For your data protection lead

Data protection for schools

Spelling.Live holds a pupil's first name and their spelling practice, stores it in the EU, keeps nothing a pupil types freely, and deletes a class on the school's instruction. The school is the data controller and we are its processor. This page is the short version; the signed documents are one email away.

Last reviewed 13 October 2026. Operated by AK Shah Ltd, ICO registration ZC266285.

The pack

Data protection summary	On the site This page as a document your DPO can file: who holds what, where, for how long, and why. PDF · Word
Data processing agreement	By email Our processor terms under UK GDPR Article 28, written to be read in ten minutes. A pre-signed copy is sent within one working day of a request, and we accept reasonable amendments from your DPO.
Data Protection Impact Assessment	On the site Spelling.Live has completed its own DPIA, as the data controller for the service. It sets out every risk to pupils and parents, the mitigation and the residual rating. It is for your DPO to review, and it is written to support the school's own DPIA process rather than to replace it. PDF · Word
Record of Processing and breach plan	On the site Our UK GDPR Article 30 record, with the 72-hour breach response plan and each processor's security contact. PDF · Word
Children's Code self-assessment	On the site Our position against each of the ICO's 15 Age Appropriate Design Code standards. PDF · Word
AI providers and your data	On the site Every AI provider, what it receives, the no-training position and our review log: spelling.live/ai-transparency.
Privacy policy and terms	On the site Privacy policy and terms. For a school's pupil data the data processing agreement prevails over both.

Send the pack to your DPO

The documents above go to this address straight away, with the data processing agreement following from Manoj within one working day.

Your name

School

Your role

Email to send it to

Anything we should know? Optional

We use these details only to send the pack and the agreement. Prefer email? support@spelling.live.

Who is responsible for what

The school	Data controller for its pupils' data. The school decides which classes use Spelling.Live, which pupils are added and when they are removed. Your existing privacy notice to parents should cover online learning tools; we can supply a paragraph for it.
Spelling.Live	Data processor, acting only on the school's instructions, to deliver spelling practice and reporting to the school's teachers. Operated by AK Shah Ltd, registered in England and Wales (company number 17491910), registered office 9 Cobham Avenue, New Malden, KT3 6EP. ICO registration ZC266285. Built for children aged 5 to 11 under the ICO's Age Appropriate Design Code.
Parents at home	Where a parent creates their own Spelling.Live account for the same child, we are the controller for that account under our privacy policy. It is separate from the school's data.

What we hold about a pupil

Who they are	First name (surname optional), school year and which English the school teaches, so the right words are shown and the child is named on screen. Never: date of birth, address, pupil number (UPN), SEN status, attendance, photos of the child, parent contact details.
How they sign in	A username and the password printed on their QR label, kept so the label can be reprinted. A login opens spelling practice and nothing else. Never: a pupil email address. Pupils do not have one.
What they practised	Words attempted, right or wrong, what they typed or wrote, hints used and scores, to mark, to schedule revision and to report to the teacher. Never: anything a pupil types freely. There is no chat, no messaging and no free-text box for children.
What they find hard	The spelling rules a pupil keeps getting wrong, worked out from their own mistakes, for the curriculum report and the AI coach's tips. Never: any judgement about ability beyond spelling.
What they wrote	Handwriting from the Write it pad and photos of marked paper tests, for the most recent 100 attempts per pupil, so the teacher can see what the child actually wrote. Never: voice recordings. Spoken spelling is transcribed and the audio discarded.
Where they came from	If the class was imported from a roster, the pupil's Google Classroom or Wonde identifier, so a repeat import never creates the same child twice. Never: grades, coursework or anything else from Classroom or the MIS.
Teachers	Name and school email address for the teacher's own account.

Parents are not contacted by Spelling.Live during a school pilot unless the school asks for parent reports.

Where it is stored and who processes it

Everything we keep about a pupil is stored in the European Union (Ireland). Our web hosting is set to Frankfurt; as with any website, an individual request may be handled at the server nearest the user, but nothing is stored outside the EU. We choose the EU option wherever a provider offers one.

The AI models that write practice sentences and read children's handwriting are not offered from UK or EU data centres today, so those requests are processed in the USA. Each one carries only what the task needs, with no name or identifier, is processed and returned, and is not stored or used to train any model. We review this as sovereign options appear and will move when one is available.

Supabase	Database, file storage and sign-in. All stored data. EU (Ireland).
Vercel	Web hosting and delivery. Server logs and IP addresses. EU (Frankfurt), worldwide delivery network.
OpenAI	Target words and the pupil's age band, to write sentences and hints and to draw a word's picture hint; handwriting and paper-test images, to read them (at every reading level, and the only reader at the forgiving level); spoken spelling, to transcribe it. No names. USA.
Google Cloud	Words and sentences for British-English audio; the image of a word drawn on the Write it pad, to read it at the standard and strict levels, with no name and without being told the expected word. USA.
Anthropic	Feedback a teacher or parent types into the feedback form, to triage it. USA.
Resend	Email to teacher accounts: name, address and the message sent. USA.
PostHog	Anonymous usage statistics: event counts with no names, no practice words and no typed text. EU.

Transfers to the USA are covered by each provider's data processing agreement with Standard Contractual Clauses and the UK Addendum. The full register, what each provider receives and our review log: AI providers and your data.

How long we keep it, and how the school gets it back or deleted

During the pilot or subscription: practice data is kept so the teacher's reports work. Handwriting and paper-test images are capped at the most recent 100 attempts per pupil; older ones are deleted automatically. Spoken spelling is never stored.
Operational logs: AI usage logs up to 14 months, email logs 12 months, server logs per the hosting provider's standard window.
At the end: the school chooses. Either the classes continue, or the school asks us to delete them and we erase every pupil's profile, practice, handwriting and login within 30 days, with residual copies in encrypted backups rolling off within a further 30 days. We confirm in writing.
A single pupil: the teacher can remove a pupil from the class at any time, and a request to delete one child's data is met within five working days.
Export: the school can have a copy of a class's data in machine-readable form (JSON) on request, for a subject access request or to move elsewhere.
Nothing is sold or shared for marketing, and pupil data is never used to train AI models.

Security and safeguarding, in plain words

Pupils cannot reach each other. A pupil's login shows only their own practice. There is no chat, no messaging, no friend list and no public profile.
Only the pupil's own teacher sees their data. Access is enforced at the database row level: a teacher sees the classes they own or have been given, and nothing else.
Children never type freely. The only inputs a child has are a spelling answer, a tap on an option, their handwriting and their voice. Nothing they produce is shown to another child.
AI content is guarded. Every sentence, hint and clue a child sees is generated under a child-safety instruction and moderated; anything a teacher or child reports is reviewed by a person.
Printed logins are low-risk by design. A pupil's login gives access to spelling practice and nothing else, which is why it is safe to print on a label and stick in a book. The teacher can reset any login in one tap.
Encrypted in transit and at rest, with daily encrypted backups; private storage for images; secrets held server-side only.
Breaches: we assess any incident immediately, notify the school within 48 hours of becoming aware, and report to the ICO within 72 hours where required.
No advertising, no tracking for marketing, and analytics are anonymous.