Data protection, from the first paper

Schools trust us with pupils' answers. Here is how that data is handled. The full detail is in our privacy policy.

Where data is kept

• School data is stored in the EU (Ireland).
• The application runs in the EU (Railway, Amsterdam).

Who does what

• The school is the data controller, and Piarrel is the data processor.
• A data processing agreement is signed before any live pupil data is processed.

AI and pupils' work

• Answers are marked through OpenAI's API without pupils' names, and are not used to train AI models.
• OpenAI may keep API inputs and outputs for up to 30 days, only for abuse monitoring.
• A teacher approves every mark before a pupil sees it.

Sub-processors

Sub-processors are listed in the privacy policy with their purpose and location.

• OpenAI: AI marking; USA, under Standard Contractual Clauses.
• Supabase: database and files; EU (Ireland).
• Railway: application hosting; EU (Amsterdam).
• Resend: email delivery; USA, under SCCs.
• Replit: development and operations; USA, under SCCs.

Deleting data

• Deleting an assessment that holds pupils' answers archives it, so that reporting and audit records are kept.
• Permanent erasure is done on written request to privacy@piarrel.com, within 14 days, confirmed in writing.

For your DPO

A data processing agreement and a security overview are available on request.