Who is responsible for what
Data protection law gives different duties to the organisation that decides how personal data is used (the controller) and an organisation that handles it on the controller's behalf (a processor).
| Who | Role | What that means |
|---|---|---|
| Your institution | Controller | Decides who has an account, what is used and kept, and answers requests from students, parents and staff. Gives any notices and gets any consents the law requires. |
| Ashanti Labs | Processor, only when we set up or support your box | Acts only on your written instructions, keeps what we see confidential, and does not open student conversations, work or safety alerts. |
| Ashanti Labs | Controller, for our own business data | Website, enquiries, orders and invoices, as set out in our Privacy Policy. |
Because the box runs on your network and does not send student data to us, there are no sub-processors for student data.
What the box stores, and the tools you get
| Data | Where | Default |
|---|---|---|
| Accounts: display name, username, role, class | Your box | Until the person is removed |
| Conversations with the AI tutor | Your box | Deleted after 90 days. Admins can set 7 to 365 days. |
| Lessons, assignments, submissions, projects, progress | Your box | Until removed by staff or admin |
| Safety alerts | Your box, visible only to designated safety contacts | Per your school's policy |
| Admin actions (audit log) | Your box | Kept for accountability |
In the admin area you can export one person's data (for an access or portability request), export your people list, delete a person, set how long tutor conversations are kept, back up the box, and read the audit log. Everyone signs in with their own account, and each role (student, teacher, safety contact, admin) sees only what it needs. Checks are enforced on the box itself, not just hidden in the screens.
We do not use your data for advertising and we do not train AI models on it. The AI models run on the box.
The laws we design for
These are the main laws schools raise with us. This is a plain summary, not legal advice; please check with your own adviser.
| Country | Law and regulator | Points that matter for schools |
|---|---|---|
| EU and UK | General Data Protection Regulation (GDPR) and UK GDPR. | Applies to institutions in Europe or offering services to people there. Requires a written processor agreement (Article 28), privacy notices and breach reporting within 72 hours. The UK Children's Code also applies to online services likely to be used by children. |
| United States | FERPA and COPPA. | For US schools, we act under the school's direct control as a "school official", and the school can authorise collection for educational use under COPPA. |
What your institution should do
- Register with your data protection authority if the law requires it (for example, UK schools pay the data protection fee to the Information Commissioner's Office).
- Tell people: add Ashanti Labs to the privacy notice you give students, parents and staff. We can give you wording.
- Get consent where needed: for children, collect any parent or guardian consent your law and policies require.
- Name safety contacts who will act on safety alerts.
- Set retention: confirm how long tutor conversations are kept, in the admin settings.
- Keep the box secure: a locked, ventilated place; strong admin passwords; regular backups kept safely.
- Remove leavers and handle requests using the export and delete tools.
Agreements we will sign
On request we provide, for your records or your data protection officer:
- a data processing agreement covering our setup and support access, in line with the GDPR (Article 28), the UK GDPR and similar laws;
- a one-page data inventory and data flow for the box;
- wording for your privacy notice to students, parents and staff;
- written confirmation of data return and deletion if a box is returned to us for repair or at the end of its use.
Ask at [email protected].
If something goes wrong
If we become aware of a security incident affecting personal data on your box or in our systems, we will tell your institution without undue delay, with what we know, what we are doing about it, and what you may need to do. That lets you meet your own deadlines (72 hours to the regulator under the GDPR and UK GDPR).
If you suspect a problem, contact [email protected] straight away.