Data-processing agreement
Version 2026-11
This agreement is between the school that accepts it when setting up Curiosity (“the school”) and [Operator name and postal address go here: set OPERATOR in site/src/plan.js] (“we”). It sets out how we handle personal data for the school, as Article 28 of the UK GDPR requires, and forms part of our terms.
1. Who does what
The school is the controller of the personal data processed through its Curiosity account, and we are its processor. We act only on the school’s documented instructions, which are this agreement and the settings the school chooses, unless the law requires otherwise. If we think an instruction breaks data-protection law, we will tell the school.
The school is responsible for its lawful basis, its data protection impact assessment, telling pupils and parents about Curiosity, and what its staff do with the log and with safeguarding alerts.
We are the controller of our own business records, such as invoices and the contact details of the staff who hold the account.
2. What is processed
| Subject matter | Providing Curiosity to the school. |
|---|---|
| Duration | While the school’s plan runs, and until deletion under section 9. |
| Nature and purpose | Turning pupils’ speech into text; writing answers, speech and pictures; keeping the log; checking questions for safeguarding concerns and alerting the safeguarding lead; applying time limits and daily allowances. |
| Personal data | Whatever pupils say in their questions, which can include names and special category data if a pupil shares it. Curiosity’s answers. Each screen’s username and a scrambled copy of its PIN. The time and screen of each question. The names, job titles and email addresses of staff who set up the account or are named as safeguarding lead. |
| Data subjects | Pupils, staff, and anyone a pupil mentions. |
Voice audio is used to turn speech into text. We don’t store it. We ask schools to name screens by place, such as “Library”, rather than after a pupil.
3. Our commitments
- Anyone we authorise to handle the data is bound by a duty of confidentiality.
- We keep appropriate technical and organisational security measures, including encryption in transit, scrambled PINs, and access to the log limited to the school’s signed-in account holder and safeguarding lead.
- We don’t sell the data or use it for advertising.
4. Sub-processors
The school authorises us to use the sub-processors below. We have contracts with them that place data-protection duties on them, and we remain responsible for their work. We will give the school at least 30 days’ notice by email before adding or replacing one. If the school objects on reasonable grounds and we can’t resolve it, the school may end its plan and receive a refund of the unused part of its year.
- Anthropic: writes the answers and runs the safeguarding check.
- OpenAI: paints pictures when a pupil asks for one.
- ElevenLabs: turns answers into speech and, on some devices, speech into text.
- Cloudflare: hosts the service, stores the log and sends email.
- Stripe: raises invoices and takes payment.
On some devices the browser’s own speech service turns speech into text instead (Google, in Chrome). That service is chosen by the school’s choice of browser.
5. Transfers
Some sub-processors are based in the United States. Where personal data leaves the UK, it is protected by a safeguard UK law recognises, such as the UK–US data bridge or the International Data Transfer Addendum.
6. Helping the school
We will pass on any request we receive from a pupil, parent or regulator about the school’s data, and not answer it ourselves unless the law requires it. We will give reasonable help with subject access requests, the school’s data protection impact assessment, and consultation with the Information Commissioner’s Office.
7. Personal data breaches
If we become aware of a personal data breach affecting the school’s data, we will tell the school without undue delay and within 48 hours, with what we know then and more as we learn it.
8. The log and safeguarding alerts
The log is kept for 90 days and then deleted. If someone reports an answer on a screen, we keep that question and answer for 90 days so we can review it, and the report appears in the school’s flagged log. The safeguarding check is automatic. It can miss concerns and can flag things wrongly, and it doesn’t replace the school’s safeguarding procedures. Alert emails go to the address the school gives and don’t contain the pupil’s words. The school is responsible for keeping that address current.
9. When the plan ends
Within 30 days of the plan ending we will delete the school’s log and screens, unless the law requires us to keep them. The school can ask for a copy of the log before then.
10. Checks
We will give the school the information it reasonably needs to show that this agreement is being followed, and allow reasonable audits with reasonable notice.
11. Changes and the law
If we change this agreement we will email the school at least 30 days before the change applies. This agreement is governed by the law of England and Wales. Contact: [email protected].