Privacy notice

Who is responsible

SeedSlate is the platform and intended trading name. The public support and privacy contact is info@seedslate.co.uk. The legal operator and postal contact address are omitted from this draft at the owner’s request and must be confirmed before this notice is issued. No limited company has been confirmed.

The operator is responsible for its own account administration and security processing. A school or tutor may separately determine how student teaching records are used, with SeedSlate acting on its instructions. These roles must be agreed for each service arrangement.

Information used

Account information includes sign-in identity, email, display name, role, optional organisation and profile details, invitations, class membership, session identifiers and account activity. Do not add a phone number or address unless it is needed.

Teaching information includes decks, drawings, worksheets, schedules, assignments, answers, marks, feedback and uploaded documents or photos. Messages and support suggestions are saved. Camera photos can become saved lesson or submission content.

Live voice uses microphone permission and browser audio connections. No audio-recording code was found in the reviewed application. Connection signalling and call metadata can be stored; peer connections may expose network addresses to participants or relay providers. Do not treat a live lesson as confidential from its intended participants.

Technical information includes access/security records, diagnostic categories and, when the owner starts lesson monitoring, pseudonymous device identifiers, traffic counts and sampled round-trip timings. Monitoring reports do not intentionally collect board content, names or email addresses. Existing registration-source records may contain campaign labels and referring hostnames.

Purpose and lawful basis

Information is used to provide lessons and accounts, save work, deliver invitations, protect access, investigate failures and handle requests. The operator must complete a purpose-by-purpose lawful-basis register before issuing this notice.

A teacher contract does not automatically provide a contractual lawful basis for every child’s data. Where a school controls educational records, its instructions and basis must be distinguished from the operator’s own processing. Any reliance on legitimate interests requires a documented balancing assessment, particularly for children. Consent for optional purposes must be separate from accepting service terms.

Who can receive information

Teachers and students receive content allowed by their class, deck and assignment access. Other intended participants can see shared work and receive messages. The platform owner has administrative access; authorised support access must be limited to need.

The application uses Cloudflare-hosted services and durable database/file storage, Google Firebase for live-site sign-in, and Ably for realtime delivery when configured. Hosting is managed through Sites. Invitation email can use IONOS or Resend depending on configuration. Private testing uses a separate owner identity, database and file store.

The final supplier list must identify the actual contracted entities, enabled providers, processing locations, retention, subprocessors and safeguards for any restricted international transfers. This draft does not promise UK-only storage.

Retention and deletion

Saved work and messages do not currently have one verified automatic expiry period. The operator must approve separate periods for teaching content, accounts, communications, uploads, support records and backups. Archiving or hiding content is not erasure.

Application diagnostics use a 90-day cleanup threshold, triggered by activity. Monitoring reports use a 24-hour threshold, pruned when another run starts. Neither is a guarantee of deletion at that precise time. Provider log and backup retention must be checked separately.

The present administrative account-removal action blanks some profile fields and blocks access; it does not erase all linked work or the Firebase identity. Erasure requests need a coordinated review of database records, files, authentication and backups, including any lawful reason to retain particular records.

Your rights and complaints

Depending on the processing and legal basis, you may request access, correction, erasure, restriction or portability, object to processing, or withdraw consent without affecting previous lawful processing. A school-controlled record may require the school’s involvement. A parent does not automatically have unrestricted access to a child’s data.

For privacy questions, complaints or rights requests, the intended public contact is info@seedslate.co.uk. Mailbox delivery, monitoring and the request-handling process must be verified before this notice is issued. Privacy complaints must be logged, acknowledged within 30 days, investigated and given an outcome without undue delay. Rights requests have their own statutory deadlines.

You can complain to the UK Information Commissioner’s Office at ico.org.uk. The operator must assess and explain any applicable automated-decision processing; automatic worksheet scores do not constitute verified automatic method marking.