Privacy

01Who we are, and which of us is responsible

Outclass Education Technologies Ltd (“Outclass”, “we”, “us”) provides a tutoring and teaching platform. Outclass and OxbridgeAI are trading names of the same company.

Which data-protection role we hold depends on how you reached us, and it matters because it decides who you go to about your data.

• Through your school or tutoring agency. Your school or agency is the data controller. They decide what is collected and why; we act as their processor and only on their instructions. Requests about your data go to them first. They can direct us, and we will act on it.
• Directly, as an individual tutor or student. We are the controller, and you can contact us directly using the details at the end of this page.

02What we collect

• Account details. Name, email address, and a password stored only as a salted scrypt hash, so we never hold your actual password. Optionally a profile image, school or organisation, and year of study.
• Learning activity. Questions attempted, answers given, marks, topic mastery, study plans and schedules, and when you were last active. This is the record the platform exists to build.
• Work you submit. Photographs or scans of handwritten working, and typed answers, so they can be transcribed and marked.
• Conversations with our AI. What you type to Marlow and our practice assistants, and what they reply. In school and agency workspaces these transcripts are retained so a teacher, tutor or safeguarding lead can review them. This is a deliberate safeguarding measure, not a hidden one.
• Technical data. A session cookie to keep you signed in, and server logs including IP address for security and troubleshooting.
• Website visits. When you visit our websites we count which pages are opened, for how long, and whether the visit ends in a sign-up or a demo request. We record the type of device (phone, tablet or computer). We do not record your IP address and we set no cookie for this. A visitor is recognised within a single day only, and visit records are deleted after 90 days.

03What we do not do

• We do not sell your data. Not to anyone, in any form, for any purpose.
• We do not use third-party analytics or advertising trackers. There is no Google Analytics, no advertising pixel, and no third-party tracking script in Outclass’s own app or websites. Product usage statistics are computed inside your own workspace. Websites opened in the university agent’s browser may use their own cookies and tracking.
• How model training is restricted. Google contractually commits not to use customer data to train or fine-tune its models without permission, and our handwriting-recognition provider is configured with model improvement switched off. We do not train models on pupil work. The university Grok connection described below has separate consumer terms and data settings; these Google assurances do not cover it.

04Where your data is stored

Our main application database and web servers are located in London, in Google Cloud’s europe-west2 region. The database is reachable only over a private network and only over an encrypted connection. The university agent’s separate cloud browser is described below and is not covered by this London hosting statement.

Each school and each agency gets its own separate physical database. Data belonging to one organisation is not stored alongside another’s.

05Where AI processing happens, stated plainly

This is separate from storage, and we would rather be exact than reassuring.

When the AI marks work or answers a question, that request is sent to Google’s Gemini service for processing. Usually it is text. For marked tests, past paper sittings and uploaded documents, it includes images of the pages, which can show a pupil’s handwriting. We currently use Google’s global endpoint, which means Google may carry out that processing in a data centre outside the UK. We cannot presently guarantee otherwise: the Gemini model we rely on is not offered in a UK region.

The next retention statement applies to the existing Google projects with our approved prompt-logging exception. Those requests are processed and returned, and are not used for training. Your records in our main application database stay in London throughout.

Google does not retain the requests we send. We hold an approved exception from Google’s prompt-logging for abuse monitoring, so prompts are processed and discarded rather than stored.

That exception is project-specific. It does not automatically cover a new university-agent project or another model provider.

Handwriting on the practice whiteboard is read into text by Mathpix, in the United States, and only that text goes on to Gemini.

06The university agent and your connected accounts

The university agent is optional and available only when enabled for your account. When you use it, Amazon Web Services (AWS) hosts a private cloud browser for you in London. You can sign into websites yourself in a private browser while the agent is paused. The browser can keep signed-in sessions between tasks. When saved sign-in is enabled, you may enter a platform username and password in a separate form. They are encrypted with a Google Cloud Key Management Service key managed by Outclass and stored with your account in our London database. Sign-ins saved before 3 November 2026 remain in a dedicated 1Password vault managed by Outclass until you remove or replace them. Our backend decrypts them only to fill supported sign-in forms on the exact website you selected. They are not added to chat, the agent’s memory or its model prompts. You complete multi-factor authentication and CAPTCHA yourself. Unsupported forms require the private browser.

