For UK schools

Data protection & UK GDPR

This page explains how Questipedia processes personal data for UK schools under the UK GDPR and the Data Protection Act 2018. It is maintained by Questipedia and is not a legal document — the binding terms are in our Terms of Service, Privacy Policy, and Data Processing Agreement (DPA) available on request.

Controller & processor

Consumer accounts (parent-purchased)

Questipedia is the data controller for the parent and pupil account.

School licences

The school is the data controller for pupil data. Questipedia acts as the data processor and operates strictly under a signed DPA.

Educator accounts

Questipedia is the data controller for adult educator accounts and their DBS records.

What we collect

Pupil: display name, year group, school (if licensed), chosen avatar, learning activity, lesson bookings, moderated chat, lesson recordings where applicable.
Parent / adult: name, email, hashed password, billing metadata (via Stripe — we do not store card numbers), consents given.
Educator: above, plus Enhanced DBS certificate scan, qualifications, and payout account reference (via Stripe Connect).
Technical: IP address, device metadata, and error logs for the shortest time we need to keep the service reliable.

Lawful basis

Contract — to deliver the learning service purchased by the parent or school.
Legitimate interests — for security, moderation, and preventing abuse (balanced against pupil rights).
Legal obligation — for safeguarding referrals and tax records.
Consent — for optional communications and for anything a parent explicitly opts into.

We do not rely on legitimate interests for advertising, and we do not use pupil personal data to train our AI models.

Hosting & subprocessors

Application hosting

Cloudflare Workers (edge, EU/UK region routing where available).

Database, auth, storage

Supabase (project in EU region).

Email delivery

Resend (transactional email).

Payments

Stripe (PCI-DSS Level 1). We never see or store card numbers.

AI inference

Lovable AI Gateway. Pupil prompts are not used to train foundation models.

Video calls

Managed WebRTC provider used for live lessons; recordings stored on our Supabase project.

The current subprocessor list is provided in full inside our DPA and updated when it changes; schools with a signed DPA are notified before new subprocessors are added.

Retention

Active pupil account

Kept while the account is in use.

Chat & moderation logs

12 months, then purged (retained longer only if flagged for safeguarding review).

Lesson recordings

90 days by default; schools may request deletion sooner.

Financial records

7 years (HMRC requirement).

Backups

Rolling 30 days; deletions propagate on the next cycle.

Data subject rights

Parents (and pupils via their parent) can request access, correction, restriction, or erasure at any time. Schools acting as controller can raise DSARs on behalf of pupils via their nominated contact.

DSAR route: email privacy@questipedia.co.uk. We respond within 30 days (UK GDPR statutory window). Identity verification may be required.

Breach notification

Personal data breaches meeting the ICO threshold are reported to the ICO within 72 hours of discovery. Affected schools are notified without undue delay with a description of the incident, the data involved, and the remedial steps taken.

How to get our DPA, ROPA extract, or privacy notices

Email privacy@questipedia.co.uk or the schools contact suleman.md@gmail.com. We aim to return countersigned DPAs within 5 working days.