Skip to content
TeachPal
Sign inStart free

Legal

Privacy Policy

This policy explains what TeachPal collects, why, who else handles it, how long it is kept and what you can do about it. It describes what the app does today. When that changes, this page changes with it.

In short

  • TeachPal is a workspace for teachers. Students don’t use it and don’t have accounts. The only details about them are the ones you choose to record.
  • Nothing about a student is sent to an AI model unless you attach that student or their class to a question, and their names are replaced with labels such as “Student A” first.
  • Dates of birth, guardians’ names, contact details and notes you mark sensitive are never sent to an AI model.
  • We don’t sell your data or show ads. Our public pages (the home page, sign-in, sign-up and the legal pages) use Google Analytics to count visits; nothing from inside the app is sent to it.
  • You can download everything you’ve made, or delete your account, from your account settings at any time.

Who we are and what this covers

“TeachPal”, “we” and “us” mean the operator of this TeachPal service. This policy covers the TeachPal website and app, including the connection AI assistants use. Services you reach from TeachPal, such as an AI assistant you connect, have their own policies.

This policy is about two groups of people: you, the teacher with an account, and the students whose details you record. For your own account, we decide how your data is used. For your students’ details, you (or your school) decide what is recorded and why, and we process them on your behalf to provide the service.

What we collect

We hold what you give us and what the service needs to run:

  • Account: your name, your email address, and a hash of your password if you sign up with one. If you sign in with Google, we receive your name, email address and profile picture, and ask Google for nothing else.
  • Teaching profile: your display name, school name, subjects, grade bands, teaching language and preferences.
  • Student records: what you enter for each student, which is a name and, if you choose, a date of birth, a guardian’s name, email and phone, learning notes and a reference number, plus the notes you add over time, your classes and who is in them.
  • Your work: conversations with the assistant, lesson plans, quizzes, notes, reports, library items and their versions, and the files you upload.
  • Billing: your plan, credits and usage, your invoices and payment attempts, and the receipt images you upload.
  • Technical records: the IP address and browser of each sign-in session, security and audit records of important actions, and your browser’s push subscription if you turn on reminders on a device.
  • Product events: a note of what kind of thing happened and when, such as that you created a class, sent a message with two students attached or saved a quiz. Events hold ids, counts and choices, never content: no names, notes, prompts or titles.

How we use it

  • To provide the service: store your work, answer your questions, write resources, find passages in your documents and send the reminders you ask for.
  • To run your plan: count usage against your limits and credits, issue invoices and apply payments.
  • To keep the service safe: scan uploads for viruses, limit repeated attempts, protect sign-in and investigate problems.
  • To improve TeachPal: product events, looked at together, show which features help teachers and where they get stuck.

We don’t sell or rent your data, use it for advertising or pass it to data brokers. We don’t use your content or your students’ details to train AI models.

What the AI sees

TeachPal uses AI models from third-party providers to answer, write and read documents. The service’s administrators choose which provider handles each task. A request carries the conversation it belongs to and what you’ve attached, and where a provider offers the choice, TeachPal asks it not to store the conversation.

  • Students and classes are sent only when you attach them to a question, and only for that question. The context bar shows what will be sent, and you can remove anything before you send.
  • Before a request leaves our server, the names of attached students are replaced with labels such as “Student A”, including in what you type. The real names are put back only on your screen.
  • Date of birth, guardians’ names, contact details, reference numbers and notes you mark sensitive are never included, whatever you attach.
  • As a last safeguard, email addresses and long numbers such as phone or ID numbers are masked in everything sent to a model, including text you paste yourself.
  • A request that carries student details is sent only to a provider our administrators have marked as having zero-retention, no-training terms. If the configured provider isn’t marked that way, the request is refused instead of sent.
  • Text from documents you upload is sent to AI models to index it for search, to read scanned pages and, when it helps answer a question, as quoted context.

One limit to know about: names are replaced only for students attached to the question. If you type the name of a student who isn’t attached, or a name appears in a document you upload, it is sent as written.

AI assistants you connect

If you connect an AI assistant such as ChatGPT, Claude or Gemini, it reads what you allow through that connection, and the platform it runs on handles that data under its own policy.

  • Each connection has its own permissions. Reading your students and classes is off by default, and turning it on asks you to confirm it’s you.
  • Students are shown to an assistant under stable labels instead of names, unless you choose to reveal names for that connection in your account settings.
  • Each connection spends your credits only up to the cap you set, and you can revoke it at any time.

