Legal
Privacy Policy
Last updated October 11, 2026 · Version 2.0
At a glance
- Global Digital Labs Ltd runs EduAgentic and is responsible, as data controller, for the personal data of everyone who uses it, including learners and staff of the schools and other organisations that use EduAgentic.
- We use personal data to run the learning service: accounts, courses, progress, live classes, messages and AI help. We never sell it, never use it for advertising and never use it to train AI models.
- Many of our users are children. A child joins through their school or organisation or through a parent or guardian, and AI for learning is used by a child in a family account only after a parent or guardian switches it on.
- If you sign in with Google, we receive only your name, e-mail address, language setting and Google account identifier, and use them only to sign you in.
- You can download a copy of your data or delete your account from your account settings, and you can contact our Data Protection Officer at dpo@eduagentic.ai.
This summary highlights the main points. The full text below is what applies.
1.Who we are and what this policy covers
EduAgentic is a learning platform operated by Global Digital Labs Ltd, a private limited company registered in Scotland under company number SC463994, whose registered office is at 45 Lagrannoch Drive, Callander, Perthshire, FK17 8DW, United Kingdom (“we”, “us”, “our”).
This policy explains what personal data we collect when you use EduAgentic (the web application at app.eduagentic.ai, the spaces of the organisations that use it, their public pages, our live classrooms and related e-mails), why we use it, who we share it with, how long we keep it and what rights you have. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR), the Privacy and Electronic Communications Regulations (PECR) and the ICO's Age Appropriate Design Code (the Children's Code).
Our company website at eduagentic.ai is not covered by this policy.
2.Our role and the role of organisations
Global Digital Labs Ltd is the controller of the personal data processed on EduAgentic. This applies to everyone: people who learn or teach on their own, families, and the learners, parents and staff of the schools, colleges, academies and other organisations that use EduAgentic. We decide how the service processes personal data and we are responsible for it.
Each organisation administers its own space. Its administrators and teachers decide who joins, which courses are taught, which features are switched on (for example Google sign-in or live classes), and they create, assess and report on learning. When they do so, they use EduAgentic as we designed it and as this policy describes, and they can see the information about their learners and staff that their role needs.
You can always come to us directly about your personal data, whichever organisation you belong to. Write to our Data Protection Officer at dpo@eduagentic.ai. If you contact your organisation first, it can pass your request to us.
3.Definitions
In this policy:
- Personal data means any information about an identified or identifiable living person.
- Organisation means a school, college, university, academy, training provider or other body that uses EduAgentic, and space means its own area of the service.
- Learner means a person who uses EduAgentic to learn. A child is a learner below the age of digital consent in their country: 13 in the United Kingdom and the United States, between 13 and 16 in the European Union depending on the country, and 16 where we do not know the country. A learner whose age we do not know is treated as a child.
- Parent or guardian means a person with parental responsibility for a child, linked to the child's account.
- Staff means teachers, tutors and administrators.
- Service provider (or processor) means a company that processes personal data for us, on our instructions and under a contract.
4.The personal data we collect
What we hold about you depends on your role and on the features your organisation uses. The table lists each category, what it includes and where it comes from.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account and identity | Name, username, e-mail address (optional for learners), password (held only in our sign-in service, in hashed form), role, organisation, language, time zone, country, date of birth or year of birth, sign-in history. | You, your organisation, or your parent or guardian; Google if you sign in with Google. |
| Profile | Display name, picture or avatar, short biography, accessibility settings, teacher title, qualifications and introduction video, a parent's relationship to a child. | You or your organisation. |
| Learning and assessment | Enrolments, lesson progress, practice answers, mastery and review schedules, assignments and the work submitted, grades, feedback, rubrics, certificates, badges and rewards. | Your use of the service; your teachers. |
| Support and wellbeing | Learning-support notes and plans, accessibility needs, screening results for learning differences (screening only, never a diagnosis), signs that a learner may be struggling, and engagement questionnaires. | Your teachers and organisation; the service, from your learning activity. |
| AI conversations | What you write to LUMI and to the other AI features, the answers, short summaries, and learning notes that never contain names or contact details. | You; the AI features. |
| Live classes | Attendance, joining and leaving times, time speaking or on camera, device and browser type, chat, poll answers and reactions, and, where a class is recorded, the recording of your voice, video, shared screen and chat. | Your participation in a live class. |
| Messages and content you create | Messages, posts, discussion contributions, artwork, music, coding projects, files you upload, support requests, friend requests. | You and the people you communicate with. |
| Family links and consent | The link between a parent or guardian and a child, how it was verified, and the record of consent given or withdrawn (with the time, IP address and browser, stored encrypted). | Parents and guardians; your organisation. |
| Payments | Plan, subscription status, purchases, and the reference numbers of our payment provider. We never receive or store full card details. | You; Stripe. |
| Technical and security | IP address, browser and device information, sign-in events, security and audit logs, cookies and similar technologies described below. | Your device and your use of the service. |
Some support and wellbeing information can be special category data, for example about a learner's health or learning differences. It is entered by staff only where the learner's education needs it, it is visible only to the people who support that learner, and we protect it as described in this policy.
