Privacy Policy
Effective date: 28 September 2026
This Privacy Policy describes how Scholarova Ltd (“Scholarova”, “we”, “us”, “our”) processes personal data when you use Scholarova, available at www.scholarova.com (the “Service”).
Who is the data controller? It depends how you use Scholarova:
- Organisation-linked use (for example through a school, academy trust, tuition centre, or college): the organisation is the data controller for learner, staff, and parent personal data it submits for that use. Scholarova is the processor under the data processing agreement (DPA).
- Parent, family, or solo learner use not linked to an organisation: Scholarova Ltd is the data controller. The organisation DPA does not apply.
Where Scholarova processes account, billing, or security data for our own operational purposes, we act as an independent controller as described in this policy.
Scholarova Ltd is registered with the Information Commissioner's Office (ICO) under registration number ZC133337.
Questions: Admin@scholarova.com
1. What we provide
Scholarova is an educational platform that supports teachers, students, parents, and school staff in delivering and tracking learning activities, assignments, courses, and related features (including optional integrations such as Google Classroom).
2. Personal data we collect
2.0 Personal data inventory
The table below is the single list of personal data categories we process. Other legal pages point here rather than maintaining separate inventories. Detail for each area is in the subsections that follow (and in section 9 for children-specific points).
| Category | Examples we may hold | When / notes |
|---|---|---|
| Account | Name, email address, account role(s) | While you have an account; see section 2.1. Passwords are stored hashed only. We do not collect phone numbers, postcodes, or similar identifiers as account fields (section 2.6). |
| Organisation and class membership | School or organisation affiliation, class and course enrolments, invites, and related membership metadata | When you join or are added to classes and organisations; see sections 2.1 and 2.3. |
| Age band and under-13 status | Whether you declared over or under 13 at signup, and whether under-13 access is blocked pending approval | From the age gate and account state; see section 9 (Under-13 access). |
| Profile image URL | Profile image URL for accounts that may show a photo | If you sign in with Google or use a permitted role with a photo. We do not display Google profile photos for student accounts and remove stored Google image URLs for student-only accounts; students see initials instead (section 9). |
| Learning attempts and results | Activity attempts, answers or submissions, scores, teacher feedback, and AI-generated feedback where enabled | When you complete learning activities and assignments; see sections 2.3 and 2.6. |
| Assessment integrity signals | Focus/tab-leave counts and time away, paste detection and counts, time per question, suspicious-speed flags, and (in lockdown exam mode) fullscreen-exit events | Exam mode only, off by default; ordinary Learn does not collect these. Full list in section 2.3. |
| Parent–child link | Parent account identifier linked to a child account, link status, and (for under-13 signup) parent email pending invite | Only when the organisation enables parent–child linking — it is not automatic for all organisation students. Also used when an under-13 user or parent completes the parent-link flow where that feature is available (section 9). |
| Billing | Billing contact email, subscription tier, and Stripe customer or subscription identifiers | For paid individual, school, or organisation accounts. Card and payment-method details are processed by Stripe; we do not store full card numbers on Scholarova servers. |
We also process authentication, security, and integration data described in sections 2.2, 2.4, and 2.5.
2.1 Account and profile
We process data you give us or that we obtain when you use the Service, including where applicable:
- Name, email address, and profile image (e.g. if you sign in with Google)
- Password data (hashed) if you register with email and password
- Role and onboarding information (e.g. student, teacher, parent, school administrator)
- School or organisation affiliation you provide
2.2 Authentication and security
We process sign-in data, session tokens, security logs, IP address, device/browser details, and similar technical information to operate authentication, prevent abuse, and maintain security.
2.3 Educational and usage data
Depending on your use of the Service, we may process:
- Class and course structure, memberships, invites, and enrolment data
- Learning activities, assignments, submissions, scores, feedback, and related metadata
- Assessment integrity metadata (exam mode only). This is off by default. It is collected only when a teacher or organisation enables exam mode on an assignment. Ordinary course and practice activity in Learn does not collect these signals. When exam mode is on, we may process for that assignment session:
- Focus or tab-leave events: a count of times the learner leaves the exam window and the total time away (blur/focus)
- Paste events: whether paste was detected and how many times; our event log may record the length of pasted text only — we do not store clipboard contents
- Time taken per question, and a suspicious-speed flag when an answer is submitted in under about three seconds
- Lockdown exam mode only: fullscreen-exit events when the learner leaves fullscreen. The client may also block the context menu and some developer-tool keyboard shortcuts as in-session UI controls; we do not store separate counters for those beyond fullscreen-exit events
- Appeals or review requests relating to marking, and related messages
2.4 Google Sign-In
If you choose Google Sign-In, Google shares certain account details with us in line with your Google account settings and Google’s policies. We use this to create and secure your account.