We store your agent messages and replies, task progress, connection addresses, saved source text, personal notes and practice scores (the topic, how many answers were right and when) in your Outclass workspace. Relevant conversation history, notes, practice scores and text read from connected pages are sent to the agent’s configured model provider to answer your request. When you practise a course topic, the saved text of that topic’s sources, including files you added yourself, is sent to the same provider to write the questions. Connected-page text can include email, calendar entries and course material. This browser access is separate from the Google and Microsoft API connections described below and can reach more than the files or calendar fields those connections allow.

University students admitted by invitation can use xAI’s Grok through our shared hosted CPA subscription proxy. Each student has a separate Outclass conversation, memory and browser workspace. Relevant prompts, conversation history, practice scores, connected-page text and saved course material reach xAI under the connected subscription’s consumer service terms and data settings. We do not promise that these requests are excluded from training or have zero retention. Google’s Vertex AI terms and prompt-logging exception do not cover this connection. A separately configured Gemini pilot uses a dedicated paid Gemini API key and its own paid-service terms. AI processing may take place outside the UK.

When public web search is enabled, your search query is sent to Brave Search. Public pages and connected websites receive the requests, form entries and actions made in their services, and their own privacy policies apply. Those websites may set cookies in your cloud browser.

In the University whiteboard, asking Marlow about a selection or the entire board sends an image of that working, relevant conversation history and any PDF you attach to the configured University model provider. Making flashcards from the board sends its image to that provider. Board conversations are saved with the note and removed when you delete that note. New PDFs you upload to your course Library are retained in their original form beside their extracted text so you can reopen their pages. Removing that Library file removes its retained original. The Research widget sends the query you enter to arXiv. The Wolfram Alpha widget sends the query you enter to Wolfram Alpha when its integration is configured, or when you follow its result link.

The agent can act autonomously in a connected account, including sending messages, submitting forms, deleting items and making purchases, without asking for confirmation in chat. Content on a website or in an email may mislead the agent into taking an action you did not intend. Connect only accounts you want it to use and review the results of important tasks.

Cancelling an active task or disconnecting a connection destroys the current cloud browser and its signed-in sessions. Cancelling does not remove saved sign-ins. Disconnecting revokes access to its saved sign-in, deletes it, removes saved source pages and clears agent conversation history. Removing a saved sign-in also closes the browser and cancels unfinished tasks. Saved notes and other source pages remain until you remove them or delete the agent workspace. Practice scores remain until you delete the agent workspace. Deleting the agent workspace or your Outclass account revokes saved sign-ins, requests their deletion, removes the stored agent data and destroys the browser. If a deletion could not be completed at once, your encrypted sign-in, or a recovery reference to it, can remain after account deletion until cleanup confirms it is gone. Encrypted copies that our servers can still decrypt remain in database backups until those backups expire, and 1Password’s recovery and backup retention can continue for sign-ins saved there. None of these steps reverses messages, submissions, deletions or purchases already made on another service, or removes copies held by that service or a model provider under its own retention terms.

07Who else processes your data

These are our sub-processors. Some are only engaged if your organisation switches on the relevant feature; we list them anyway, because “optional” still means your data reaches them when it is on.

• Google Cloud Platform. Hosting, database, encryption keys for university agent saved sign-ins (Cloud Key Management Service), and AI processing (Vertex AI / Gemini). United Kingdom for main application hosting and storage; see the sections above for AI processing and any separately configured university-agent model account.
• xAI (Grok). The university agent for students admitted by invitation. Receiving each student’s relevant prompts, conversation history, connected-page text and saved course material through the shared hosted CPA subscription proxy, under the connected subscription’s consumer terms and data settings. See the university-agent section above.
• Amazon Web Services (AWS). Optional. Hosting the university agent’s private cloud browser in London, including website content, browser cookies and signed-in sessions.
• 1Password. Optional. Holding platform usernames, passwords and approved website addresses that a university student saved before 3 November 2026, until they are removed or replaced. Outclass’s backend retrieves these credentials for supported sign-in forms in the student’s private cloud browser. This is an Outclass-managed vault, separate from any personal 1Password account. New saved sign-ins are not stored in 1Password.
• Brave Search. Optional. Receiving public web-search queries from the university agent when web search is enabled.
• Mathpix. Reading handwritten mathematical working into text. It receives an image of the working, or the pen strokes, and processes them in the United States, configured so submissions are not used to improve their service.
• Google Workspace. Sending email, such as sign-in verification, password resets and parent progress reports, and the alerts our team receives when someone sends us feedback.
• Microsoft. Optional. Importing files from OneDrive, exporting lesson plans to OneNote, putting lessons into an Outlook calendar, and returning marks to Microsoft Teams assignments, where a teacher or school connects a Microsoft account.
• Telegram, and Meta (WhatsApp). Optional. Delivering messages and progress reports between a tutor and a parent, where an organisation enables it.
• TutorCruncher. Optional. Synchronising scheduling and roster information for tutoring agencies that use it.
• Stripe. Processing card payments for the direct subscription. Card details are collected and stored by Stripe, not by us.