We do not ask for or keep phone numbers, gender, home addresses or government identification numbers for learners.
5.How we use personal data and our lawful bases
We use personal data only for the purposes below. Each has a lawful basis under the UK GDPR and the EU GDPR.
| Purpose | Lawful basis |
|---|---|
| Creating and running accounts and spaces, delivering courses, lessons, assignments, grading, certificates and progress reports. | Performance of a contract (Art. 6(1)(b)) with you or your organisation; for state schools, our legitimate interest in providing the service they use for their public task (Art. 6(1)(f)). |
| Adapting practice and review to each learner (mastery and spaced repetition), and showing learners, parents and teachers how learning is going. | Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) in effective teaching. |
| AI for learning: LUMI, AI tutoring and practice help, and reading how a learner feels from what they write so the help can adapt. | For a child in a family account, the consent of a parent or guardian (Art. 6(1)(a)); for a learner of an organisation, the organisation's confirmation on the learner's behalf and our legitimate interests (Art. 6(1)(f)); for adults, performance of a contract (Art. 6(1)(b)). |
| AI tools for staff: drafts of report comments, support plans and class insights. | Legitimate interests (Art. 6(1)(f)) in supporting teachers; a teacher always reviews the draft. |
| Recording learning-support needs and screening for learning differences. | Legitimate interests or public task of the organisation (Art. 6(1)(e) or (f)), and for special category data, substantial public interest or the provision of education and support (Art. 9(2)(g)), or explicit consent where required (Art. 9(2)(a)). |
| Running live classes, taking attendance and, where the organiser chooses, recording them. | Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)); for invited guests, consent to the recording (Art. 6(1)(a)). |
| Sending service e-mails and notifications (sign-in, invitations, reminders, grades, messages, weekly summaries for parents). | Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)). You can switch off non-essential notification types in your settings. |
| Keeping learners safe: safeguarding alerts, moderation, guardian approval of friendships for children, and responding to concerns. | Legitimate interests (Art. 6(1)(f)), legal obligation (Art. 6(1)(c)) and, for special category data, the substantial public interest in safeguarding children (Art. 9(2)(g)). |
| Taking payments, managing subscriptions and keeping financial records. | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)). |
| Securing the service, preventing misuse, keeping audit logs and fixing faults. | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)). |
| Understanding how the service is used, in aggregated form, to improve it. | Legitimate interests (Art. 6(1)(f)). |
Where we rely on consent, you (or the parent or guardian who gave it) can withdraw it at any time. Withdrawing does not affect what was done before. We do not make decisions about anyone that are based solely on automated processing and have legal or similarly significant effects on them.
6.Children
EduAgentic is designed for learners of all ages, including young children, and we apply the standards of the UK Children's Code. We are also mindful of the US Children's Online Privacy Protection Act (COPPA).
- How a child joins. A child joins through their school or other organisation, which enrols them, or through a parent or guardian, who creates their account. Children cannot sign up on their own.
- Parents and guardians. A parent or guardian is linked to a child's account with a single-use code or when they create the account. They can see the child's progress, attendance, work, certificates and consent settings, and they can download or delete the child's data.
- AI for learning. For a child in a family account, AI for learning is off until a parent or guardian switches it on, and it can be switched off at any time. For a child in an organisation, the organisation decides on the child's behalf.
