Privacy Policy

For any privacy-related questions or requests, please contact us:

Email: hello@chalkie.ai

Address:

Chalkie AI Ltd.

71 - 75 Shelton Street

London

WC2H 9JQ

United Kingdom

We collect and process information necessary to provide, maintain, and improve Chalkie AI. This includes:

Information You Provide Directly:

Account Information: Your name, email address, password, and potentially your institution or role (if applicable) when you register an account. Why: To create and manage your account, provide access to the service, and communicate with you.

Payment Information: Billing details when you subscribe to paid services. Note: Payment processing is handled by our secure third-party partner Stripe. We do not directly store your full credit card or bank details. Why: To process payments for subscriptions.

User-Generated Content: The prompts you enter, text, lesson plans, presentation content, and other information you create or upload while using Chalkie AI (e.g., generating slides). Why: To provide the core functionality of the service (generating content based on your input).

Communications: Information you provide when you contact us for support or other inquiries. Why: To respond to your requests and provide assistance.

Marketing Preferences & Consent: Your preferences for receiving marketing communications and records of consent you have provided. Why: To send relevant updates and offers (where consented) and respect your choices.

Information Collected Automatically:

Usage Data: Information about how you interact with our website and service, such as features used, pages visited, clicks, time spent, and user journeys. This may involve tools like PostHog. Why: To understand user behaviour, improve the service, troubleshoot issues, and enhance user experience. We may also tell a school how many of its teachers use Chalkie and how many resources they have created, as totals only, when offering it a licence or pilot. We never name individual teachers or share what they have made.

Device and Connection Information: IP addresses, browser type, operating system, and other technical details about your device and connection. Why: For security purposes, analytics, and optimizing service delivery.

Cookies and Similar Technologies: We use cookies and similar tracking technologies. For detailed information, please see our "Cookies" section below. Why: To enable website functionality, remember preferences, perform analytics, and potentially for marketing.

Connecting an app is optional. When you authorize ChatGPT or another app to connect to Chalkie through the Model Context Protocol (MCP), that app can use the permissions you grant to create teaching resources and find or read resources in your Chalkie account. We process these requests to provide the features you ask for.

Information exchanged: Chalkie receives the instructions, search terms and creation settings the connected app sends. Depending on the request, we return account details (account ID, name, email address, country, language and plan), resource titles and IDs, generation settings, teaching content, preview images, status information and links to resources. This can include personal information you put in prompts or teaching materials. The connection does not give Chalkie access to your entire conversation history; we receive the information sent with requests to Chalkie. Please don’t include pupils’ names or other personal information about students in requests made through a connected app. If you use Chalkie under a school or district agreement, check your school’s policy before connecting a third-party app.

Who receives it: Information returned through the connection is shared with the app you authorize, including OpenAI when you use ChatGPT. That service processes information under its own terms, privacy policy and your account settings, including its retention and model-training settings. The API-provider statements elsewhere in this policy describe services Chalkie uses to generate content; they do not describe how your connected ChatGPT or other app account handles information. For ChatGPT, see https://openai.com/policies/privacy-policy/.

Connection records: We store the app identifier, the account that authorized it, permissions, authorization codes and access/refresh token records, including expiry and revocation information, to manage and secure the connection. Your Chalkie password is not shared with the connected app.

Disconnecting and deletion: You can revoke an app’s access in Chalkie under Account → Connected apps. Disconnecting revokes its authorization to make further requests using that connection. School and district administrators can ask us to turn off connected apps for all teachers on their organisation’s Chalkie account by emailing compliance@chalkie.ai. Disconnecting does not delete your saved Chalkie resources or information already received by the app. You can delete resources in Chalkie or contact hello@chalkie.ai about your Chalkie data; use the connected service’s controls or contact that service to request deletion of its copies.

