Privacy Policy

Last updated: May 2026

Introduction

This privacy notice provides you with details of how we collect and process your personal data through your use of our site tandemteach.ai, including any information you may provide through our site when you create an account, purchase a subscription, use our AI-assisted tools, sign up to our newsletter, contact us, take part in research, complete a survey, or participate in a promotion, prize draw or competition.

This privacy notice also explains how we collect and process data when you use Tandem Teach’s AI-assisted tools, including information you enter into prompts, forms, templates or generation fields, and content generated through the platform.

By providing us with your data, you warrant to us that you are over 18 years of age, or that you are using Tandem Teach with the permission and supervision of an appropriate adult, school, organisation or account holder.

Tandem Teach is intended for use by teachers, tutors, education professionals, schools, educational organisations and adult account holders. Tandem Teach is not intended for direct use by children.

We have appointed a Data Protection Officer who is in charge of privacy related matters for us. If you have any questions about this privacy notice, please contact the Data Protection Officer using the details set out below.

Contact details

Tandem Teach is owned and operated by Classroom Secrets Limited.

If you are not happy with any aspect of how we collect and use your data, you have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection issues.

We would be grateful if you would contact us first if you do have a complaint so that we can try to resolve it for you.

It is very important that the information we hold about you is accurate and up to date. Please let us know if your personal information changes by emailing us at [email protected] or via your account settings.

What data we collect about you

Personal data means any information capable of identifying an individual. It does not include anonymised data.

We may process certain types of personal data about you as follows:

• Identity Data may include your first name, last name, username, title, job role, school, organisation, account name or other identifiers you provide to us.
• Contact Data may include your billing address, delivery address, email address, telephone number, school address, organisation address or other contact details.
• Account Data may include your username, password, account settings, subscription status, user role, organisation, school, plan type, account permissions, saved content, preferences and account activity.
• Financial Data may include payment card details, billing details, payment method, payment provider information and other information required to process payments. We do not store full payment card details ourselves where these are processed by our payment providers.
• Transaction Data may include details about payments to and from you, subscriptions, invoices, purchases, renewals, cancellations, refunds, credits, payment status and other details of products or services purchased by you.
• Technical Data may include your login data, internet protocol address, browser type and version, device type, operating system, platform, time zone setting and location, browser plug-in types and versions, pages visited, session data, error logs, diagnostic data and other technology on the devices you use to access our site or services.
• Profile Data may include your username and password, purchases, subscriptions, plan type, saved resources, generated content, your interests, preferences, feedback, survey responses, research participation, communication preferences and information about how you use Tandem Teach.
• Usage Data may include information about how you use our website, products, AI tools and services. This may include tools used, generations created, resources saved, edits made, downloads, exports, usage limits, credit usage, session activity, clicks, page views, feature use and interactions with emails or other communications.
• Prompt and Input Data may include information you enter into Tandem Teach tools, including prompts, instructions, form responses, templates, year groups, subjects, topics, curriculum information, learning objectives, pupil needs, class context, educational requirements, uploaded or pasted content, and any other information you provide in order to generate, adapt, rewrite, review or create content.
• Generated Output Data may include AI-assisted content created through Tandem Teach, including worksheets, reports, letters, lesson materials, adapted text, questions, answers, explanations, summaries, plans, feedback, templates and other outputs generated, saved, edited, exported or downloaded through the platform.
• Safety and Audit Data may include prompts, inputs, generated outputs, moderation results, flagged content, misuse indicators, system logs, account activity, security events and other information used to monitor platform safety, investigate misuse, comply with legal obligations, protect users and maintain the integrity of the service.
• Marketing and Communications Data may include your preferences in receiving marketing communications from us and our third parties, your communication preferences, email engagement, consent status and opt-out preferences.
• Aggregated Data — we may also process Aggregated Data from your personal data. Aggregated Data does not reveal your identity and is not personal data in itself. For example, we may review usage data to understand which tools are most popular, which year groups are most commonly selected, or how often a particular feature is used.

If we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data and use it in accordance with this privacy notice.

Sensitive data

We do not intentionally ask you to provide special category data. Special category data includes information about race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health information, genetic data and biometric data.

We do not intentionally collect information about criminal convictions and offences.