- Built-in protections. A child's friend requests need a guardian's approval, a child's name is not shown on public leaderboards, and a child cannot delete their account or change their e-mail address alone; a parent, guardian or organisation does this.
- Data minimisation. A child does not need an e-mail address. We collect only what the learning service needs.
- No advertising and no profiling for marketing. There is no advertising on EduAgentic. We never use a child's data for marketing, never sell it and never build profiles for anything other than their learning.
If you believe we hold a child's data without proper authority, contact dpo@eduagentic.ai and we will act promptly.
7.Artificial intelligence
EduAgentic includes AI features: LUMI, the learning companion; AI tutoring and help with practice; spoken answers and listening (speech to text and text to speech); generated pictures for lessons; and tools that help staff draft materials, report comments and support plans.
Our AI provider is Google, through the Gemini API. Google processes what we send only to return an answer to us. Where an organisation connects its own AI account, its requests go to that provider under the organisation's agreement with it.
What we send, and what we do not
- We send what you type or say and the learning context the answer needs (for example the lesson topic or the question you are practising).
- We do not send a learner's name, e-mail address, date of birth or contact details. Where staff write about a learner, the learner's name is replaced before the text leaves our servers.
- Voice is converted to text and the audio clip is not stored.
- The AI may read how a learner feels from the words they write (for example that they are struggling) so that it can adjust its help. It never uses a camera, the voice or other biometric data for this.
We do not use your personal data to train AI models, and we do not allow our AI provider to use it to train or improve its models. We do not sell it or use it for advertising.
AI answers can be wrong. They support learning and teaching; they do not take decisions about learners. Teachers review AI drafts before they use them.
8.Live classes and recordings
Live classes take place on our own classroom server, which runs BigBlueButton software and is operated by us; the audio, video and chat of a class do not pass through any other company's meeting service.
Recording. The teacher or organiser decides whether a class is recorded. Learners are told before they join a class that it may be recorded, and the classroom shows when a recording is running. Invited guest speakers must agree to the recording before they can join. Organisations are responsible for deciding when it is appropriate to record children and for informing participants.
Who can watch. Recordings are stored on our classroom server and played only through short-lived secure links. They can be watched by the teacher who ran the class, by learners who were invited to or attended it, and by the organisation's senior administrators. They are not public.
How long they are kept. A recording is kept for 12 months unless the organisation sets a different period or the teacher deletes it sooner. A deleted or expired recording goes to a protected bin for 30 days, in case it was deleted by mistake, and is then permanently erased.
9.Sign in with Google
Where your organisation allows it, you can sign in to EduAgentic with your Google account instead of a password. This section explains exactly what we receive from Google and what we do with it.
What we receive
We ask Google only for the basic sign-in permissions openid, profile and email. With them Google gives us:
- your name (first name and last name);
- your e-mail address and whether Google has verified it;
- your Google account identifier (a number that identifies your Google account to us);
- your profile picture address and your language setting, as part of the basic profile.
We keep your name, e-mail address, language setting and Google account identifier. We do not store your Google profile picture. We do not receive your Google password, and we do not keep the access tokens Google issues: we do not request offline access and we cannot act in your Google account. We do not request access to any other Google data such as Gmail, Drive, Contacts or Calendar.
How we use it
We use this information only to sign you in to EduAgentic through our own identity service (which we host ourselves), and to create your EduAgentic account on your first Google sign-in or link Google to your existing account with the same e-mail address. Your name and e-mail address then appear in your EduAgentic account like those of any other user.
- We do not sell Google user data.
- We do not use Google user data for advertising, including retargeting or personalised or interest-based ads.
- EduAgentic does not use Google Workspace APIs, or any user data obtained through Google APIs, to develop, improve or train generalised or non-personalised AI and/or machine-learning models.
- We do not transfer Google user data to anyone else, except to our service providers who host and run EduAgentic for us under contract, where needed to comply with the law, or as part of a merger or acquisition with notice to you. No person reads it except where you ask us for support, for security or legal reasons, or where it is aggregated and anonymised.