Usage analytics: We use PostHog to understand connected-app use and troubleshoot failures. Tool-usage events include your account ID, the tool used, whether it returned an error and the connected app’s identifier. Resource-creation events identify resources created through MCP and the connected app. These tool-usage events do not contain prompts or resource content. Separate AI-generation analytics may include prompts and responses, as described in the PostHog disclosure below.

Live Activities let students join a teacher-led lesson using a code or link at https://chalkie.live. Students do not need a Chalkie account, email address, password, or school login, and we do not create a student profile across lessons.

When a teacher runs Live Activities with a class, the school, trust, district, or other organisation is the controller of student information in that lesson. Chalkie is the processor under the Data Processing Agreement at https://chalkie.ai/dpa. A teacher who turns answering on does so for that organisation, not as a personal account. If a parent or student asks about student data, they should ask the school first. Chalkie will help the school.

When answering is enabled, Chalkie stores that lesson's display name, participant ID, activity responses, scores, and timestamps on our servers so the teacher can run the activity and review results. The join screen gives each student a made-up display name. Students can change it and can type anything, including a real name. If they type a real name, we treat that display name as personal data. Please do not type real names, and do not share the lesson with anyone who should not see the class. We never use this information for advertising. Follow-along viewing does not require an answering profile. Those lesson records remain on our servers after the session ends. Ending the session does not delete them, and there is no automatic deletion period. The teacher can delete that session's results in the app, or the school can ask us to delete them at hello@chalkie.ai.

The browser keeps a reconnection token and participant details in local storage on that device for up to 12 hours, including after the tab is closed, so the same device can rejoin that lesson. We do not link participant identities across sessions. These records are pseudonymous, not necessarily anonymous: a teacher may know who used a nickname, and a nickname may be a real name.

Hosting and our real-time connection provider (Pusher) process the data needed to run the lesson, such as IP addresses, browser details, session or connection identifiers, display names and scores. We also process temporary connection, tab-visibility, and slide-synchronization information to show the teacher classroom connection counts.

The teacher can see participants, responses, scores, and class results during the session and review saved results afterward. Ending a session or closing a browser does not delete those stored records. Nicknames are shared within the session, and nicknames and scores may be shown to other participants when the teacher enables the leaderboard.

Student data is not sold, used for advertising, or used to train AI models. Student answers are not sent to AI providers for assessment: scoring uses the activity answer key and fixed scoring rules. AI may help the teacher create the activity before students answer it.

No analytics, advertising, session-replay, or support-tracking scripts run on the chalkie.live student surface. Essential browser storage and real-time connections support participation. Separate server-side service events record teacher/session usage and operational counts without student names, answers, scores, or participant tokens.

For school-directed use, the school determines the educational purpose and applicable legal basis, provides required notices, and obtains any required authorization. Chalkie processes student participation data on the school’s behalf. For younger students, the school provides those notices and any required authorization, including school authorization where COPPA applies. Relying on school authorization does not remove Chalkie’s remaining operator obligations under COPPA or similar children’s privacy laws. Joining a lesson is not consent to advertising or AI training. Parents and eligible students should contact their school about access, correction, or deletion; schools can contact hello@chalkie.ai for assistance.

We rely on the following lawful bases under GDPR to process your personal data:

Contract: Processing necessary to perform our service contract with you (e.g., managing your account, generating content, processing payments).

Legitimate Interests: Processing necessary for our legitimate interests, provided these do not override your fundamental rights and freedoms (e.g., improving our service, security monitoring, analyzing usage trends, limited marketing communications about similar services).

Consent: Where required by law, or for certain marketing communications, we will rely on your explicit consent. You can withdraw consent at any time.

Legal Obligation: Processing necessary to comply with our legal obligations (e.g., financial record-keeping).

We process your data only when we have a valid legal basis, applying the appropriate basis depending on the specific processing activity.

Directly from you: When you sign up, use the service, make payments, or contact us.

Automatically: Through your use of our website and service (e.g., usage data, cookies).

