Privacy Policy

1. Who We Are

DEEPWrite is an educational platform operated by Deep Education Network. We provide adaptive grammar exercises, AI-graded essay writing, and educational tools for UK schools, specifically designed for Key Stage 3 English students (ages 11-14).

Data Controller: Deep Education Network
Website: write.deepeducationnetwork.com
Contact Email: privacy@deepeducationnetwork.com

We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the ICO's Age Appropriate Design Code.

2. What Data We Collect

We collect only the data necessary to provide our educational service. We practice data minimisation and do not collect excessive information.

2.1 Account Data

• Teachers: Name, email address, school affiliation
• Students: First name, surname, email address (optional), school affiliation, class membership

We do NOT collect: physical addresses, phone numbers, date of birth, photographs, or payment card details directly (payments are processed by Stripe).

2.2 Educational Data

• Student written work (essays, grammar exercise responses)
• Mastery scores and progress tracking (Elo-based proficiency scores from 0-100)
• Exercise completion history and performance metrics
• Teacher feedback and grades
• Reading annotations and highlights

2.3 AI Interaction Data

• Student essays submitted for AI grading (with personal information redacted before processing)
• AI-generated feedback and grade suggestions
• Timestamps of AI processing requests

2.4 Usage Data

• Login timestamps and session duration
• Feature usage statistics (which exercises accessed, time spent on tasks)
• Error logs and performance metrics (anonymised)

3. Legal Basis for Processing

We process your data under the following legal bases:

• Contract: To deliver the educational service subscribed to by your school
• Legitimate Interests: To improve our service, fix errors, and ensure platform security
• Consent: For AI processing of student written work (provided by schools on behalf of students through their data processing agreement)

For students under 13, consent is obtained from schools acting in loco parentis. Schools are required to inform parents/guardians about DEEPWrite's use before onboarding students.

4. How We Use Your Data

• Service Delivery: To provide grammar exercises, essay writing tools, progress tracking, and teacher dashboards
• AI Grading: To generate automated feedback on student essays and rewrite exercises using Claude by Anthropic
• Progress Tracking: To calculate mastery scores, identify areas for improvement, and personalise exercise recommendations
• Translation: To provide English as Additional Language (EAL) support via DeepL translation service
• Service Improvement: To analyse aggregated usage patterns (anonymised) and improve educational effectiveness
• Security: To detect and prevent abuse, protect against unauthorised access, and maintain platform integrity
• Communication: To send service-related notifications to teachers (assignment reminders, platform updates)

5. AI Processing Transparency

DEEPWrite uses artificial intelligence (Claude by Anthropic) to provide automated feedback on student essays and to check rewrite exercises. We believe in complete transparency about how AI is used in educational assessment.

5.1 What AI Does

• Analyses student essays against curriculum-aligned rubrics
• Generates feedback on structure, argument quality, grammar, and style
• Suggests a grade based on assessment criteria
• Checks whether rewritten sentences correctly apply grammar rules

5.2 What AI Does NOT Do

• Make final decisions about student grades (teachers always have final authority)
• Access student names, email addresses, or other personal information (essays are anonymised before processing)
• Store or train on student data (Anthropic does not use customer data to train their models)
• Make decisions that significantly affect students without human review

5.3 Teacher Authority (Article 22 GDPR Compliance)

AI grades are recommendations only. Teachers always have the ability to review, modify, or override AI-generated grades. No automated decision-making occurs without meaningful human oversight. This ensures compliance with Article 22 of UK GDPR, which protects individuals from solely automated decision-making.

5.4 Privacy-Preserving AI Processing

Before student essays are sent to Anthropic's API, we automatically redact personal information including names, email addresses, phone numbers, postcodes, and school identifiers. Only the essay text itself is processed. After grading, we re-insert redacted information where necessary for context.

6. Children's Privacy and Age Appropriate Design

DEEPWrite is designed specifically for students aged 11-14. We comply with the ICO's Age Appropriate Design Code and implement the following safeguards:

• Data Minimisation: We collect only data essential for educational purposes
• Default Privacy Settings: Student profiles are private by default; only teachers in their school can view their work
• No Profiling for Marketing: We do not track students for advertising or commercial profiling
• No Data Sharing: Student data is never sold or shared with third parties for marketing
• Parental Transparency: Schools are required to inform parents/guardians about DEEPWrite's use
• Age Verification: Student accounts can only be created by teachers; students cannot self-register
• Content Safety: AI-generated feedback is filtered for age-appropriateness

7. Data Sharing and Third-Party Processors

We work with carefully selected third-party processors to deliver our service. We never sell your data. We share data only when necessary for service delivery, and only with processors who meet our strict data protection standards.

7.1 Third-Party Processors

7.2 We Never Sell Data

We will never sell, rent, or trade your data to third parties for marketing or any other purpose. Your educational data belongs to you and your school, not to us.

8. International Data Transfers

Primary Data Storage: All student data is stored on servers located in the European Union (Germany, via Hetzner) for data residency compliance.

AI Processing: When essays are sent to Anthropic for grading, data is transferred to the United States. These transfers are protected by Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office. Anthropic has implemented appropriate technical and organisational measures to protect your data.

All international transfers comply with Chapter V of UK GDPR and the Data Protection Act 2018.

9. Data Retention

We retain your data only as long as necessary to provide our service and comply with legal obligations.

• Active Subscriptions: Data is retained while your school's subscription is active
• After Subscription Ends: Student data is deleted within 90 days of subscription cancellation
• Data Export: Schools can export all student data within 30 days of cancellation
• Anonymised Analytics: Aggregated, anonymised usage statistics may be retained indefinitely for service improvement
• Legal Obligations: We may retain data longer if required by law (e.g., financial records for tax purposes)

10. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data held by us
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal obligations)
• Right to Data Portability: Receive your data in a structured, commonly used format (CSV/JSON export)
• Right to Object: Object to processing based on legitimate interests
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Withdraw Consent: Withdraw consent for AI processing (schools can opt students out of AI grading)
• Right to Lodge a Complaint: File a complaint with the Information Commissioner's Office (ICO)

To exercise any of these rights, contact us at privacy@deepeducationnetwork.com. We will respond within 30 days.

11. Security Measures

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Row-level security policies ensure students see only their own data and teachers see only their school's data
• Authentication: Secure password hashing (bcrypt) and optional two-factor authentication for teachers
• Regular Audits: Security reviews and penetration testing
• Incident Response: Data breach notification procedures compliant with UK GDPR (within 72 hours)

12. Cookies and Tracking

DEEPWrite uses minimal cookies, and we do not use tracking cookies or advertising cookies.

12.1 Essential Cookies

• Session Cookie: Maintains your login session (deleted when you log out)
• Authentication Token: Securely stores your login credentials

12.2 What We Do NOT Use

• No Google Analytics or third-party analytics cookies
• No advertising cookies or remarketing pixels
• No social media tracking
• No cross-site tracking

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will notify schools via email and display a notice on our platform.

The "Last Updated" date at the top of this page indicates when the policy was last revised. Continued use of DEEPWrite after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

Email: privacy@deepeducationnetwork.com
Website: write.deepeducationnetwork.com

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.