Back to Home

Privacy Notice

Last Updated: 13th July 2026

Introduction

PeddyLoop ("we," "our," or "us") is committed to protecting your privacy. This Privacy Notice explains how we collect, use, disclose, and safeguard your information when you use our AI-powered educational platform. We handle personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Information We Collect

Personal Information

  • Account Information: Name, email address, password (encrypted), and user type (student/teacher/parent)
  • Date of Birth: Collected from students at registration so we can apply the right protections for younger users
  • Parent/Guardian Email: Collected when a student is under 13, so we can obtain parental consent (see Children's Privacy below)
  • Google Sign-In: If you register or sign in with Google, we receive your name and email address from your Google account. We never receive or store your Google password
  • Profile Information: Year group, exam board, qualification level, school name
  • Connection Codes: Unique codes for connecting teachers, parents, and students

Educational Data

  • Learning Sessions: Questions attempted, answers submitted, time spent, accuracy scores
  • Progress Records: Mastery levels, skill assessments, topic completion rates
  • Homework Assignments: Assigned work, completion status, grades
  • Submissions: Uploaded images of handwritten work, typed answers
  • Mock Exams: Papers attempted, uploaded answers, marks, and grade estimates
  • Teacher Uploads: Worksheets and materials uploaded by teachers to create homework and mark schemes

Collaboration Data

  • Whiteboard Sessions: Drawings and annotations made on shared whiteboards
  • Session Chat: Messages sent in whiteboard session chat
  • Peddy Conversations: Questions you ask Peddy and the answers generated from your learning data

Technical Information

  • Device Information: Browser type, operating system, device identifiers
  • Usage Data: Pages visited, features used, interaction patterns
  • Cookies: Session tokens, preference settings

AI Processing Data

  • Question Responses: Your answers are processed by AI to provide feedback
  • Image OCR: Handwritten work is processed to extract text
  • Exam Marking: Uploaded mock exam answers are processed by AI and marked against official mark schemes
  • Mark Scheme Generation: Worksheets uploaded by teachers are processed by AI to generate mark schemes
  • Peddy: Your questions to Peddy are answered by AI using your own learning records. Peddy can only access data your account is already permitted to see — this is enforced on our servers
  • Performance Analytics: AI analyzes your progress to recommend content

How We Use Your Information

Educational Purposes

  • Provide personalized learning experiences and AI tutoring
  • Track progress and generate mastery assessments
  • Assign and grade homework automatically
  • Mark mock exams and estimate grades
  • Generate performance reports for students, teachers, and parents
  • Answer your questions about your own learning data through Peddy

Platform Operations

  • Authenticate users and maintain secure sessions (including via Google Sign-In)
  • Enable connections between students, teachers, and parents
  • Enable real-time collaboration on shared whiteboards
  • Send notifications about homework, connections, and achievements
  • Process payments, subscriptions, one-off purchases, and enterprise licences

Improvement and Analytics

  • Analyze platform usage to improve features
  • Generate aggregate statistics (never personally identifiable)
  • Conduct research on educational effectiveness

Data Sharing and Disclosure

With Connected Users

  • Teachers and parents can view student progress when connected
  • Class members' names and progress may be visible to assigned teachers
  • Participants in a shared whiteboard session can see the whiteboard content and chat messages in that session

Service Providers

  • Anthropic AI: Question evaluation, feedback generation, exam marking, and Peddy responses
  • Google Cloud Vision / TrOCR: Handwriting recognition on images of written work you upload (TrOCR runs on our own servers; Google Cloud Vision is used where configured)
  • Google: Sign-in authentication, where you choose Google Sign-In
  • Stripe: Subscription and payment handling; we do not store your full card details
  • Amazon Web Services (S3): File storage for teacher-uploaded homework materials; student submissions are processed transiently and are not stored as files
  • SendGrid: Transactional email delivery (verification codes, receipts, notifications)
  • Fly.io: Application hosting infrastructure
  • Meta: Optional analytics (see Cookies and Tracking) — only if you accept analytics cookies; never used for students' learning data

Legal Requirements

We may disclose information if required by law, court order, or to protect rights and safety.