Third Parties: Such as Google for authentication purposes if you choose to sign in via Google.

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Our retention periods are as follows:

You may request deletion of your data at any time, subject to legal or operational requirements. See "Your Data Protection Rights" below.

Account Information: While account is active + up to 7 years after closure. Reason: Service provision, legal and operational purposes.

Payment Records: Up to 7 years. Reason: Financial compliance, tax laws, and audit purposes.

Marketing Preferences: Until you opt-out or withdraw consent. Reason: Respecting user choices and service relevance.

User-Generated Content (Prompts, Slides, etc.): While account is active, or until deleted by user. Reason: Core service provision, user control.

Deleted User Content Backup: Up to 90 days after deletion request is processed. Reason: Data recovery, system integrity (then permanently deleted).

Website Analytics & Usage Data: Up to 26 months (often anonymized or aggregated sooner). Reason: Analytics, trend analysis, and service improvement.

Connected apps: The account, user-generated content, backup and usage-data periods above also apply when you use an app connection. We schedule expired authorization codes and access/refresh token records for deletion once they have been expired for 30 days. Revoking a connection stops access but does not immediately erase these records. Information already received by a connected app follows that service’s retention policy.

Live Activities student data: Saved participation and results remain on our servers after a session ends. Ending a session does not delete them, and there is no automatic deletion period. The teacher can delete a session's results in the app. Schools can also ask us to return or delete them by emailing hello@chalkie.ai; we fulfil those requests manually. Where the National Data Privacy Agreement (NDPA) applies, we return or delete student data from production systems — including copies we can instruct service providers to delete — within 60 days of the school’s written request, and dispose of it on termination in accordance with that agreement and applicable law. Database backups remain recoverable for about 90 days (7 daily, 4 weekly, and 3 monthly copies), plus DigitalOcean managed backups and 7-day point-in-time recovery. Deleted student records can remain in those backups until they expire. If a backup is restored, we re-apply any later deletion so restored data does not revive deleted student records.

The following list provides detailed information about the third-party sub-processors we use to deliver Chalkie AI:

Google Vertex AI (Global endpoint): Prompts, lesson content and files you upload (no name or email from account details, though prompts and files can contain anything you type or include). Primary AI content generation (Gemini models), diagram generation, YouTube video transcription, text-to-speech, and backup image generation. Google chooses the region that processes each request. Lawful basis: Contract.

OpenAI API (United States): Prompts, lesson content and files you upload, plus a pseudonymous ID (a one-way hash of your account ID, used to detect abuse; no name or email). Content moderation, editing chat for slides, documents and outlines, video selection, image generation and editing (directly and via Runware), and backup lesson, document and slide-layout generation. OpenAI retains responses under its API data-retention terms. Lawful basis: Contract. This describes Chalkie’s use of OpenAI as an API provider. User-authorized ChatGPT connections are described in “Connected Apps, ChatGPT and MCP” above.

Runware (US / Germany / Romania): AI image prompts and, for edits, the image being edited (no name or email from account details, though prompts and images can contain anything you type or include). Backup image generation and editing (routes to OpenAI's image models, or to other hosted image models as a further fallback). Lawful basis: Contract.

OpenRouter (United States): Prompts, lesson content (not stored; no name or email from account details, though prompts can contain anything you type or include). Routes slide theme design and slide layout fixes to Anthropic's Claude models (United States), and is a backup route to Google's Gemini and Gemma models for most other AI features if our primary AI provider is unavailable. Not used to train models. Lawful basis: Contract.

Serper (location not published): Search terms for images and videos (typed by you, or written by our AI from your lesson content) and web searches made by the editing chat, with a language and country to localise the results. No name, email or account ID from your account details is sent, though search text can contain anything you type or include. Image, video and web search. Lawful basis: Contract.

