Data Processing Summary (Schools)

Last updated: 16 October 2026

Roles

The School is controller; Flexrep School is processor for school-licensed accounts.

Purpose

Providing revision quizzes, flashcards, marking, analytics and assignments to the School's pupils and staff.

Data processed

Username, age band, year group, exam board, subjects, class membership, quiz attempts, scores, topic mastery, streaks, XP, uploaded study content, and teacher account details. We do not require real names, home addresses, phone numbers or email addresses from pupils.

Sub-processors

Supabase (database, authentication, storage, hosting), Anthropic (AI processing of uploaded content; not used to train models), Stripe (school payments only; no pupil data), an email delivery provider [SET_EMAIL_PROVIDER] for transactional email, and the static web host for this website.

Security

Encryption in transit, access controls, row-level security, audit logging of teacher access to pupil data, automatic deletion of uploaded images within 24 hours.

International transfers

Protected by UK adequacy regulations, the UK IDTA/Addendum or equivalent safeguards.

Children's data

Pupil accounts for children under 13 are created by the School, which is responsible for giving pupils and parents appropriate notice and for having a lawful basis. We process under-13 data only on the School's documented instructions, apply the safeguards in our Safety page, support the School's Data Protection Impact Assessment on request, and notify the School without undue delay of any personal data breach. Safeguarding alerts raised by pupils or flagged by our systems are delivered to the School's nominated safeguarding contact.

Assistance

We help the School respond to data subject requests, provide export and deletion tools, and notify the School without undue delay after becoming aware of a personal data breach.

Deletion

On written request or after the licence ends, as set out in the School Terms.

Data protection contact

flexrepschool@gmail.com. A signed Data Processing Agreement is available on request.