We Never

  • Sell your personal information to third parties
  • Share student data with advertisers
  • Use student work for commercial purposes without consent

Data Security

Security Measures

  • Encryption: All data transmitted over HTTPS/TLS
  • Password Security: Bcrypt hashing with salt
  • Database Security: PostgreSQL with strict application-level access controls
  • Access Controls: Role-based permissions and authentication
  • Managed Infrastructure: Data is stored with managed cloud infrastructure providers

Data Retention and Deletion

  • Active Accounts: Data retained while account is active
  • Live Session Chat: Chat messages from live collaboration sessions are kept for up to 12 months for safeguarding purposes (so concerns about conduct in sessions between adults and children can be investigated), then automatically deleted. Whiteboard drawings are not retained
  • Account Deletion: You can delete your account at any time from account settings. Your account is deactivated immediately and marked for permanent deletion; your data is then permanently removed from our systems (for paid subscriptions, after the current billing period has ended)
  • Deletion Requests: You can also request deletion by contacting info@peddyloop.com, and we will respond within one month as required by UK GDPR

Your Rights

Under UK GDPR you have the right to access, rectify, erase, restrict, and object to the processing of your personal data, and the right to data portability.

Access and Control

  • View Your Data: Access your personal information and learning records
  • Update Information: Correct or update your profile details
  • Copy of Your Data: Request a copy of your personal data and learning records by contacting us
  • Delete Account: Delete your account and data from account settings, or by contacting us

Communication Preferences

  • Opt-out: Unsubscribe from marketing emails anytime
  • Notifications: Control notification preferences in settings

Parental Rights

Parents can access and update their connected children's data, and can request deletion of their children's accounts and data at any time.

Complaints

If you have concerns about how we handle your data, please contact us first at info@peddyloop.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk.

Children's Privacy

Age Requirements

  • We collect every student's date of birth at registration
  • Students under 13 may only use PeddyLoop once a parent or guardian has given consent (see below)
  • Students 13-18 may create their own accounts

Parental Consent

  • When a student under 13 registers, we collect a parent or guardian's email address and email them a consent link. The account stays locked until the parent or guardian confirms
  • The consent email explains what data we process (including AI processing by Anthropic) and links to this notice
  • If we become aware that we hold personal data of a child under 13 without parental consent, we will delete it
  • Parents can withdraw consent and request deletion of their child's account and data at any time by contacting info@peddyloop.com

UK Data Protection

We process children's personal data in line with UK GDPR and the Data Protection Act 2018.

Cookies and Tracking

Essential Cookies

  • Authentication: Session tokens to keep you logged in
  • Security: CSRF protection tokens
  • Preferences: UI settings and language preferences

Analytics Cookies (optional — off by default)

  • Meta Pixel: Helps us understand how visitors find PeddyLoop and whether our advertising works
  • We only set analytics cookies if you explicitly accept them in the cookie banner; declining (or ignoring the banner) means they are never set
  • You can change your mind at any time by clearing the site's data in your browser, which brings the banner back

Managing Cookies

You can control cookies through your browser settings, but some essential features (like staying signed in) may not work without them.

International Data Transfers

Data may be processed in countries where our service providers operate. Where personal data is transferred outside the UK, we ensure adequate protection through:

  • UK adequacy regulations, where applicable
  • The UK International Data Transfer Agreement (IDTA) or Addendum
  • Standard Contractual Clauses (SCCs) with equivalent safeguards

Updates to This Notice

We may update this Privacy Notice periodically. Changes will be posted on this page with an updated "Last Updated" date. Significant changes will be communicated via email.

Contact Us

The data controller is PeddyLoop Technologies Ltd (company registration in progress; company number and registered office to be added on incorporation).

For privacy-related questions or to exercise your rights:

Email: info@peddyloop.com Website: https://peddyloop.com/contact

By using PeddyLoop, you acknowledge that you have read and understood this Privacy Notice.