Firecrawl (United States): The address of a public web page or PDF that the editing chat reads, when our own servers cannot read it, and the content returned. No name, email or account ID from your account details is sent, though the address you share and the page it points to can contain anything you type or include. We ask Firecrawl not to cache the page. Reading web pages and PDFs for the editing chat. Lawful basis: Contract.

DigitalOcean (Netherlands, EU, for the live database; a worker server and encrypted database backups in London, United Kingdom, covered by the European Commission's adequacy decision for the United Kingdom): Account data, user content, logs, user-generated files (via Spaces), and Live Activities lesson participation and results. Cloud hosting, data storage, file storage. A worker server in London processes queued jobs, including teacher account data and content and Live Activities participation and results. It stores no data: the data stays in Amsterdam (AMS3), and the worker connects to it over TLS. Lawful basis: Contract.

SnapShooter (Ireland, EU; part of DigitalOcean): Orchestrates encrypted database backups from our own server. It keeps a root SSH key for the backup worker, and that SSH trust stays in place between backups. The dump includes teacher account data and Live Activities participation and results. Backup contents are not sent through SnapShooter, and it does not hold the encryption key. DigitalOcean stores the encrypted backup in London. Lawful basis: Contract.

Laravel Forge (United States): Our server configuration and application settings, including service credentials. Forge sets up and manages our application and worker servers and keeps SSH access to them with root rights. Those servers process account data, user content and Live Activities participation and results, but we do not send personal data to Forge directly. Server provisioning and management. Lawful basis: Contract.

Vercel (United States): Website traffic in transit (no personal data stored server-side). Frontend hosting and content delivery. Lawful basis: Contract.

Stripe (United States): Billing name, email, billing address, payment details (tokenised). Payment processing. Lawful basis: Contract.

Google (United States): Email, name, profile picture; exported content; billing address text as you type it. Authentication, Google Slides/Docs export, and address autocomplete (Google Maps) in the billing form. Lawful basis: Contract / Consent.

PostHog (EU): Usage data, page views, device and browser information, and pseudonymous user IDs with account attributes such as country, language, locale, access tier, subscription metadata, and AI prompts and responses for quality monitoring (no name or email in your account details, though prompts and responses can include anything you type; IP-based geolocation disabled for server-side events). In the Chalkie app, session replay is on: PostHog records what you do on screen, such as pages viewed, clicks and what is displayed. Text you type into form fields is masked, and Live Activities student nicknames (in the student list and leaderboard) and score charts are blanked out. Other on-screen text, including lesson and document content, is not masked. Session replay is off on our marketing website. Product analytics and service improvement. Lawful basis: Legitimate Interests / Consent.

Google Analytics (United States): On our public marketing website only, not inside the Chalkie product: the pages you visit (address, title and referring page), device and browser information, approximate location derived from your IP address, and Google Analytics cookie IDs (_ga, _ga_*). It loads and sets these cookies when the page loads, before you make any cookie choice. If you opt out of analytics cookies, it still records page views, without cookies. Website analytics and conversion measurement. Lawful basis: Legitimate Interests.

Intercom (United States): Device and browser information, IP address, language preference, and any contact details or message content you choose to submit via support chat. Customer support and messaging. Lawful basis: Legitimate Interests / Consent.

Brevo (France, EU): Email, name, country, language, user ID, subscription status, usage counts and events, and school name and location. Transactional and product email delivery (marketing email is opt-in with one-click unsubscribe). Lawful basis: Contract / Consent.

SendGrid (United States): Name, email address, and message content submitted through the website contact form. Delivery of contact-form emails to Chalkie. Lawful basis: Legitimate Interests.

Attio (United Kingdom): Name, email address, job role, school name and location, the content of enquiry and contact-request messages, licence numbers, and (for school and organisation accounts) trial usage metrics and quote details. Customer relationship management for school enquiries, pilots and quotes. Lawful basis: Contract / Legitimate Interests.

Instantly (United States): Name, work email address, job title, email content, and open and reply events. Sending outreach emails to school staff. Lawful basis: Legitimate Interests.

