a deletion request we remove personal data within 30 days.

Want the data-processing agreement, or EU-region hosting for a pilot?

We'll sort it before you start. Founder-led, reply within one working day.

Book a demo