2.5 Google Classroom (optional, teacher-initiated)
If a teacher connects Google Classroom, we request additional Google permissions to:
- List courses the teacher instructs (read-only) so they can link the correct Google Classroom course to a class in Scholarova
- Create coursework in Google Classroom (for example to publish an assignment that links to work in Scholarova)
- Create classwork materials so a teacher can post the Scholarova class join link into a linked Google Classroom course
- Read rosters and student submissions as needed to match students and to sync grades from Scholarova into Google Classroom coursework
We may store:
- OAuth access and refresh tokens in our database (to maintain the integration)
- Google Classroom course identifiers linked to classes you connect
- Google user identifiers where needed for enrolment matching or pending enrolment until a student signs in
We use this data only to provide the Classroom integration the teacher activates and to run Scholarova. We do not sell Google user data or use it for advertising.
Scholarova's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
2.6 AI-assisted features
Where your school enables them, features such as AI Coach, automated marking assistance, and in-lesson AI tools send relevant prompts, activity context, and student or teacher text to our AI infrastructure only via Vercel AI Gateway. Scholarova does not call foundation-model vendors directly for those features when using Gateway credentials.
We configure Gateway with zero data retention (ZDR) and policies that do not use your prompts or model outputs to train machine-learning or foundation models. Application logic runs on Serverless Functions in the United Kingdom; AI inference is processed in the EU inference zone (not UK-only — our Gateway provider has no UK inference region).
If we change which onward sub-processors or routing apply to an AI activity, we update /subprocessors and notify organisations as described in section 10.
Scholarova does not collect telephone numbers, postcodes, or similar contact or government identifiers as dedicated account profile fields. Those are not separate categories of personal data we hold about your account.
Before free-text answers or other content are sent for AI-assisted marking or inference, we apply best-effort redaction of obvious direct identifiers if they appear in that text (for example email addresses, and patterns that resemble phone numbers or postcodes). This is not full anonymisation — names or other personal content typed into answers may still be included. AI outputs can be incorrect or incomplete; teachers remain responsible for instructional decisions.
Automated marking and human review (UK GDPR Article 22)
Where AI-assisted marking or feedback is enabled, the Service may return suggested marks and feedback to students immediately to support learning. Teachers can review, amend, or override those suggestions before they are treated as final. Students can raise appeals or request human review through the product's marking appeal workflows where available. Scholarova does not use AI alone to make decisions with legal or similarly significant effects on learners. Where an organisation uses scores for official assessment, the teacher (or other authorised staff member at the organisation) remains responsible for the final mark recorded.
The live list of sub-processors (including Vercel for hosting and AI Gateway) and onward sub-processors used for AI inference via Gateway is maintained at /subprocessors — we do not duplicate those lists here. The onward sub-processors table on that page is grouped by type of AI activity.
Parent–child linking. For pupils who sign up through or belong to an organisation (for example a multi-academy trust), parent or guardian linking and invitations are off by default. An organisation administrator must explicitly enable parent–child linking in organisation settings before parents can link to those pupils. Individual learners who are not affiliated with an organisation keep the usual parent-link options unless this conflicts with another control at their school.
3. How and why we use personal data (lawful bases)
Under UK GDPR we rely on one or more of: performance of a contract (providing Scholarova to you); legitimate interests (securing the Service, improving reliability, support, limited analytics); legal obligation; or, where required, consent (for example for optional non-essential cookies or communications, if we offer them and ask consent).
Where we process special category or children’s data in an education context, we do so in accordance with applicable UK law, including where processing is necessary for educational purposes or with appropriate authority.
4. Sharing and processors
We share personal data with service providers that help us run Scholarova (hosting, database, payments, authentication and related Google services — including Sign-In, optional Classroom, and transactional email — and, where enabled, AI inference through Vercel AI Gateway). The named sub-processors and onward sub-processors for AI inference (grouped by activity) are listed only at /subprocessors. We do not sell personal data.
We require processors to protect personal data under contract. The current sub-processor list (names, purposes, and locations) is published only at /subprocessors. Where an organisation (for example a school, academy trust, tuition centre, or college) is the controller, the data processing agreement and section 17 of the Terms apply — not to personal accounts outside that relationship.
5. International transfers
Our servers or subprocessors may be located outside the UK. Where personal data is transferred from the UK, we implement appropriate safeguards (such as the UK international data transfer agreement / addendum, standard contractual clauses, or adequacy regulations) as required by UK GDPR.
6. Retention
This section is the authoritative retention schedule for Scholarova. Where another document refers to how long we keep data, it points here unless the law requires a longer period.