Anthropic (United States): Name, job title, work email address and school of the staff we contact, and per-school usage totals. AI tools that help our team manage outreach to schools. Lawful basis: Legitimate Interests.

Cal.com (United States): Name, email address, school name and enquiry message (pre-filled from our school enquiry form), IP address and browser information. Booking calls with our schools team. Lawful basis: Legitimate Interests.

Senja (United States): Testimonials that teachers choose to submit through our Senja form: your name, photo (if you add one), testimonial text, the grade you teach, your location and the submission date. We copy them from Senja to show testimonials on our website. Collecting and publishing testimonials. Lawful basis: Legitimate Interests.

Zapier (United States): For feedback-form submissions, the teacher's name, email address and feedback; for subscription cancellations, a pseudonymous user ID, your plan, the cancellation reason, any details you add and when you cancelled. Internal workflow automation that passes feedback and cancellation information to our team. Lawful basis: Legitimate Interests.

Sentry (EU): Pseudonymous user ID, IP address, browser/OS info, error stack traces, application logs, and occasional session replays with text masked; may include an email address or request content when an error occurs. Error tracking, logging and performance monitoring. Lawful basis: Legitimate Interests.

Cloudflare (Global): IP addresses, request headers, and, for Live Activities, the participant token, display name, registration key, and answer while the request is proxied to the API, and worksheet and slide content sent to render page images for the editing chat. CDN, DDoS protection, DNS proxy, and page rendering (Cloudflare Workers). Lawful basis: Legitimate Interests.

Pusher (United States supplier; EU cluster for production real-time traffic): User, session, participant, and connection identifiers; technical connection data; real-time lesson content and room events; participant display names; and scores when the teacher enables the leaderboard. Real-time delivery for Live Activities. Being replaced by Ably. Lawful basis: Contract. Transfers are covered by Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA). The EU cluster is the processing region, not a finding of no transfer.

Ably (United Kingdom; processed on Amazon Web Services in several regions): User ID, IP address, browser information; AI chat replies while they are delivered, including edits to your resources and any personal information you include in the chat; the lesson and document content being generated (slides and worksheet sections) while it streams to your editor; lesson, document and upload titles and file names with generation, upload and notification status; and export status and download links. Real-time delivery of AI chat replies, lesson and document content as it is generated, generation and upload progress, lesson and document exports, and notifications. Lawful basis: Contract.

Meta Conversions API (United States): SHA-256-hashed email, hashed user ID, Meta browser and click identifiers (_fbp/_fbc), landing-page URL, connection metadata (IP address and browser user agent), and conversion events (sign-up and subscription only), sent server-side; on the public marketing website the Meta Pixel also loads, sets its cookie (_fbp) and records a page view as soon as the page loads, before you make any cookie choice. Ad conversion measurement. Lawful basis: Consent / Legitimate Interests.

Google Ads (United States): SHA-256-hashed email, ad-click identifiers, and conversion events (sign-up and subscription only), sent server-side. Ad conversion measurement. Lawful basis: Consent / Legitimate Interests.

Microsoft Advertising (United States): SHA-256-hashed email, ad-click identifiers, and conversion events (sign-up and subscription only), sent server-side. Ad conversion measurement. Lawful basis: Consent / Legitimate Interests.

OpenAI Ads (United States): SHA-256-hashed email, hashed user ID, OpenAI ad-click references, connection metadata (IP address and browser user agent), and conversion events (sign-up and subscription only), sent server-side; on the public marketing website the OpenAI Ads pixel also loads, sets its cookies and records a page view as soon as the page loads, before you make any cookie choice. Ad conversion measurement. Lawful basis: Consent / Legitimate Interests.

A note on advertising: no advertising or ad-network scripts run inside the Chalkie product. Sign-up and subscription conversions are sent server-side only and use a hashed email rather than your email address. In the UK, EEA and Switzerland this is enabled by default, and you can opt out at any time. In some US states you can also opt out at any time. Users belonging to school or organisation accounts are excluded from ad conversion reporting.