08Data from your Google account

This section describes our Google API connections. Signing into a Google website in the university agent’s cloud browser is separate and follows the browser access described above.

Signing in with Google gives Outclass your name, email address, profile picture and Google account ID. It does not by itself connect your inbox or files. Where Connect Google is available, students and teachers can separately choose one Google connection for Gmail, whole-Drive access, Calendar and relevant Classroom features. We explain these permissions before opening Google's consent screen. You can decline a permission, and the features that need it will remain unavailable. Existing Calendar and selected-file connections keep their narrower permissions until you choose to upgrade.

• Google Drive (drive.file). The selected-file permission lets you pick files in Google's file picker and import them into your Outclass library. This permission alone does not let us search the rest of your Drive. We keep a copy of each file you import, and its text, so your lessons can use it.
• Whole Google Drive (drive). If you grant whole-Drive access through Connect Google, you can search your Drive, read supported files and native document text, create files and edit text files from Outclass. Spreadsheet text export currently covers the first worksheet. These workspace tools do not save a copy of the search results or file contents in our database. Files you create or edit remain in Google Drive. Importing a file into your Outclass library is a separate action with the retention described above.
• Gmail (gmail.modify). If you grant Gmail access, you can search and read messages, create or update drafts, explicitly send a saved draft, and change a message's read state. These workspace tools do not save message bodies, search results or attachments in our database, and do not send them to an AI model. Drafts and sent messages remain in Gmail. We retain a request identifier for each attempted write until account deletion to prevent duplicate actions; this record contains no message content or recipient.
• Google Calendar (calendar.events). Lets Outclass put the lessons you schedule into the calendar you connect and keep them up to date. A private tutor’s lessons are titled with the student’s first name, for example “Lesson with Priya”. A school’s lessons are titled “Outclass lesson”, with no pupil’s name. We also read the other events in that calendar, so that your own calendar appears on your Outclass timetable and a lesson is never booked over a busy time. Outclass asks Google only for each event’s time, title, whether it shows you as busy or free, whether it repeats, who organised it, and the email address and reply of each person invited. We use those addresses only to recognise a lesson with one of your own students, and when you ask who an event is with, Outclass reads its guests’ names and addresses from Google at that moment. We keep each event’s times, title, whether it shows you as busy, and Google’s reference for it, and delete them 30 days after the event ends. Only you can see these events in Outclass, and they are never sent to an AI model. An event recognised as a lesson becomes that lesson: your student and their parents see its date, time and length, never its title or guests. Your answers about which events are lessons, and the links between lessons and their events, are kept until you disconnect the calendar. We never keep descriptions, locations, guest lists or meeting links.
• Google Classroom (classroom.courses.readonly, classroom.rosters.readonly, classroom.profile.emails, classroom.coursework.me, classroom.coursework.students, classroom.push-notifications). Optional two-way Classroom sync is available to school and university students and teachers where enabled. You choose which courses to link. Outclass checks linked courses in the background while they remain enabled and Google stays connected. Students can list their active courses; teachers can list or import their own classes, including the names and email addresses of students in a chosen roster. Teachers can explicitly publish approved Outclass-created native homework and edit its linked assignment title, instructions, deadline and maximum points. Students explicitly choose to attach files or links, turn in or reclaim their own linked submissions. Teachers explicitly save reviewed grades and return submissions. Work created in Google Classroom remains read only in Outclass. Native Outclass completion never automatically turns in a Classroom submission. Students see only assigned grades; teachers can see draft and assigned grades. While sync is enabled, we retain titles, instructions, deadlines, maximum points, provider IDs, submission states, attachment metadata, grades and pending reviewed actions needed for sync. Classroom sync itself does not send data to an AI model. Course withdrawal and disconnect retention are described below.

