Platform Privacy Policy

Inkling is a trading name of GGTW Education Limited (“we”, “our” or “us”). This Privacy Policy explains how we collect, use, and protect personal data when you use the Inkling AI tutoring platform (“Platform”).

This policy applies to students, teachers, school staff, and (where relevant) parents or guardians using the Platform.

1. Who we are
   GGTW Education Limited (trading as “Inkling”)
   Registered in England and Wales under company number 16609200
   Registered address: 167-169 Great Portland Street, 5th Floor, London, UK, W1W 5PF
   Contact: via our website contact form at https://myinkling.ai/
   
   

2. Our role

   • School deployments:
     The school is the Data Controller.
     Inkling acts as a Data Processor on the school’s behalf.

   • Direct-to-consumer:
     Inkling acts as the Data Controller.

   We only process data according to our contractual obligations and instructions where acting as a processor.
   
   

3. Data we collect
   We may collect and process the following personal data:
   
   a) Account and identity data

   • Name, email address, role (student, teacher, parent)

   • School affiliation and class/group information

   b) Educational data

   • Subjects studied, curriculum/exam board selection

   • Progress data, performance metrics, usage history

   c) Tutoring session data

   • Conversation transcripts (text and/or voice interactions)

   • Responses generated during tutoring sessions

   • Derived insights (e.g. strengths, weaknesses, knowledge gaps)

   d) Safeguarding data

   • Flags generated from monitoring interactions

   • Associated transcript excerpts where a safeguarding concern is identified

   e) Technical data

   • Device information, IP address, browser type

   • Session logs and platform usage data

   f) Support and communication data

   • Messages sent to support or via the platform
     
     

4. Special category data
   We do not intentionally collect special category data (e.g. health, religion).

   However:

   • Students may disclose sensitive information during conversations.

   • Where this occurs, processing is limited and safeguarded.

   • Safeguarding alerts may be generated where appropriate.
     
     

5. Children’s data:
   Our services are intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, please contact us so we can delete it.
   
   

6. How we use your data
   We use personal data to:

   • Deliver AI tutoring sessions

   • Personalise learning and adapt content

   • Track progress and provide insights to students and schools

   • Maintain platform security and performance

   • Detect and respond to safeguarding concerns

   • Provide support and resolve issues

   • Comply with legal and regulatory obligations
     
     

7. Legal basis for processing
   Depending on context:

   • Contract – delivering the tutoring service

   • Legitimate interests – improving the platform, ensuring safety

   • Legal obligation – safeguarding and compliance

   • Consent – where required (e.g. marketing, certain direct users)
     
     

8. Safeguarding
   We monitor interactions to identify potential safeguarding risks.

   • Alerts may be generated automatically

   • Relevant excerpts may be shared with the school’s safeguarding lead (DSL)

   • Teachers do not have general access to student transcripts by default

   This is designed to balance:

   • student privacy

   • safeguarding responsibilities
     
     

9. Automated processing and AI
   The Platform uses AI systems to:

   • generate tutoring responses

   • analyse student understanding

   • personalise learning pathways

   This involves automated processing, but:

   • it is used to support education, not make legal decisions

   • meaningful human oversight exists (e.g. teachers, DSLs)
     
     

10. Data sharing
    We share data only where necessary with trusted service providers, including:

    • Cloud hosting and databases

    • Authentication providers

    • Real-time communication infrastructure

    • Analytics providers

    • Email delivery services

    We require all providers to:

    • process data securely

    • comply with UK GDPR

    • act under contractual obligations

    We do not sell personal data.
    
    

11. International transfers
    Some providers operate outside the UK/EEA.

    Where this occurs, we ensure appropriate safeguards, including:

    • Standard Contractual Clauses (SCCs)

    • UK International Data Transfer Addendum

    • Data Privacy Framework (where applicable)
      
      

12. Data security
    We implement appropriate technical and organisational measures, including:

    • Encryption in transit (TLS) and at rest

    • Role-based access control and least privilege access

    • Multi-factor authentication for privileged access

    • Logging and monitoring of system activity

    • Regular security reviews and testing

    Access to personal data is restricted to authorised personnel only.
    
    

13. Data retention
    We retain data only as long as necessary:

    • Account and educational data: for the duration of use + limited retention period

    • Tutoring transcripts: retained to support learning and safeguarding, unless deleted earlier

    • Safeguarding data: retained in line with legal and school requirements

    Schools may request deletion of data at any time.
    
    

14. Data subject rights
    Individuals have the right to:

    • Access their data

    • Correct inaccurate data

    • Request deletion

    • Restrict or object to processing

    • Data portability (where applicable)

    For school users, requests should normally be made via the school (Data Controller).

    Complaints can be made to the ICO: www.ico.org.uk
    
    

15. Sub-processors

    We use sub-processors to deliver the Platform.

    A current list is available on request and may include:

    • cloud infrastructure providers

    • authentication providers

    • analytics and monitoring tools

    We ensure all sub-processors:

    • meet appropriate security standards

    • are bound by contractual data protection obligations
      
      

16. Incident management
    We maintain a documented incident response process.

    In the event of a personal data breach:

    • we will notify affected schools without undue delay

    • and within 72 hours where required
      
      

17. Changes to this policy

    We may update this policy from time to time. The latest version will always be available on our website.
    
    

18. Contact

    For any privacy-related queries, please contact us via: support@myinkling.ai