Safeguards for International Transfers: Where sub-processors are located outside the UK/EEA (e.g., United States), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office and/or the European Commission.

We do not sell your personal data. We share information with service providers who help us operate Chalkie AI under confidentiality and data processing agreements. We also share information with apps you choose to connect, as described in “Connected Apps, ChatGPT and MCP” above.

Google Vertex AI: We send the prompts and content you provide to Google's Vertex AI API to generate lessons, worksheets, and other outputs as requested by you. No name or email from your account details is sent with this content (though it can contain anything you type or include), and under the API terms this data is not used to train models.

OpenAI API: We use OpenAI's API to screen the content you submit (content moderation), to power the editing chat for slides, documents and outlines, to select videos, to generate and edit images (directly and via Runware), and as a backup for generating lessons, documents and slide layouts. No name or email from your account details is sent with these API requests (though content can contain anything you type or include); editing-chat requests carry a pseudonymous ID (a one-way hash of your account ID) that OpenAI uses only to detect abuse. Please review OpenAI's policies for how they handle data received via their API: https://openai.com/policies/usage-policies/ This API disclosure does not cover your separate use of a connected ChatGPT account.

OpenRouter, Anthropic and Google: We use OpenRouter to send lesson content to Anthropic's Claude models, which design slide themes and fix slide layouts, and as a backup route to Google's Gemini and Gemma models when our primary AI provider is unavailable. No name or email from your account details is sent with this content (though it can contain anything you type or include), and it is not used to train models.

DigitalOcean: Hosts our application servers, website, and stores service data securely.

Google: Manages authentication if you sign in with Google. Used for exporting content to Google Slides if you use that feature. Provides address autocomplete (Google Maps) in the billing form. We comply with the Google API Services User Data Policy, including the Limited Use requirements.

PostHog: Provides product analytics and service usage insights. This uses a pseudonymous user ID and account attributes such as country, language, locale, access tier, and subscription metadata, plus AI prompts and responses — no name or email from your account details is sent to PostHog, though prompts and responses can include anything you type.

Intercom: Provides customer support and messaging tools. If you contact us via Intercom, it may process device and browser information, your contact details, and the contents of your message.

Stripe: Handles payment processing securely. We do not store your full card details.

We may also share data if required by law, to protect rights and safety, or in connection with a business transfer (e.g., merger or acquisition), ensuring appropriate safeguards are in place.

If we contact you in your work role, we hold your name, contact details, job title and school. We get these from Apollo.io and the Department for Education's Get Information About Schools register. You can object at any time by replying "unsubscribe" or emailing hello@chalkie.ai, and we will stop contacting you.

Our primary servers, hosted by DigitalOcean, are located in Amsterdam, Netherlands 🇳🇱. Encrypted database backups of that data are stored in London, United Kingdom, covered by the European Commission's adequacy decision for the United Kingdom. A worker server in London, United Kingdom, processes queued jobs; it stores no data and connects to the servers in Amsterdam over TLS. Data storage and processing comply with GDPR standards.

If we transfer personal data outside the UK, EEA, or Australia (e.g., through our use of third-party services based in the US, such as our payment processor or AI providers), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the relevant authorities or verifying the recipient's participation in a recognized adequacy framework, to protect your data in accordance with UK GDPR, EU GDPR, and the Australian Privacy Principles (APPs).

Changes to where we host or process data: If we move our primary hosting to a different country, or change our primary AI provider, we will tell you by email or by a notice in Chalkie, where practicable before the change takes effect. We keep the sub-processor list above up to date, and the date of each change is shown on this page.

We use cookies (small text files placed on your device) and similar technologies (like web beacons or pixels) to operate our website, remember your preferences, analyze performance, and potentially for marketing purposes. These may include:

Essential Cookies: Necessary for the website and service to function (e.g., login sessions).