Tandem Teach is designed for creating educational content. You should not enter unnecessary personal data into Tandem Teach. In particular, you should avoid entering identifiable information about children, pupils, parents, colleagues or other individuals unless this is necessary, lawful and authorised by your school, setting or organisation.

Where you choose to enter sensitive or identifiable information into prompts, forms or templates, that information may be processed in order to provide the requested service, apply safety checks, maintain audit logs, investigate misuse, provide support and administer the platform.

You are responsible for ensuring that any personal data you enter into Tandem Teach is appropriate, necessary and lawful for the purpose for which you are using the platform.

Children’s data

Tandem Teach is not intended for direct use by children.

Users must not enter identifiable personal data about children or pupils unless they have authority to do so and have considered whether the information is necessary for the intended purpose.

Where Tandem Teach is used by a school, tutor, teacher or educational organisation, that organisation or professional may have separate responsibilities under data protection law, safeguarding policies, school policies and any relevant contractual arrangements.

Tandem Teach should not be used to make automated decisions about children, pupils or other individuals that produce legal or similarly significant effects.

Tandem Teach outputs should be reviewed by an appropriate adult before being used, shared or relied upon.

AI inputs and generated content

When you use Tandem Teach’s AI-assisted tools, we may process the information you provide in prompts, forms, templates or uploaded content in order to generate the requested output.

This may include:

• the year group, subject, topic or curriculum area selected;
• instructions or prompts entered by you;
• educational content you ask the system to create, adapt, review or rewrite;
• generated outputs created through the platform;
• edits, saves, exports, downloads or other interactions with generated content;
• usage limits, credit use and account activity.

You should not enter unnecessary personal data into Tandem Teach. You should avoid entering identifiable information about children, pupils, parents, colleagues or other individuals unless this is necessary, lawful and authorised.

Tandem Teach does not use your prompts, uploaded content, generated outputs or saved resources to train third-party AI models.

Use of data for AI training and product improvement

We do not use your prompts, uploaded content, generated outputs or saved resources to train third-party AI models.

We do not sell your prompts, uploaded content, generated outputs or saved resources to third parties.

We may use anonymised and aggregated usage information to understand how Tandem Teach is used, improve tool performance, prioritise future development, manage usage limits, monitor costs, improve user experience and develop new features.

For example, we may use aggregated information to understand that a particular year group, subject area or tool type is popular. This does not identify individual users.

Where we test or improve Tandem Teach tools internally, we use test data, anonymised data, aggregated usage patterns or content that has been appropriately reviewed for privacy and compliance.

How we collect your personal data

Direct interactions

You may provide data by filling in forms on our site, using Tandem Teach tools, creating an account, subscribing to our services, contacting us by post, phone, email or otherwise, or interacting with us through support, research or marketing activities.

This includes personal data you provide when you:

• create an account on Tandem Teach;
• subscribe to Tandem Teach;
• purchase a product or service;
• use an AI-assisted tool;
• enter a prompt or complete a generation form;
• upload, paste or submit content;
• save, edit, export or download generated content;
• request support;
• contact us with a question or complaint;
• request resources or marketing be sent to you;
• respond to onboarding or lifecycle communications;
• enter a competition, prize draw, promotion or survey;
• take part in research, interviews, focus groups or product feedback;
• give us feedback.

Automated technologies or interactions

As you use our site, platform and tools, we may automatically collect Technical Data, Usage Data, Safety and Audit Data about your equipment, browsing actions, account activity and usage patterns.

We collect this data by using cookies, server logs, application logs, analytics tools, security tools and similar technologies.

Please see our cookie policy at tandemteach.ai/dpa for further details.

Third parties or publicly available sources

We may receive personal data about you from various third parties and public sources as set out below:

• Technical Data from Amazon Web Services (AWS) and Vercel;
• Analytics providers such as Google based outside the EU;
• Contact, Financial and Transaction Data from providers of technical, payment and delivery services such as PayPal (US), Stripe (US) and Zoho (EU);
• usage, safety or moderation data from AI, content safety or infrastructure providers;
• publicly available information, where relevant and lawful.

The specific providers we use may change over time. We will only use providers where we consider it appropriate and lawful to do so.

How we use your personal data

We will only use your personal data when legally permitted. The most common uses of your personal data are:

• where we need to perform the contract between us;
• where it is necessary for our legitimate interests, or those of a third party, and your interests and fundamental rights do not override those interests;
• where we need to comply with a legal or regulatory obligation;
• where we have your consent.

