Data Protection
At Teachmate (the trading name of TeachMateAI Ltd), we take our responsibilities for protecting personal data seriously. We have constructed our Teachmate service with data protection and security principles at its heart. This page sets out the key matters that we believe our customers will want to understand. If you are a school and are carrying out a Data Protection Impact Assessment (DPIA) in relation to the use of our service, you will find this information helpful. If you have any further questions, you can contact us via our contact form at https://www.teachmate.com/contact
The Data Protection Principles
Data Protection law states that when processing personal data, it should be done in line with the data protection principles of: Lawfulness, fairness, and transparency; Purpose limitation; Data minimisation; Accuracy; Storage limitation; Integrity and confidentiality; and Accountability.
We have taken care to ensure that these principles are embedded in our product design and service to our customers. Both where we act as a data processor and as data controller we ensure that these principles are followed. We ensure that our products incorporate data protection by design and default.
Acting as Data Controller
We act as a controller of personal data in the following ways:
When you sign up for a subscription to our service we will hold: your first name and last name, email address, country (this is so we can select which curriculum you require, it may not be the same as the country you are located in), your default curriculum choices, and password. If you upgrade to a pro account, we use Stripe to manage our subscription payments. The Stripe terms of service are here. Individual subscriptions remain until the user deletes the account themselves (this can be done by the user in the 'My Account' tab) or requests for it to be deleted. Inactive accounts will be deleted after 6 years of inactivity.
If you purchase as a school, we act as controller in relation to our main point of contact (the admin user) and also collect the school's name and address. We also act as data controller for the information entered by the admin user about staff (name and email address) to create individual teacher licences. This is so we can send each user information about our news, features and developments.
School data is deleted 28 days after expiration of the contract unless there are active discussions about renewing the licence. Again, we use Stripe to process subscription payments.
If you sign up for one of our free demo webinars, we use Eventbrite to manage the booking process. The Eventbrite terms of service are here.
Once you are using our platform, if you use our feedback tool, we will hold the output (the information generated by the AI tool) and the feedback that you type into the feedback box. For details on how feedback data may be used, see the "AI Models and Your Data" section below.
Similarly, if you contact us with suggestions, we will hold any personal data within your suggestion to develop our services.
If you agree to share information with us to promote our services, or act as an ambassador, we will hold your personal data as a controller. In those cases, we will ask for your consent to share your name, your comments, your school, and a photo before sharing on our social media channels and website.
Our Privacy Notice sets out more detailed information about our use of personal data as Controller.
Acting as Data Processor
We encourage our users to ensure that they also follow data protection principles when using our products and services. There is no requirement to enter any identifiable personal data into any of our AI tools, and it is the user's choice and responsibility to ensure that they follow their school's data protection requirements. For example, the use of personal data should always be minimised, so do not enter pupil information unless you need to. You can use nicknames or pseudonyms instead of real names when creating your inputs if necessary.
However, we acknowledge that it is possible for users to choose to enter personal data into some of our AI tools. Entering any personal data into our tools always remains the choice of the user, and we act as processor only in relation to this information.
When using these tools, users will see a reminder that they should avoid or minimise the use of personal data where possible.
Users can see their inputs and the content they create for 28 days in the My Content area. During this time, the content is held on our servers (stored in the UK and EU). It is automatically removed after 28 days. Users can delete content any time before then if desired, using the delete button.
This ensures that users remain in full control of what they create and how long it is stored. Users are also able to download any content for that time period, which may be helpful in the event of receiving a Data Subject Access Request (DSAR) or other Rights Request.
Only Users can see the content in the My Content area. We do not access or disclose the content within the My Content area to anyone, unless required to by law or the user requests that we do so.
Data Controllers are responsible for identifying an appropriate lawful basis for processing personal data. We are committed to complying with controller instructions, including supporting controllers with upholding their own responsibilities under Data Protection laws, and supporting them to ensure that they comply with Data Subject Rights Requests.
Where we process personal data as a processor, we do so in accordance with our Data Processing Agreement. This agreement is linked to in our Terms and Conditions of Service.
AI Models and Your Data
Our AI tools are powered by large language models (LLMs) provided by our infrastructure partners, hosted on UK servers. The specific providers we use are listed in Annex B of our Data Processing Agreement. We keep our models up to date as new versions are released.
We enhance these models with education specific information curated by our expert staff. Our team continually reviews new publications, curricula and guidance, and where relevant we add this to our system using specialist staff in the education sector in each nation to ensure accuracy and quality.
We do not use your data to train AI models. Customer data, including all user inputs, outputs, and feedback, is never used to train, fine tune, or otherwise incorporate into any large language model. No customer data is included in any model weights, training datasets, or fine tuning processes. This applies to all data entered into our tools, without exception.
User input data is not stored beyond what is necessary to generate the requested output. Output data is retained by us for 28 days only so that the user can access their generation history. Authorised Teachmate staff may access input or output data solely for the purposes of technical troubleshooting, and only when requested by the user or where necessary to resolve a technical issue.
If you use the feedback tool within any of our AI tools, we may use that feedback and the associated output to improve the quality of our service, for example by refining prompts, identifying errors, or improving system performance. This does not involve training or fine tuning of any AI model.
For further reading on the use of AI and data protection, the ICO has published guidance on AI and data protection which users may find helpful.
Storage of personal data
We use Amazon AWS and Azure for data storage and API processing. They meet very high data security standards (SOC 2 and ISO 27001/ISO 27002). All customer data (including account information, tool inputs, and generated outputs) is stored and processed within the UK and EU, using servers provided by AWS and Microsoft Azure.
In addition to our core infrastructure, we use a number of third party services for website analytics, advertising measurement, marketing communications, payment processing, and cookie consent management. These services may process limited personal data (such as IP addresses and browsing behaviour) outside the UK and EU, including in the US. For a full list of these services, please see our Privacy Policy. Where data is transferred internationally, appropriate legal safeguards are in place as required by UK data protection law.
Personal data is encrypted in transit with TLS and at rest through RDS AES 256. More detailed information is contained in our responses to the Vendor Security Information Questionnaire.
Website Analytics and Marketing
To improve our website and measure the effectiveness of our marketing, we use analytics and advertising tools including Google Analytics, Amplitude, HubSpot, and advertising pixels from Meta (Facebook), LinkedIn, and Microsoft (Bing). These tools use cookies to collect information about how visitors interact with our website.
These services are separate from our core AI platform and do not have access to customer data entered into our tools. The use of non essential cookies is subject to your consent, which you can manage through our cookie consent banner (powered by Termly) at any time.
Intellectual Property
The intellectual property of both inputs and outputs always remains the property of the user.
Safeguarding, Harmful Content, Bias and Discrimination
No generative AI product can guarantee zero bias or hallucinations, but we strongly scaffold our prompts and use our own augmentation datasets to ensure accuracy in our results. We educate teachers to evaluate generative AI content before using it, and we provide tools to refine answers if something should be changed.
All of our tools have feedback buttons, through which users may alert us to any tools that may give outputs we need to work on. More complex tools use several rounds of generative AI processing which gives a level of self checking, in so far as we are able.
Users are always responsible for checking their inputs and outputs to ensure that pupils are safeguarded and risk in relation to harmful content, bias or discrimination is removed. Data controllers are responsible for ensuring that their use of AI is transparent and fair to data subjects.
JCQ guidance on AI use and assessments
We do not currently offer any AI tools that are specifically designed to assist teachers with assessing work that is assessed for examination purposes. Teachers are responsible for ensuring that both pupil work and their assessment of it is carried out in line with JCQ requirements.