Analytics Cookies: Help us understand how users interact with our service (e.g., PostHog; Google Analytics is used on our public marketing website only, not inside the Chalkie product).

Support Cookies: Help us provide support and messaging functionality (e.g., Intercom).

Preference Cookies: Remember choices you make (e.g., language).

Marketing Cookies: Used on our public marketing website only (e.g., the Meta Pixel and the OpenAI Ads pixel for visitors). No advertising or ad-network scripts run inside the Chalkie product itself.

Analytics and marketing cookies are on by default and do not wait for your consent: Google Analytics, the Meta Pixel and the OpenAI Ads pixel load and set their cookies as soon as a page of our marketing website loads, before you make any cookie choice, unless you have already opted out. In the UK, EEA and Switzerland, you can disable either category at any time via "Cookie settings" in the website footer, and we delete the related cookies. In some US states you can opt out of marketing cookies via "Your Privacy Choices" in the footer; we also honour the Global Privacy Control browser signal as an opt-out.

For the full list of cookies we use, their purposes and durations, see our Cookie Policy at https://chalkie.ai/cookies.

Providing Consent: You provide consent for AI processing of your content when you create an account and use Chalkie AI's generation features. This is clearly indicated during the signup process.

Withdrawing Consent: You may withdraw your consent for AI processing at any time by emailing hello@chalkie.ai with the subject line "Withdraw AI Consent". We will process your request within 5 business days.

Effect of Withdrawal: If you withdraw AI consent, you will no longer be able to use AI-powered features (lesson generation, worksheet creation, etc.). Your account and any previously generated content will remain accessible. You may reinstate AI consent at any time by contacting us.

If Chalkie AI is used by a U.S. school or district ("School"):

School Official Status: Where the FERPA school-official exception applies, Chalkie performs an educational service for the School under its direct control regarding the use and maintenance of education records, with a legitimate educational interest and restrictions on use and redisclosure (34 CFR §§ 99.31(a)(1) and 99.33).

Educational Purpose: We use student data only to provide the educational service for the School. Student data is not sold, used for advertising, or used to train AI models. Student answers in Live Activities are scored against activity answer keys, not assessed by AI.

Student Data: Students do not create Chalkie accounts or a profile across lessons. Live Activities store that lesson's display names, participant IDs, responses, scores, and timestamps on our servers so the teacher can review results. The join screen starts with a made-up display name. Students can change it and can type a real name. If they do, that name is personal information and may be an education record. Pseudonymous records may still be education records or personal information. Teachers should avoid placing real student names, student ID numbers, or sensitive education-record information in prompts, teaching materials, or display names. The School retains control of its student data.

Data Access, Return & Deletion: The teacher can delete a session's results in the app. Schools may also contact hello@chalkie.ai to access, correct, return, or delete their student data. We fulfil these requests manually and support the School in responding to parents and eligible students. Where the NDPA applies, we return or delete student data from production systems — including copies we can instruct service providers to delete — within 60 days of the School’s written request and dispose of it on termination under the agreement and applicable law, subject to any shorter applicable deadline. Database backups remain recoverable for about 90 days. Deleted student records can remain in those backups until they expire. If a backup is restored, we re-apply any later deletion.

Data Security: We implement administrative, physical, and technical safeguards to protect any data processed, consistent with industry standards.

Data Breach: In the event of a data breach potentially involving student data, we will notify the affected School(s) promptly.

For users in Australia, we are committed to complying with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs):

Collection: We only collect personal information reasonably necessary for our functions and activities.

Notification: As outlined in this policy, we inform you about the types of data collected, purposes, third-party sharing, and that data is primarily stored securely in Amsterdam, Netherlands.

Access and Correction: You have the right to request access to and correction of your personal information we hold (see "Your Data Protection Rights").

Data Security: We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorized access, modification, or disclosure.