EduAgentic's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How long we keep it, and how to remove it
We keep the information we received from Google for as long as your EduAgentic account exists. You can stop using Google sign-in at any time by removing EduAgentic's access on your Google Account permissions page; you can then sign in with a password if one is set for your account. To have the information deleted, delete your account from your account settings or write to dpo@eduagentic.ai; we delete it together with your account as described in the section on keeping data.
11.International transfers
Our servers are in the United Kingdom. Some of our service providers, listed above, process personal data in the United States or other countries. When personal data leaves the United Kingdom or the European Economic Area, we make sure it is protected by an adequacy decision (such as the UK-US data bridge for certified companies), or by the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses, together with the additional measures the provider applies. You can ask us for more information at dpo@eduagentic.ai.
12.How long we keep personal data
We keep personal data only for as long as we need it. Organisations can set shorter or longer periods for some of the categories below in their space.
| Data | How long |
|---|---|
| Account, profile, learning records, work, grades and messages | As long as the account exists. Deleted when the account is deleted, or when the organisation's space is closed. |
| AI conversations and learning notes | 12 months after the last activity in the conversation, or earlier if the learner deletes the notes or the account is deleted. |
| Live class recordings | 12 months, then 30 days in a protected bin, then permanently erased. A teacher can delete a recording sooner. |
| Live class attendance details, chat, polls and reactions | 12 months. |
| Learning activity statements (xAPI) waiting to be filed in our learning record store | 180 days after they are filed; in the learning record store, as long as the account exists. |
| Generated reports | 90 days. |
| Sign-in events | 90 days. |
| Signed-in sessions | Up to 30 days of inactivity and at most 90 days. |
| Download links for data copies you request | 7 days. |
| Consent records | Until withdrawn, then kept as a record of what was agreed while the account exists. |
| Security, audit and safeguarding records | As long as needed for security, accountability and the protection of children. When an account is deleted, these records no longer identify the person. |
| Payment and invoice records | As long as tax and accounting law requires. |
When an account is deleted, we erase or anonymise its personal data across our systems: the databases, files, search index, learning record store and caches. Deleted data may remain for a limited time in our secured backups until they are replaced; we do not use backups to bring deleted data back into use.
13.How we protect personal data
- All connections to EduAgentic are encrypted (TLS), and browsers are told to use only secure connections.
- Sensitive fields, such as e-mail addresses, names, IP addresses in consent and audit records and stored secrets, are encrypted in our database.
- Passwords are held only by our own sign-in service and stored with a strong one-way hash (Argon2). Repeated failed sign-ins lock the account temporarily.
- Each organisation's data is kept in its own separate database schema, and every request is checked against the person's role and permissions.
- Our databases and storage are not reachable from the internet; only our gateway is.
- Changes made by administrators and every consent decision are recorded in audit logs.
No system is completely secure. If a personal data breach occurs that is likely to put people at risk, we will inform the Information Commissioner's Office within 72 hours where required, and the people affected without undue delay.
14.Your rights
Under the UK GDPR and the EU GDPR you have the right to:
- access your personal data and receive a copy;
- rectify inaccurate data;
- erase your data (the “right to be forgotten”);
- restrict how we use it;
- data portability: receive your data in a machine-readable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time where we rely on it;
- not be subject to decisions based solely on automated processing that significantly affect you.
How to use them
In your account settings you can download a copy of your data (a report, or a portable copy in JSON, xAPI or OneRoster format) and delete your account. A parent or guardian can do the same for a linked child, and an organisation's administrators can do it for the people in their space. A child cannot delete their own account; a parent, guardian or the organisation does this.
For any other request, or if you cannot use the settings, write to dpo@eduagentic.ai. We will reply within one month (this can be extended by two further months for complex requests, in which case we will tell you). We may ask you to confirm your identity first.
If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority in the country where you live or work.
16.Changes to this policy
We update this policy when the service or the law changes. The date and version at the top show when it was last updated. If we make a significant change, we will tell you in the service or by e-mail before it takes effect.
17.Contact us
Data Protection Officer: dpo@eduagentic.ai
Support: support@eduagentic.ai
By post: Global Digital Labs Ltd, 45 Lagrannoch Drive, Callander, Perthshire, FK17 8DW, United Kingdom. Company number SC463994, registered in Scotland.