Who else handles your data

We use a small number of service providers to run TeachPal. Each receives only what it needs for its part:

  • AI model providers, such as OpenAI, Anthropic or Google, directly or through a gateway such as OpenRouter, depending on how the service is set up. They receive the requests described above.
  • Brevo, an email service based in France, which delivers the emails TeachPal sends you: confirming your address, resetting your password and telling you when it was changed. It receives your email address, your name and the message.
  • Google, if you choose to sign in with Google, and Google Analytics, which counts visits to our public pages (see Cookies below).
  • Your browser’s push service, if you turn on reminders on a device. A reminder carries a short title and line, never anything about a student.
  • The providers that host our servers, database and file storage.

Some of these providers may process data in other countries. We may also disclose data when the law requires it.

The service’s administrators can see account details, plans, usage, invoices and receipts, so they can run the service and help you. Your students, classes, conversations and library are protected by database rules tied to your account, and the admin tools don’t open them.

Cookies and storage in your browser

TeachPal uses a few cookies, all needed for the app to work or to remember a choice you made, and Google Analytics sets its own on the public pages only. There are no advertising cookies.

  • Sign-in: keeps you signed in, for up to 7 days at a time.
  • Appearance: remembers whether you chose light or dark mode, for a year.
  • Language: remembers the language you last used.
  • Shared link: if you open a shared plan before you have an account, it is remembered for 7 days so you can copy it after you sign up.
  • Visit statistics: on the home, sign-in, sign-up and legal pages, Google Analytics sets its own cookies (named _ga, kept for up to 2 years) to count visits and where they came from. Its advertising features are off, page addresses are sent without their query, and nothing from inside the app (classes, students, conversations or files) is sent to it.

Your browser’s own storage also keeps a couple of interface settings, such as whether the sidebar is collapsed. None of it leaves your device.

How long we keep it

  • Your account and work are kept for as long as your account exists.
  • Students, classes, conversations, library items and files you delete can be restored for 30 days. After that they are deleted for good, together with the text and search index made from them.
  • When you delete your account, everything it owns is deleted at once: your profile, students, classes, conversations, library and every uploaded file. Afterwards the deletion is checked to confirm nothing owned by the account is left.
  • Invoices, payment records and receipts are kept after an account is deleted, without a link to the account, because they are our financial records and the evidence for any refund. Only administrators can see them.
  • Security and audit records, including the record that an account was deleted, are kept without a link to the account.
  • Encrypted backups are kept for 30 days and expire on their own schedule. A single account can’t be removed from a backup, so deleted data can remain in backups until they expire.

Your choices and rights

  • See and correct: everything you enter is visible and editable in the app, and your profile is in your account settings.
  • Take it with you: download a single archive of your profile, students (every field, contact details included), classes, conversations, library, uploaded files and invoices from Account › Your data.
  • Delete: remove single items at any time, or your whole account from Account › Delete account. Deleting the account asks for your password, or a recent sign-in if you use Google.
  • Limit what the AI sees: attach only what a question needs, mark notes sensitive, turn off note suggestions in your preferences, and keep assistants’ access to students off.
  • Ask: for any question or request about your data, contact support. Depending on where you live, data protection law may give you further rights, such as objecting to processing or complaining to a regulator.

Students’ details: your part

TeachPal isn’t meant for children, and students never sign in. You decide what to record about them. Record only what you need for teaching, keep sensitive matters such as health or safeguarding in notes marked sensitive, and follow your school’s rules and the law where you teach, including any permission you need from the school or from parents or guardians.

How we protect it

  • Each teacher’s data is separated by rules in the database itself, so one account can’t read another’s.
  • Passwords are stored as hashes, AI provider keys are encrypted, and sign-in attempts are limited.
  • Deleting your account, or letting an assistant read your students, asks you to confirm it’s you again.
  • Uploads are scanned for viruses before they can be opened, and are served from a separate address from the app.
  • Our logs are set up to leave out passwords, keys, prompts and message content.

No system is perfectly secure. Keep your password to yourself, and sign out on shared computers.

Changes to this policy

When what TeachPal does with data changes, we update this page and the date at the top. If you keep using TeachPal after a change, the updated policy applies.

Questions

If you have a question about this policy or your data, contact TeachPal support.