Skip to content

Privacy notice

Last updated 16 September 2026

Who runs EdTechCore

EdTechCore is an independent, non-commercial project. It is not run by a registered company: it is built and paid for privately while it is being tested, and it charges nothing for access. If that ever changes and the project becomes a commercial service, a company will be formed, this notice will name it with its registration details, and it will say so before anything is charged. Until then the person who operates EdTechCore is the data controller under the GDPR, and the way to reach them is admin@edtechcore.com.

What this notice covers

The public site and the workspaces you sign in to. What is stored on your own device has a page of its own, the cookie policy, and the two are meant to be read together.

What is collected, and why

Only what the service needs in order to work:

The legal bases are the agreement under which the service is provided to you or to your school, our legitimate interest in keeping it running and secure for the technical records, and a legal obligation where accounting rules require a record to be kept.

Consent, and where you give it

These forms ask for it in as many words: the request form on the site's pages, the partner application on the partner site, and the form that creates an account from an invitation. The box is never ticked for you and the form does not send without it, and what you agree to is written beside it - that what you type is processed for that purpose and no other. The server refuses a request without it too, and records the moment you agreed with the request, the application or the account, so that the agreement can be shown if it is ever questioned. Consent is not the basis for everything here: your account and the work inside it are processed to provide the service, as set out above. A consent you gave can be withdrawn at any time, and withdrawing it does not make unlawful what was done while it stood.

What teachers and schools put here

Most of what lives in EdTechCore is put there by teachers and schools, not by us. A school decides who has an account, what its courses contain and what it records about its students; for that material the school is the controller and EdTechCore processes it on the school's instructions. If you are a student, a question about your own record is usually answered fastest by your school or your teacher - write to us anyway if you prefer, and we will pass it to the right place and tell you that we have.

Advertising, analytics and tracking

There are none. EdTechCore runs no analytics, sets no advertising cookies, builds no profiles and shares nothing with an advertising network - not on this site and not in the workspaces. That is a statement about today, not a promise about forever: the project may later want to measure how the product is used, or to reach new people through advertising. If it does, this notice and the cookie policy will be updated before anything is switched on, the cookie notice will ask instead of telling, and nothing beyond what the service needs will be stored on your device unless you agree to it. Refusing will not cost you access.

What we do not do with it

EdTechCore processes personal data to provide the service to you and to your school, and for nothing of its own. It does not sell it, rent it or hand it to anyone for their own purposes; it does not use it for advertising or profiling; it does not train models on it; and nobody reads the work in a workspace except to run the service, to answer a request you make, or to act on a report. AI help sees only what its job needs. When a teacher drafts material with it, that is the material the teacher hands it. When a teacher sets a task answered in the student's own words to be checked by AI, and the platform has that check switched on, it is the student's answer to that task, from which the AI drafts a score and a line of feedback that wait for the teacher. The request runs on a key the teacher has lent from their own account with the provider, or otherwise on the provider the service is configured with.

Who else is involved

A few other companies are needed to run the service. Some of them are based outside the European Union, mainly in the United States; data reaches them under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Each one sees only what its job requires:

How long it is kept

Account and course data stays while the account and the workspace exist. When you ask to be forgotten, the account is deleted outright if nothing else refers to it; where a record must be kept by law - an invoice, a payment, a mark - the record stays, and everything in the account that identifies you is removed, so the record explains itself without naming you (Article 17(3)(b) GDPR). A request from the site's form that was never followed up, a partner application, and an invitation that expired or was withdrawn, are deleted after a set number of days. A file attached to a message or handed in outside a marked answer is deleted after a set period; a marked answer keeps its file as the record of the work. The trail of who did what is kept for at least twelve months and then pruned. Accounting records are kept for as long as the law requires. Server and access logs are kept for a short period and then discarded. Backups are rotated, so something deleted from the live service can survive briefly in a backup before it goes with it.

Keeping it safe, and the limits of that

Traffic is encrypted in transit, passwords are stored only as hashes, the most sensitive fields are encrypted at rest, every account reaches only what its role opens, sensitive actions in the console need a second sign-in, and backups are taken regularly. None of that is a guarantee. Hardware fails, software has defects and a determined attacker sometimes succeeds; no service can honestly promise that data will never be lost or never reached by someone who should not have it, and to the maximum extent permitted by applicable law EdTechCore gives no such warranty. Keep your own copy of anything you cannot afford to lose. What the law does require of us we do: if a breach happens that puts people at risk, we will say so - to those affected and to the supervisory authority - within the time the GDPR sets, and your right to compensation for damage caused by processing in breach of the GDPR (Article 82) is not affected by anything on this page.

Your rights

You can ask what personal data is held about you, have it corrected or erased, restrict or object to how it is used, receive a copy in a portable form, and withdraw any consent you gave. Write to admin@edtechcore.com and we answer within one month. Erasure works as the section on retention describes: the account goes, and a record the law requires us to keep stays without your name on it. If the data belongs to a school's workspace we may have to pass the request to the school, and we will tell you when we do. You also have the right to complain to a data protection authority.

Children

Schools and teachers use EdTechCore to teach people of any age, children included. A child's account is created by their school or their teacher, and it is the school that must have the standing to do so under the rules that apply to it. We do not seek children out, and there is no advertising and no profiling here for anyone.

Automated decisions

None that affect anyone legally. Marking is deterministic: the same answer scores the same way every time. AI never decides a mark. It helps a teacher draft material, and where a task answered in the student's own words is checked by AI, it drafts a score that counts for nothing until the teacher confirms or changes it.

Changes to this notice

When what the service does with personal data changes, this notice changes with it and the date at the top moves. Anything that needs your agreement will be asked for, never assumed.

The limits of this page

This is a plain description of how the service works, written to be understood rather than to sound impressive. It is not legal advice and it takes away no right the law gives you. The companies named above run their own services under their own terms.

Read the terms of use Read the cookie policy Back to the home page