Privacy Policy

Last updated: 26 September 2026 (version 2026-09-26)

1. Introduction and who is responsible

Thinking Paper is an AI-supported writing and learning platform at thinkingpaper.app (the "Service"), provided by Kompass Education ("we", "us", "our"). This policy explains what personal data the Service uses, why, where it is kept and what your rights are.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who is responsible for your data depends on how you use the Service:

  • Through a school: your school is the data controller. It decides how pupil and staff data is used. Kompass Education is the school's data processor. We act only on the school's instructions, under a Data Processing Agreement with the school. The school's own privacy notice also applies.
  • Directly, without a school: Kompass Education is the data controller.
  • Running the Service: for billing contacts, security logs and service operation, Kompass Education is the data controller.

Kompass Education
Contact: darren@kompass.education

2. Where your data is kept

Your data is stored in the United Kingdom. The application is hosted in London, and the database and file storage are in London.

AI features are processed in the European Economic Area. They use OpenAI's EU regional service only, never its global service, and there is no fallback to any other provider. Our OpenAI project is set up for EU data residency and Zero Data Retention. Requests are sent with storage switched off, and your content is never used to train AI models.

If AI is unavailable or switched off, writing and saving still work.

3. Information we collect

3.1 Staff and individual accounts

  • Email address and name
  • Avatar image (optional)
  • Password (stored only as a secure hash)
  • Role and school or class membership

If you sign in with Google, Microsoft or GitHub, we receive your email address, name and account identifier from that provider.

3.2 Pupils

Pupils join a class with a class code, their name, and a personal PIN issued by their teacher. We do not collect pupils' email addresses. The PIN is stored only as a secure hash.

3.3 Work you create

  • Documents, drafts and earlier versions
  • Folders, projects, assignments and submissions
  • Uploaded files, and photographs of handwritten work
  • Voice recordings, when you use voice input (converted to text)
  • Defence Mode responses and Cognitive Provenance certificates

3.4 Teacher feedback

Comments, marks, saved comments and review status on pupils' work.

3.5 AI interactions

  • Your questions and the AI's responses
  • Usage counts (for managing the Service)
  • Safety classifications (to keep use appropriate)
  • Times and context

3.6 Safeguarding

AI interactions are checked automatically for signs of harm. If a concern is raised, the school's Designated Safeguarding Lead is alerted. We keep records of flags, concerns, reviews and outcomes. Pupils' writing or safeguarding records may sometimes contain sensitive information, for example about health. The school decides how that is handled.

3.7 Technical data

  • IP address, browser and device information
  • Pages visited, features used, and writing activity
  • Audit logs of significant actions
  • Error reports (with personal data removed where practical)

4. How we use your information

4.1 Providing the Service

  • Writing, saving, organising and submitting work
  • Letting teachers set, review, comment on and return work
  • AI feedback, prompts and tutoring, and reading uploaded or handwritten work
  • Generating Cognitive Provenance certificates

AI output is advisory. No decision with legal or similarly significant effects is made about anyone by automated means alone.

4.2 Safety and safeguarding

  • Checking AI interactions for harmful content
  • Supporting Designated Safeguarding Leads
  • Keeping audit trails for accountability

4.3 Running and improving the Service

  • Fixing errors and keeping the Service reliable and secure
  • Understanding how features are used, so we can improve them

4.4 Communication

  • Essential service emails, such as password resets and notifications
  • Responding to enquiries and providing support

We never sell personal data, use it for advertising, or use it to train AI models.

5. Legal basis for processing

Through a school: the school decides the legal basis. This is usually its public task, or its legitimate interests for independent schools. For safeguarding records, the school relies on the safeguarding conditions in the Data Protection Act 2018.

