What this software does with data

Who decides what

Vita et Pax Preparatory School is the data controller. We are the processor. We act on the school's instructions and on nothing else. The lawful basis is the school's public task, so nothing here depends on a parent giving or withholding consent.

What is held about a child

• First name, and the initial of their surname.
• Year group and class.
• A sign-in name we generate, and a four-digit PIN, stored hashed.
• Their answers, whether each was right, how long they took, and the question they were asked.

The full surname is off by default and a school has to turn it on.

What is never collected

Date of birth, UPN, address, telephone number, a pupil email address, SEN or EHCP status, ethnicity, free school meal eligibility, photographs.

The class-list importer refuses these columns by name and tells the school it dropped them. There is no column in the database to put them in, and a test fails the build if one is ever added.

Who can see it

• A teacher sees the classes their school gave them, and no others.
• An administrator or senior leader can read across the school.
• Every time a member of staff opens a named child's record, that is written to a log the school can read and nobody can edit or delete — including us.
• The classroom display shows counts only. It never shows a child's name or a child's answer.

How long it is kept

The school sets the period, between three months and seven years. When a pupil leaves they can no longer sign in, and when the period runs out their record, their work and the log of who looked at them are deleted together. That deletion runs nightly and by itself.

What we do not do

• No advertising, no profiling for advertising, no selling or sharing of anybody's data.
• No third-party script, tag or analytics on any page a child can reach. The browser is told to refuse them, not merely not sent them.
• No artificial intelligence in any request. No child's work is sent to any AI system, because nothing in the product calls one.
• No licence key, no activation, no remote switch. A school that stops paying keeps working software and loses support.
• No email is sent to a child, ever. There is no address to send one to.

Where it runs

The hosted service runs on Vercel with a PostgreSQL database in the EU (Ireland). A school may instead run the software on its own server, in which case the data never leaves the school's own infrastructure and we hold none of it.

Curriculum version 1.2.0. The curriculum is part of the software, not part of your data.

Asking for something

A parent or pupil asks the school, because the school is the controller. The school can see, correct and delete anything held here from its own settings screens, without asking us.