6.1 Active organisation use
While your school, academy trust, tuition centre, college, or other organisation has an active relationship with Scholarova, we keep personal data for as long as needed to provide the Service, operate classes and courses, support users, and meet our contractual and legal obligations.
6.2 End of contract or written deletion request
When an organisation's contract ends or we receive a written request to delete organisation data (from an authorised organisation contact), we delete or anonymise that organisation's personal data within 90 days, except records we must keep for law, tax, accounting, or security (see section 6.4). Our data processing agreement reflects this end-of-service commitment for organisation data.
6.3 Leavers (member removed by an organisation admin)
When an organisation administrator removes a member from a school or organisation in the product, we schedule deletion or anonymisation of that person's organisation-linked data (for example class enrolments, school-scoped AI Coach threads, and assignment work tied to that school's classes) within 30 days of removal. The member's Scholarova account may continue if they use the Service elsewhere (for example a personal or family account).
6.4 Security and authentication logs
We retain security, authentication, and similar operational logs for 90 days to investigate abuse, protect accounts, and maintain the Service, unless a longer period is required by law or to establish, exercise, or defend legal claims.
6.5 Backups
Backup copies held by us or our infrastructure providers are designed to roll off within 90 days after the corresponding primary data has been deleted, though restoration windows may briefly retain redundant copies during that period.
6.6 Cease trading
If Scholarova Ltd ceases trading, we will notify affected organisations, offer a reasonable opportunity to export organisation data where feasible, and delete or anonymise organisation personal data within 90 days thereafter, subject to legal requirements.
6.7 Individual accounts and your rights
For personal accounts not linked to an organisation, we retain data while your account is active and as needed to provide the Service. You may ask us to delete your account subject to statutory exceptions. Contact Admin@scholarova.com.
7. Security
We implement technical and organisational measures appropriate to the risk. A plain-language summary of hosting, encryption, AI routing, and related controls is at /security. No system is completely secure; please use a strong password and protect your devices.
8. Your rights
Under UK data protection law you may have rights to access, rectify, erase, restrict, or object to certain processing, and to data portability where applicable. You may also withdraw consent where we rely on it.
To exercise rights, contact Admin@scholarova.com. You may complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.
Subject access / data export. Signed-in users can download their own data from Account (“Download my data”). Organisation or school admins can export a JSON zip for a single named user or the whole organisation from Admin → Organisations (organisation data export). These self-serve downloads cover common access requests; contact us for anything they do not include.
9. Children and schools
Where Scholarova is used in schools, the school or local authority may also determine how certain personal data is processed. If you are concerned about a young person's account, contact us and the relevant school where appropriate.
Children (UK Age Appropriate Design Code)
Scholarova is built for education and we aim to act in children's best interests when they use the Service through a school or other organisation, or after a parent or school has approved access for under-13 users.
- Under-13 access. Users who tell us they are under 13 cannot browse or use the Service on their own until their school or organisation approves their join request, or a linked parent or guardian completes the parent–child link (where the organisation has enabled parent–child linking — see section 2.6). This matches the age gate at signup.
- AI features. AI Coach and similar AI-assisted features are off unless the organisation enables them in product settings (see section 2.6).
- Marketing. We do not send marketing or promotional emails to student accounts. Service or product updates may be sent to organisation contacts (for example school billing or admin emails) and to adults who have opted in to non-essential communications where we offer that choice.
- Privacy defaults. We use high privacy defaults for children's use of the platform. We do not use behavioural advertising or marketing profiling of children on Scholarova.
- Profile photos. A profile photo is not required to use Scholarova. We do not store or display Google profile photos for student accounts; students see initials placeholders instead. Staff and parent accounts may still use a Google photo if they sign in with Google.
- Assessment integrity. For children, integrity metadata is off by default and is collected only when a teacher or organisation enables exam mode on an assignment. Ordinary Learn activity does not collect these signals. When exam mode is on, we process the same signals described in section 2.3: focus or tab-leave count and total time away; paste detection and count (event log may store pasted text length only, not clipboard contents); time per question and suspicious-speed flags under about three seconds; and, in lockdown exam mode, fullscreen-exit events (plus in-session UI restrictions such as blocking the context menu or some developer-tool shortcuts — not stored as counters beyond fullscreen exit). We do not use webcam, screen recording, microphone, keylogging, face detection, or full clipboard capture. We do not use this data for marketing or profiling.
10. Changes
We may update this policy from time to time. Where we make material changes to how we collect or process personal data — or make changes to third-party sub-processors, onward sub-processors used for AI inference, or other AI routing — we will notify users or organisation administrators in advance by email or through an in-app notice prior to the changes taking effect.