Generally, we do not rely on consent as a legal basis for processing your personal data other than in relation to certain marketing communications, optional research participation, or where the law requires consent.

You have the right to withdraw consent at any time by emailing us at [email protected] or by using the unsubscribe or preference options provided.

Purposes for processing your personal data

Set out below is a description of the ways we may use your personal data and the lawful bases on which we process such data. We may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data. Please email us at [email protected] if you need details about the specific lawful basis we are relying on to process your personal data where more than one lawful basis has been set out.

Marketing communications

You may receive marketing communications from us if you have:

• requested information from us;
• purchased goods or services from us;
• created an account with us;
• subscribed to our service;
• used our free tools;
• provided us with your details and consented to receive marketing communications;
• not opted out of receiving marketing.

We will get your express opt-in consent before we share your personal data with any third party for their own marketing purposes.

You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out or unsubscribe links on any marketing message sent to you, by changing your account preferences where this option is available, or by emailing us at [email protected].

Where you opt out of receiving marketing communications, this will not apply to personal data provided to us as a result of a product or service purchase, subscription, account registration, service experience or other transaction.

We may still send you service communications that are necessary for the administration or use of your account, such as subscription updates, payment notices, changes to terms, safety notices, security alerts or important product updates.

Lifecycle communications

We may send you lifecycle communications to help you use Tandem Teach, understand your account, manage your usage, use available tools, renew or upgrade your subscription, or get more value from the service.

These communications may include:

• onboarding emails;
• account set-up guidance;
• usage reminders;
• credit or limit notifications;
• renewal reminders;
• cancellation or expiry notices;
• product updates;
• feature education;
• support prompts;
• free-to-paid conversion communications;
• reactivation communications.

Some lifecycle communications may be service-related and necessary for the performance of the contract. Others may be marketing communications, depending on their content and context.

You can opt out of marketing communications, but you may still receive important service communications where these are necessary for your account or subscription.

Third-party AI and service providers

We use selected third-party service providers to operate Tandem Teach. These may include providers of:

• hosting and infrastructure;
• database storage;
• payment processing;
• analytics;
• email delivery;
• customer support;
• AI generation;
• content safety;
• moderation;
• security;
• monitoring;
• system administration.

Where AI model providers process prompts, inputs or generated outputs on our behalf, they do so as service providers and are not permitted to use that data to train their models.

We require third-party service providers to respect the security of your personal data and to treat it in accordance with the law. We only allow such providers to process your personal data for specified purposes and in accordance with our instructions.

Our current or intended providers are:

• Anthropic / Claude
• OpenAI Moderation
• Azure Content Safety
• AWS
• Stripe
• Zoho

This list may change as our services develop. Where necessary, we will update this privacy notice.

Disclosures of your personal data

We may have to share your personal data with the parties set out below for the purposes described in this privacy notice:

• service providers who provide IT, hosting, storage, database, system administration, analytics, security, payment, email, support, AI generation, content safety or moderation services;
• professional advisers including lawyers, bankers, auditors, accountants and insurers who provide consultancy, banking, legal, insurance and accounting services;
• HM Revenue & Customs, regulators, law enforcement, safeguarding bodies, courts or other authorities where we are required or permitted to disclose information by law;
• third parties to whom we sell, transfer or merge parts of our business or our assets;
• schools, organisations or account administrators where you use Tandem Teach as part of a school, organisation or managed account and disclosure is necessary for account administration, billing, safeguarding, misuse investigation or service delivery.

We require all third parties to whom we transfer your data to respect the security of your personal data and to treat it in accordance with the law.

We only allow such third parties to process your personal data for specified purposes and in accordance with our instructions, unless they are independent controllers with their own legal obligations.

International transfers

Countries outside of the European Economic Area (EEA) do not always offer the same levels of protection to your personal data, so European law has prohibited transfers of personal data outside of the EEA unless the transfer meets certain criteria.

Many of our third-party service providers are based outside the EEA so their processing of your personal data will involve a transfer of data outside the EEA.

Whenever we transfer your personal data out of the EEA, we do our best to ensure a similar degree of security of data by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission; or
• Where we use certain service providers, we may use specific contracts or codes of conduct or certification mechanisms approved by the European Commission which give personal data the same protection it has in Europe.

