AI and Data Use for Schools

What Feedback Flow Does

Feedback Flow helps authorised teachers upload student work, transcribe it, organise it, and generate draft feedback, marking support, analysis, lesson follow-up, and teacher comments. The service is designed to support teacher workflow. It is not designed to replace teacher judgement.

Data Uploaded and Processed

Depending on the feature used, a teacher may upload or enter PDFs, images, typed answers, exam-style responses, mark schemes, class names, student names, folders, feedback structures, rubrics, teacher notes, teaching resources and limited pupil support indicators.

Where a school/trust has approved the use in its DPIA and policy, Feedback Flow may process minimal PP/SEND indicators such as pupil premium eligibility, SEND support status or EHCP status. These indicators must be used only where necessary for the educational workflow and must not be treated as AI decision inputs for SEND, intervention, behaviour, safeguarding, setting or progression decisions.

Student work may contain personal data. It may also contain sensitive or special-category information if a pupil writes it in their answer. Teachers should not upload safeguarding records, child protection records, EHCP documents, SEND case notes, detailed medical records, behaviour logs, counselling notes, candidate numbers, UCI numbers, email addresses or other unnecessary personal data unless a separate school/trust approval says it is strictly necessary.

Use of Google Gemini API

Feedback Flow sends selected uploaded files, prompts and related educational context to Google Gemini API through server-side API access in a billing-enabled Google Cloud project. API keys are not intentionally exposed to the browser.

Under Google's paid Gemini API terms, Google states that paid API prompts, uploaded files and responses are not used to train or improve Google's models, subject to those terms. Google may still process, cache or log data as needed to provide the service, maintain security, monitor abuse and comply with law.

Schools and trusts should verify the current Google Cloud billing, DPA, transfer, logging and retention configuration during procurement or DPIA review.

What Feedback Flow Stores

Lawful Basis, DPIA and School Governance

Schools are normally the data controller for pupil data they upload. Feedback Flow acts as processor for school-controlled pupil data. A school should decide its lawful basis, commonly public task for state schools or another appropriate basis depending on the institution and use case. Blanket pupil consent should not be treated as the default basis for routine school assessment support.

Before using Feedback Flow with real pupil data, schools should complete their own DPIA, consult their DPO or IT/security lead, review this page, the School DPIA Checklist, the Privacy Policy, Terms and Data Processing Agreement, and decide whether the intended use is permitted under school, trust and exam-board policy.

Individual Teacher Access

An individual teacher may create an account for their own authorised use, but that does not mean the service has been approved for a whole department, school or trust. If you do not yet have school approval, use only demo, synthetic or properly anonymised data until your school has confirmed the lawful basis, DPIA position, privacy notice, DPO/IT review and assessment policy.

Before the first upload, the app asks users to acknowledge the core data-protection and assessment boundaries. This acknowledgement is recorded as account metadata and does not replace school governance or a controller decision by the school.

Assessment and Coursework Limits

Feedback Flow is intended for teacher-reviewed formative feedback and workflow support. It must not be used as the sole decision-maker for grades, setting, progression, interventions, SEND, behaviour or safeguarding.

Do not use Feedback Flow for live external coursework, non-exam assessment, controlled assessment, exam-board evidence or other high-stakes assessment unless your centre policy and the relevant exam-board rules permit that use. Teachers remain responsible for assessment integrity and for checking whether any AI-assisted feedback record needs to be retained.

Deletion, Export and Retention

Users can review and export account data from the in-app data pages and can submit account deletion requests. Deletion routines are designed to remove user-owned rows and private storage objects across the main student-work, AI-output, maths, exam, teaching-flow, usage and metadata-only audit tables.

By default, uploaded pupil work, transcripts, AI outputs, draft feedback, maths/exam records, rubric marks, Teaching Flow pupil tracking and related support records are eligible for scheduled deletion after 395 days from last update. Usage records are eligible after 365 days, processing jobs after 30 days, and completed/rejected/cancelled deletion request records after 730 days.

Schools should confirm their required retention schedule before rollout and record it in their DPIA. Some operational records may need to be retained for legal, accounting, safeguarding, security, assessment, moderation, appeal or dispute purposes outside the app's normal deletion workflow.

Sub-processors and Hosting

Feedback Flow uses third-party services including Supabase for database, authentication and storage, Cloudflare for hosting and serverless functions, Google Gemini API for AI processing, and Stripe for payments where billing is used.

Hosting and processing regions should be confirmed as part of procurement and DPIA review. Where international transfers apply, schools should review the applicable DPA, SCCs, UK Addendum and transfer safeguards.

Acceptable Use

• Only upload student work you are authorised to process.
• Remove unnecessary personal data before upload where possible.
• Use PP/SEND only as limited support indicators where your school/trust DPIA and policy approve that use.
• Do not upload safeguarding records, child protection records, EHCP documents, detailed SEND case notes, medical details, behaviour logs or high-stakes assessment data unless separately approved and strictly necessary.
• Review every AI output before using it with pupils, parents, reports, markbooks or colleagues.
• Do not present AI marks or comments as final professional judgement without teacher approval.
• Report suspected security, privacy, safeguarding or assessment-integrity concerns promptly.

For data protection, security or school procurement questions, contact [email protected].