For schools
Safeguarding and data protection
Clevzo is used by children through their school, so we collect as little as we can and never track or advertise to them. Here is what your school's data protection lead will want to know.
Minimal data
A pupil's name, class, year group, username and their answers. Pupils never need an email address.
No tracking, no adverts
No analytics or advertising cookies, no adverts, and nothing is sold. Only the cookies needed to stay logged in.
Stored in the UK
Our database and login system store information in London.
Clean exits
A pupil you remove loses access at once and their account is deleted 30 days later.
Minimal data
What we hold, and who decides
Your school decides to use Clevzo and who uses it, so the school is the controller. JARY LTD provides Clevzo and handles the information on the school's instructions, as its processor, under a written agreement with the school. We are registered with the ICO under number C2060727.
- Pupils: first name and surname, class and year group (from your class list), a username they choose and a password stored as a one-way hash. Their answers, marks, time taken and finished topics, so they and their teachers can see progress.
- Parents: an email address from the class list, used only for the invite and password resets.
- Teachers: name, school email, a hashed password, and the classes, homework and questions they create.
Pupils only see their own work, and teachers only see their own school. Group Challenge, if your lead teacher switches it on, only works between pupils of the same school.
Children's privacy
No tracking, no adverts, no profiling
We follow the UK Age Appropriate Design Code: high-privacy settings by default, no profiling, no nudging and no adverts. We use no analytics or advertising cookies, only those needed to keep someone logged in, so there is no cookie banner. We do not sell information or share it for advertising, and pupils' answers are not used to build advertising profiles.
Hosting
Where data is stored, and who handles it
Our database and login system store information in London, in the UK. A small number of trusted services, our sub-processors, help run Clevzo on our instructions and only get what they need:
| Service | Where | What it does |
|---|---|---|
| Supabase | London, UK | Our database and login system. Its support staff, including its US company, can reach it only when needed to support or run the service. |
| Vercel | United States | Hosts the website. |
| Anthropic | United States | Marks written answers and powers the tutor. It receives the question and the answer or message text, never a pupil's name, username or email, and does not use it to train its models. |
| Resend | United States | Sends invites and password resets. |
Where information is handled outside the UK, it is protected by the UK-US data bridge or the standard contract clauses with the UK Addendum in each service's data processing agreement.
Information is encrypted in transit, passwords are stored as one-way hashes, and access to the database is restricted. If a data breach is likely to put anyone at risk, we tell the school straight away so it can meet its duties.
Retention
How long we keep it, and deleting it
- A pupil leaves: when the school removes them, their access ends at once and their account is deleted 30 days later.
- The licence ends: accounts and results are kept for 90 days so the school can renew, then deleted.
- Sooner: a school can ask us to delete its information sooner.
Pupils, parents and staff have their rights under the UK GDPR. Because the school is the controller, requests go to the school, and we help it answer within one month.
Marking
How marking works, and “Question this mark”
Answers with one right answer, such as a number or a choice, are checked against the answer. Written answers are marked against the question's mark points, and the result shows which points were met and why.
A pupil can press “Question this mark” on any mark they think is wrong, and teachers can change any mark in the results. Marks and feedback are for practice and homework only: they never make decisions with a legal or similarly significant effect on a pupil. The privacy notice explains in full how written answers are marked.
Paperwork
Data processing agreement and DPIA
Our data processing agreement and information to help with your data protection impact assessment (DPIA) are available on request. Email hello@prepacer.com and we'll send them to your school.