09Limited Use of Google user data

Outclass’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

We use Google user data only to provide the features you connected it for. We do not use it for advertising, we do not sell it, and we do not transfer it to anyone except as needed to provide those features, to keep the service secure, or to comply with the law.

Some features use AI. When one does, for example when a lesson plan draws on a file you imported from Drive, the relevant text, including data that came from your Google account, is processed by Google’s Gemini service on Vertex AI to produce the result you asked for.

We do not use raw or derived data received from Google Workspace APIs to develop, improve or train generalised or non-personalised AI or machine learning models, and we do not allow anyone we share it with to do so. Google’s terms for Vertex AI also prohibit Google from training its models on the data we send.

No person at Outclass reads your Google data unless you ask us to, such as for a support request, or unless security or the law requires it.

You can remove Outclass's access at any time from your Google Account's permissions page, at myaccount.google.com/permissions. Disconnect Google in Outclass deletes the encrypted reusable credential we hold for that connection, stops its Google calendar sync and removes its stored calendar data. The credential is also deleted when your Outclass account is erased. If you disable a Classroom course or disconnect Google, Outclass stops Classroom sync and removes the affected Classroom snapshots, submission copies and queued actions. We retain only the Google and Outclass IDs linking the same homework and a record of creation attempts until account deletion to prevent duplicates if you reconnect. Your native Outclass homework and teaching records remain under the usual retention rules, and Google copies remain unchanged. Disconnecting inside Outclass does not delete your Gmail messages or Drive files, and does not remove the grant from Google's permissions page. With an older narrow connection, disconnecting Calendar removes its permission from our record and keeps a credential still needed by Drive or Classroom. Files and classes already imported into Outclass stay until you delete them, or until your account or organisation is deleted as described below.

10Data from your Microsoft account

This section describes our Microsoft API connections. Signing into a Microsoft website in the university agent’s cloud browser is separate and follows the browser access described above.

Outclass asks for access to your Microsoft account only when you choose a feature that needs it. Connecting Outlook Calendar asks only for the calendar permission below. OneDrive and Outlook Calendar share one Microsoft connection, so disconnecting OneDrive inside Outclass disconnects Outlook Calendar too. Disconnecting Outlook Calendar stops its sync, and deletes the Microsoft access token we hold for you when OneDrive does not also use it. You can remove Outclass’s access at any time from your Microsoft account’s app permissions.

• Outlook Calendar (Calendars.ReadWrite). Lets Outclass put the lessons you schedule into your Outlook calendar and keep them up to date. It works with a work, school or personal Microsoft account. A private tutor’s lessons are titled with the student’s first name, for example “Lesson with Priya”. A school’s lessons are titled “Outclass lesson”, with no pupil’s name. We also read the other events in that calendar, so that your own calendar appears on your Outclass timetable and a lesson is never booked over a busy time. Microsoft sends Outclass each whole event, and Outclass uses only its time, title, whether it shows you as busy or free, whether it repeats, who organised it, and the email address and reply of each person invited. We use those addresses only to recognise a lesson with one of your own students, and when you ask who an event is with, Outclass reads its guests’ names and addresses from Microsoft at that moment. We keep each event’s times, title, whether it shows you as busy, and Microsoft’s reference for it, and delete them 30 days after the event ends. Only you can see these events in Outclass, and they are never sent to an AI model. An event recognised as a lesson becomes that lesson: your student and their parents see its date, time and length, never its title or guests. Your answers about which events are lessons, and the links between lessons and their events, are kept until you disconnect the calendar. We never keep descriptions, locations, guest lists or meeting links.

11Outclass in ChatGPT

We offer two ChatGPT plugins. Outclass for Students gives TMUA, ESAT, SAT and A-level Maths practice questions, marks answers and shows mark schemes, and has no sign-in. When ChatGPT uses it, we receive only what that tool needs: the exam, paper, part, content area, topic, level or difficulty you ask for, the ids of questions already shown, the answer you give, and the numbers and the main reason you give the timing diagnostic. We do not receive your name, email address, ChatGPT account or conversation.