Where possible we choose vendors who are based within the UK or, where not possible, are based within the EEA. In some instances, in order to provide the best user experience for our customers, we do select vendors based outside the UK and EEA.

Our default site analytics is Plausible (EU) — cookieless, server-side, processes no personal data, and no consent is required because no personal data is processed and nothing leaves the UK/EEA. If and only if you actively choose to enable cookies via our cookie banner will we then load Google Analytics (US) for aggregate usage analytics. Dismissing the banner, ignoring it, or making no choice all mean Google Analytics does not run and no analytics cookies are set. For our customers who pay for an individual subscription, our chosen payment gateway is Stripe (US), because of the enhanced user experience and features available. Schools are charged via invoice and data remains within the EEA.

We are aware of the Schrems II judgement in July 2020. Our understanding from the ICO is that they are continuing to work with Google to resolve issues, and that the UK is not part of the EU and therefore decisions made in EU countries are not binding. We have made adjustments to improve customer privacy, including switching to Google Analytics 4 which has improved built-in privacy features such as automatic IP anonymisation.

If none of the above safeguards is available, we may request your explicit consent to the specific transfer. You will have the right to withdraw this consent at any time.

Please email us at [email protected] if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, accessed, altered or disclosed in an unauthorised way.

In addition, we limit access to your personal data to employees, agents, contractors, service providers and other third parties who have a business need to know such data. They will only process your personal data on our instructions, unless they are legally required to act otherwise, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach. We will notify you and any applicable regulator of a breach where we are legally required to do so.

You are responsible for keeping your account login details secure. You should not share your password or allow unauthorised people to access your account.

Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes.

In some circumstances you can ask us to delete your data: see your legal rights below.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data. These include the right to:

• Request access to your personal data.
• Request correction of your personal data.
• Request erasure of your personal data.
• Object to processing of your personal data.
• Request restriction of processing your personal data.
• Request transfer of your personal data.
• Withdraw consent.

You can read more about these rights at ico.org.uk.

If you wish to exercise any of the rights set out above, please email us at [email protected].

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

Cookies

Cookies on this site are off by default. The only cookie set automatically is a same-session log-in cookie used purely to keep you signed in — it can’t be used for tracking and never leaves your browser beyond your own session. All other cookies — analytics, behavioural, marketing — require your active opt-in via our cookie banner. Dismissing the banner, ignoring it, or making no choice all mean no additional cookies are set and no third-party trackers load. The detail of which tools can be enabled, and what each one does, is set out below.

Analytics by default: no cookies, no tracking

Our default site analytics are provided by Plausible Analytics, which is a privacy-friendly, cookieless, server-side analytics service. Plausible does not set cookies in your browser, does not collect or store personal data, does not use device fingerprinting, and does not track you across websites. No consent is required to use this service because no personal data is processed.

Optional analytics and behavioural tools (cookie consent required)

If — and only if — you choose to accept our cookie policy via the cookie banner, the following additional third-party tools will be loaded. You are not required to accept these. Declining or ignoring the cookie banner means none of the tools below will run.

• Google Analytics (GA4) — provided by Google LLC. If enabled, GA4 sets cookies in your browser (typically _ga, _ga_* and similar) and collects information about your interactions with our website, including pages viewed, time on page, referral source, approximate location (derived from IP address), device, browser and operating system. Google may process this data outside the UK/EEA. Cookies typically persist for up to two years from your most recent visit.
• Zoho PageSense — provided by Zoho Corporation. If enabled, PageSense sets cookies in your browser (typically _zps, _zpses and similar) and collects information about your interactions with our website, including click and scroll behaviour, heatmap data, session recordings, on-page surveys and A/B test exposure. PageSense may process this data outside the UK/EEA. Cookies typically persist for up to one year from your most recent visit.

Both Google Analytics and Zoho PageSense are loaded with their respective vendors’ default settings. Where supported by your browser, signals such as Global Privacy Control (GPC) or Do Not Track may also be honoured by these vendors, but we do not guarantee third-party behaviour beyond what each vendor commits to.

You can withdraw consent at any time by clearing your cookies and either declining the cookie banner the next time it appears, or using your browser’s privacy controls to refuse third-party cookies. Once consent is withdrawn, no further data will be collected by these optional tools, although data already collected before withdrawal may be retained by the relevant vendor under their own retention schedules.