Cross-border Disclosure: We take reasonable steps to ensure overseas recipients (like OpenAI or DigitalOcean) handle your data in accordance with the APPs, typically through contractual clauses.

Notifiable Data Breaches (NDB): We comply with the NDB scheme requirements in case of eligible data breaches.

Depending on your location and applicable law (particularly under GDPR and similar regulations), you have rights regarding your personal data:

Right of Access: Request a copy of the personal data we hold about you. 📥

Right to Rectification: Ask us to correct inaccurate or incomplete information. ✏️

Right to Erasure ('Right to be Forgotten'): Request deletion of your personal data under certain conditions (e.g., it's no longer needed for the purpose it was collected). 🗑️

Right to Restrict Processing: Ask us to limit how we process your data in specific circumstances. ⛔

Right to Object: Object to processing based on legitimate interests or for direct marketing. 🙅

Right to Data Portability: Request your data be transferred to you or another organization in a structured, commonly used, machine-readable format (where processing is based on consent or contract and automated). 🔄

Right to Withdraw Consent: If processing is based on consent, you can withdraw it at any time (this won't affect past processing). ❌

There is usually no fee to exercise these rights. We aim to respond to verifiable requests within one calendar month. 🕓

To make a request, please contact us using the details at the top of this policy. We may need to verify your identity before fulfilling your request. 📬

We hope to resolve any concerns you have directly. Please contact us first using the details provided above.

However, if you are unsatisfied with our response or believe we are not processing your data in accordance with the law, you have the right to lodge a complaint with your local data protection supervisory authority:

In the UK: Information Commissioner's Office (ICO). Website: https://www.ico.org.uk/make-a-complaint Helpline: 0303 123 1113 ☎️

In Australia: Office of the Australian Information Commissioner (OAIC). Website: https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us

In the EU: Contact the data protection authority in your member state.

In the U.S.: FERPA complaints are typically handled through the educational institution or the U.S. Department of Education's Student Privacy Policy Office (SPPO).

We update this Privacy Policy from time to time, for example to describe a new feature, name a new service provider, or make the wording clearer. The "Last Updated" date at the top shows when it was last changed, and the "Recent changes" list below summarises what changed.

Material changes: If a change is material, we will tell you by reasonable and appropriate means, such as email or a notice in Chalkie, and where practicable before it takes effect. A change is material if it means we use your personal data for a new purpose, collect a new type of personal data, share it with a new kind of recipient, or reduce your rights. Corrections, clarifications, extra detail about processing we already describe, and formatting changes are not material, and we make those by updating this page.

Schools and organisations: Changes affecting personal data we process for a school or organisation, including new sub-processors, are handled under the Data Processing Agreement.

If you keep using Chalkie after a material change takes effect, the updated policy applies to you. If you do not agree, you can close your account at any time.

Recent changes

• 5 Nov 2026: Added disclosures for optional ChatGPT and other MCP app connections, including information exchanged, connection records, usage analytics, retention, disconnection and deletion. Distinguished connected-app processing from Chalkie’s use of AI-provider APIs.

• 30 Oct 2026: Added Instantly and Anthropic for our outreach to schools. Explained that we may tell a school how many of its teachers use Chalkie and how many resources they have created, as totals only. Added a section for people we contact who don't use Chalkie.

• 30 Oct 2026: Clarified where DigitalOcean and Vertex AI process data.

• 23 Oct 2026: Updated how we notify you about changes. Updated OpenRouter (now also used for slide design with Anthropic), Ably (now also used for exports and notifications), Zapier, OpenAI and Google, and added Cal.com. Updated Vertex AI, Runware, Pusher, Cloudflare, Sentry, PostHog, Stripe, Brevo, Meta and OpenAI Ads to match how we use them. Added Google Analytics, Senja, Serper, Firecrawl and Laravel Forge. Clarified that analytics and marketing cookies on our marketing website load when the page loads, and that PostHog session replay is on in the app.