Outclass for Teachers lets a teacher connect their own Outclass account to ChatGPT, after signing in to Outclass and approving it. Once connected, ChatGPT can see the teacher's class names and how many students are in each, find questions with answers, set homework for one of their classes when the teacher asks, and see how many students finished each homework. ChatGPT never receives pupils' names, work or marks through it.

For each teacher connection we keep a record of who approved it, when, and when it was last used, so ChatGPT can stay signed in. It holds no password and no usable token, only a one-way check value. It stops working when the teacher disconnects or after 30 days without use, and it is deleted with the teacher's account.

ChatGPT may also attach a general location, your language and an anonymous identifier to each request. We do not read, log or store them.

We use these details only to return the question, feedback or homework you asked for. We do not build a profile from them or share them with anyone. When an A-level answer is marked, ChatGPT marks it against our mark scheme, so your working stays in your ChatGPT conversation and is never sent to us.

To count usage, each request leaves one log line with the tool used, its result (for example whether an answer was right), the exam and section, and whether a topic was asked for, but not the question, your answer or your numbers. Our hosting also logs the address each request came from, which for ChatGPT is one of ChatGPT's own servers, for security. All of these logs are deleted after 30 days.

You can stop at any time by disconnecting the plugin in ChatGPT. What ChatGPT itself does with your conversation is covered by ChatGPT's own privacy policy.

12How long we keep it

• While your account is open. Your learning record is kept so the platform can track progress over time. That is the point of it.
• When your account is deleted. Your personal data is erased, not archived or hidden. That includes your profile, your AI conversation transcripts, your practice and homework answers, and your stored preferences. Some records are not yet removed automatically, such as marked test scripts and some progress records. If you ask us, we will erase those too, within one month.
• When an organisation leaves. Their entire database is deleted, which removes every record belonging to them and their users.
• Parent messaging setup. A pending parent-pairing record is held for at most 75 minutes and then deleted automatically.

13Children and young people

Most of our students are aged 13 to 18, and some are younger. We design for that.

We apply the principles of the Information Commissioner’s Age Appropriate Design Code: we collect only what the service needs, we do not profile children for advertising, we use no engagement-maximising or manipulative design patterns, and we do not build behavioural advertising profiles.

Our school and exam-preparation AI assistant additionally refuses to store sensitive personal information a student mentions in conversation, including anything relating to health, wellbeing, additional needs, beliefs, identity or safeguarding. Such statements are excluded from the memory that assistant builds. The university agent’s saved source text and personal notes are described above.

Where the platform is provided through a school, the school is responsible for the lawful basis for a child’s use of it, including any consent required.

14How we protect it

• Separation. A separate physical database per organisation, with access enforced in code rather than by query filters.
• Encryption. Encrypted in transit, and encrypted at rest by the database. Third-party access tokens are additionally encrypted with AES-256-GCM.
• Passwords. Outclass account passwords are stored as salted scrypt hashes and compared in constant time. We cannot recover your Outclass account password. Saved platform sign-ins for the university agent are recoverable credentials, encrypted and stored as described above.
• Sessions. Session cookies are HTTP-only and, in production, restricted to encrypted connections.
• Sign-in. Sign in with Google or Microsoft, so your organisation keeps control of the account.

15Your rights

Under UK data protection law you may ask for a copy of your data, ask us to correct it, ask us to delete it, object to or restrict how it is used, or ask for it in a portable form.

School accounts are managed by the school. Ask your school administrator to arrange account deletion. Individual and tutoring-agency accounts can be deleted from account settings. If your school or agency is the controller, send data-protection requests to them. We support them in responding.

We respond within one month. If you are not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk.

16Data breaches

If a breach occurs affecting personal data, we notify affected organisations without undue delay and within 72 hours of becoming aware, with what we know, what we are doing, and what they may need to do. Where we act as processor, we notify the controller so they can meet their own reporting duties.

17Changes to this page

When this policy changes materially we update the date at the top and, where the change affects how organisations’ data is handled, tell them directly. We do not make changes retrospectively quiet.