Where Kompass Education is the controller:

  • Contract: to provide the Service you signed up for
  • Legitimate interests: security, fraud prevention, fixing errors and improving the Service, where your rights do not override these interests
  • Legal obligation: for example tax and accounting records
  • Consent: for anything optional, such as marketing, which you can withdraw at any time

6. Who we share data with

We use a small number of service providers who process data for us under written contracts:

  • Vercel: application hosting (London)
  • Supabase: database, sign-in and file storage (London)
  • OpenAI: AI features, through its EU service only (European Economic Area)
  • Sentry: error monitoring (EU)
  • Upstash: protection against request flooding
  • Amazon Web Services: sending service emails (UK/EU)

Schools receive advance notice before we add or replace a provider that handles school data.

6.1 Within your school

If you use Thinking Paper through a school, authorised staff may see:

  • Your account and class details
  • Work you submit or share, and progress information
  • Safety flags and concerns (Designated Safeguarding Leads only)

7. How long we keep data

Schools can adjust some of these periods for their own data:

  • Accounts and work: until the account is deleted, the school removes it, or the school's use of the Service ends
  • Inactive pupil accounts: deleted automatically after a period the school chooses, if the school turns this on
  • AI interaction logs (not flagged): 90 days
  • AI interaction logs (flagged for review): 1 year
  • Safeguarding records (escalated): 3 years, or longer where the school's safeguarding policy requires it
  • Audit logs: up to 2 years

Data is deleted automatically when these periods end. When a school stops using the Service, it can export its data. We then delete it from live systems within 30 days, and it leaves our backups as they expire.

8. Your rights

Under UK GDPR you have the right to:

  • Access: get a copy of your personal data
  • Rectification: have inaccurate data corrected
  • Erasure: have your data deleted, subject to legal and safeguarding retention requirements
  • Portability: receive your data in a structured, machine-readable format
  • Restriction: limit how your data is used in certain circumstances
  • Objection: object to processing based on legitimate interests
  • Human review: AI provides suggestions only; no significant decision about you is made by automated means alone

Staff can download a copy of their data or delete their account from Settings. Pupils can download their writing from their class page. A school administrator can export or delete a pupil's data.

If you use Thinking Paper through a school, please contact your school first, because it is responsible for your data. If you contact us instead, we will pass your request to the school promptly.

Otherwise, contact us at darren@kompass.education. We will respond within one month.

9. Children's privacy

Thinking Paper is used by children in schools, and we take extra care with their data:

  • No pupil email addresses: pupils join with a class code, their name and a personal PIN
  • Minimal data: we collect only what the educational purpose needs
  • High-privacy defaults: designed with regard to the ICO's Age Appropriate Design Code
  • No advertising or AI training with pupils' data
  • School responsibility: the school is the controller for pupil data and handles consent and requests from parents or carers

Parents and carers should contact their child's school about their child's data. We will help the school respond.

10. Security

  • Encryption: data is encrypted in transit (TLS) and at rest
  • Access control: every request is checked against account, school and class permissions, with database row-level security as an extra layer
  • Protected credentials: service and AI credentials stay on our servers and never reach your browser
  • Monitoring: alerts, audit logs and tested backup restores
  • Secure sign-in: hashed passwords and PINs, attempt limits, and sign-in with Google, Microsoft or GitHub

11. Cookies

We use only essential cookies, which are needed for sign-in, security and core features. They do not require consent. We do not use advertising or analytics cookies. Disabling essential cookies in your browser will stop the Service working properly.

12. International transfers

Your data is stored in the UK, and AI processing takes place in the European Economic Area, which the UK recognises as giving adequate protection.

Some of our providers are owned by companies based in the United States. Where a provider's staff could access data from outside the UK, we make sure the access is protected by one of the following:

  • UK adequacy regulations, including the UK–US data bridge
  • The ICO's International Data Transfer Agreement or Addendum

13. Changes to this policy

We may update this policy from time to time. When we do, we will:

  • Post the new version here, with a new "Last updated" date
  • Tell schools, and account holders where we have an email address, about significant changes

14. Contact us

  • Email: darren@kompass.education
  • Subject: Thinking Paper Privacy Enquiry

If you are unhappy with our response, you can complain to the Information Commissioner's Office (ICO):

  • Website: ico.org.uk
  • Telephone: 0303 123 1113