Privacy Policy

Who we are and how to contact us

LessonBrief ("we", "us") is an independent, privately run service that helps tutors and small education providers turn lesson notes into draft messages and documents. This policy explains what personal information we handle, why, and the rights you have. It is written in plain English on purpose.

For everyday account information — such as the email you sign in with — we are the "data controller". For the lesson content you enter about your students, you are the controller and we act as your "processor"; see "Your students' data: your role and ours" below.

The best way to reach us about anything in this policy — including to access, export or delete your data — is by email at lessonbrief@proton.me. We are based in the United Kingdom, and this service is provided under the laws of England and Wales.

The information we collect

• Account details: the email address you sign up with, and an optional display name. Where bot-protection is switched on, a one-time challenge is checked when you sign up.
• Content you enter: student labels (we ask for initials or a nickname, never a full name), subjects, year groups and other coarse teaching context, your lesson notes, the drafts we generate, any ratings or notes you add, your saved templates, and lessons you log or schedule.
• Technical and security data needed to run the service safely: a sign-in cookie, rate-limiting counters, and minimal server logs. Where error reporting is switched on, we receive scrubbed, privacy-filtered diagnostics that deliberately exclude your content (see the providers section below).

How we use your information, and our legal bases

We use your information only to provide and protect the service — to create drafts from your notes, keep a per-student history for you, let you sign in, prevent abuse, and fix faults. We do not sell your data, and we do not use it for advertising or to build a profile of you.

Under UK data protection law (the UK GDPR and the Data Protection Act 2018), our legal bases are:

• Contract: to give you the account and features you sign up for.
• Legitimate interests: to keep the service secure, prevent abuse, understand and fix errors, and improve how it works — balanced against your rights.
• Consent: where we ask for it specifically (for example, if an optional feature that needs it is introduced). You can withdraw consent at any time.
• Legal obligation: where we must keep or disclose information to comply with the law.

How your drafts are produced

Right now, every draft is produced by a template engine that runs on our own server. Your notes are not sent to any third-party AI provider to create a draft, and nothing you type is used to train any AI model.

The product is designed to work this way by default. If an optional AI mode is ever switched on in future, the notes and details you submit for a specific draft would be sent to our AI provider solely to generate that draft, the provider would be instructed not to train on your content, and we would update this policy and tell you before that change takes effect.

Every output is a draft for you to read, edit and approve before you send it, and the system is designed never to invent facts that are not in your notes.

Please do not enter sensitive information

To protect the young people you work with, use initials or a nickname rather than a full name, and do not enter special-category or sensitive personal data — for example health information, a diagnosis or special-educational-needs assessment, contact details, or anything a parent would not expect you to type into an admin tool. The app is deliberately not built to store this kind of information, and you are responsible for the content you enter.

Your students' data: your role and ours

When you enter information about a student, you decide what to record and why, so in data-protection terms you are the controller of that information and we are your processor: we handle it only to provide the service to you, on your instructions. You are responsible for having a proper lawful basis for processing a child's data — usually your tutoring arrangement with their parent or guardian — and for keeping what you enter to a minimum.

Our separate Data Processing Terms set out this relationship in more detail and form part of your agreement with us.

Who else processes your data (our providers)

We keep our list of suppliers short and use them only to run the service. Each one acts under a contract that requires it to protect your data:

• Supabase — our database and sign-in provider; stores your account and the content you enter.
• Vercel — hosts and runs the application and its server functions, and processes basic request logs.
• Cloudflare — provides the optional bot-check on the sign-up form (it processes a challenge token and your IP address at that moment to tell humans from bots).
• Sentry — where error reporting is switched on, receives scrubbed, PII-free diagnostics (an error type, a short code, the page pattern and code locations) to help us fix faults; it never receives your notes, drafts, messages or cookies, and its data for us is hosted in the EU.

Selling and sharing

We do not sell your personal data, and we do not share it with anyone for their own marketing. We would only disclose data if the law required it, to protect the service or people's safety, or as part of a change of ownership — in which case your data would stay protected by terms at least as strong as these.

Storing data outside the UK

Some of our providers may store or process data outside the United Kingdom. Where they do, that transfer is covered by appropriate safeguards — such as the UK's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, or an equivalent approved mechanism — so your data keeps a similar level of protection. You can ask us for more detail at lessonbrief@proton.me.

How long we keep your data

We keep your account and the content you enter for as long as your account is open — you decide what to keep, and you can delete any of it, or your whole account, at any time from Settings. When you delete something, or delete your whole account, it is removed from the live service and related records are deleted with it.

Short-lived technical and security data (such as server logs and rate-limiting counters) is kept for a limited period — normally no longer than 12 months — and then deleted. Where encrypted backups are taken, data you have deleted is overwritten as those backups are rotated, normally within 30 days.

How we protect your data

• Every account's data is isolated at the database level using row-level security with a default-deny rule, so one user cannot see another's data.
• Data is encrypted while it travels to and from the service.
• Secret keys are held on the server and are never exposed to your browser.
• We apply rate limits and optional bot-protection to reduce abuse.

If there is a data breach

We take steps to prevent security incidents, but no service can promise they will never happen. If a breach affects the personal data for which we are the controller (such as your sign-in email) and the law requires it, we will notify the UK's Information Commissioner's Office within 72 hours of becoming aware, and tell affected users without undue delay. Where you are the controller of your students' data, our Data Processing Terms explain how we support you if a breach affects that data.

Your rights

Under UK data protection law you have the right to access, correct, delete, restrict or object to our use of your personal data, and to receive a copy of it in a portable format. We have built the main ones in, so you do not have to wait for us:

• Export: download all of your data as a JSON file at any time from Settings.
• Delete: permanently delete your account and all associated data from Settings.
• Anything else — correction, restriction, objection — email us at lessonbrief@proton.me and we will respond within the time the law allows (normally one month).

Complaints

If you are unhappy with how we handle your data, you can complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk — though we would appreciate the chance to put things right first.

Cookies

We use only the cookies that are strictly necessary to run the service, such as keeping you signed in — no advertising or tracking cookies. Our Cookie Policy explains them in full.

Children

This service is for adult tutors and education providers; it is not directed to children, and children should not create accounts. Information about a child reaches us only if a tutor chooses to enter it, in the minimal, initials-only form the app encourages — see the sensitive-information section above.

Changes to this policy, and contact

We may update this policy as the service develops. If we make a material change, we will tell you in the app or by email before it takes effect. Minor or legally required updates take effect when we post them, and the date at the top always shows the latest version. For any question, or to exercise a right, email lessonbrief@proton.me.