Privacy notice for schools and advisers
Approved by the company's solicitor, 28 September 2026; party details updated 28 September 2026; the additions and settled points of 6 October 2026 approved by the company's solicitor that day; the changes of 22 October 2026 published on the founder's own approval and sent to the company's solicitor for review. Prepared 28 September 2026 from the code and docs/DATA_PROCESSING_RECORD.md; brought up to date on 7 October 2026 with the solicitor's approved wording of 6 October 2026; and on 22 October 2026 for pupils' names, sign-in, comments, messages, kept drafts and questions made from a pupil's own work.
From the approved document 04, Privacy notice for schools and advisers. Left out here: the paragraph headed "For the solicitor".
How Delta Research Group uses the information of the staff who use Delta, and what it does with pupils' information for schools.
Who we are
Delta Research Group Ltd (company number 17324839, registered office 127a Westbury Road, Bristol, England, BS9 3AP). Contact: privacy@deltaconsole.com.
Delta Research Group Ltd is registered with the Information Commissioner's Office under registration number ZC270883.
Advisers: what we hold and why
| Information | Why | Lawful basis | How long |
|---|---|---|---|
| Work email address | To sign you in and send invitations | Legitimate interests: running the service your school uses | While your school uses Delta; after removal it stays on the disabled account so notes keep an author, until the school's account is erased |
| Role (lead or adviser) and status | To decide what you can do | Legitimate interests | As above |
| Password, if you set one | Optional sign-in; stored only as an argon2 hash | Legitimate interests | Until changed or the account is erased |
| Two-step sign-in, if it is turned on | Advisers can protect their account with two-step sign-in using an authenticator app, and a school's lead adviser can make it compulsory. Delta keeps the app's shared secret encrypted, and recovery codes only in a form that cannot be turned back | Legitimate interests | Until it is turned off or reset, or the account is erased |
| Where you are signed in | For each signed-in session Delta keeps when it began, when it was last used and a short description of the browser (for example "Chrome on a Mac"), so that you can see where you are signed in and sign out everywhere else. Delta keeps no internet address with a session | Legitimate interests | Deleted when the session ends: after 2 hours without use, after 7 days at most, or when you sign out |
| Sign-in records and audit entries | Security and accountability; identifiers and outcomes only | Legitimate interests | Audit entries have no automatic limit yet (see 07) |
| Invitation | To let you join | Legitimate interests | 7 days if not accepted |
| A name shown to pupils, if you set one | Shown to pupils on your comments and messages, and to colleagues beside your email address; without one, pupils read "your adviser" | Legitimate interests | Until changed or the account is erased |
| Comments you write on a pupil's work | The school's record of its support. Each comment is marked as shared with the pupil or kept among the school's staff, and all of them are disclosed to the pupil on request | Legitimate interests | With the pupil's place |
| Messages between you and a pupil | Seen by all the pupil's advisers and the school's safeguarding lead; each message a pupil sends is read once for a wellbeing concern; nothing is edited or deleted once sent | Legitimate interests in pupil support and safety, shared with the school | With the pupil's place; a message that raised a concern is kept in the school's safeguarding record |
How sign-in is protected
No account can be tried more than 10 times in 5 minutes. Sessions end after a period without use: 2 hours for an adviser, 1 hour for a pupil, whose session also ends when the browser is closed. A pupil never needs a phone or an email address to sign in.
Safeguarding leads
Delta holds the name and email address of each school's safeguarding lead, entered by an administrator, so that a wellbeing concern in a pupil's writing reaches a person. The email carries a place label, a username, a date and the few words flagged, with the pupil's name taken out, and a link that needs a sign-in; never the pupil's name or wider text. The address is kept while it is recorded and erased with the school. Where a school gives its safeguarding lead an account in Delta, Delta holds that account as it holds an adviser's, so that the lead can read messages between pupils and staff, deal with wellbeing holds and keep the school's safeguarding record, which holds every concern Delta raises and is deleted with the school. Lawful basis: legitimate interests in pupil safety, shared with the school.
Pupils' information, which we handle for schools
Where a school's advisers enter a pupil's name, Delta holds it so that advisers see their pupils by name. Names are encrypted at rest with a key held outside the database, shown only to the pupil, the school's own advisers and its safeguarding lead, never put in an email, a log, a crash report or a request to an AI provider, and deleted with the pupil's place. Each pupil also has a username of three words and a label such as A-001, which are what Delta's emails and records use. What is held, why, where it goes and how long it is kept is in the data processing agreement (schedules 1 to 3) and in the notice for pupils (03).
Who else receives information
| Sub-processor | What it does for Delta | What it receives | Where | Notes |
|---|---|---|---|---|
| Render Services, Inc. | Hosting of the web service, the three scheduled jobs and the PostgreSQL database | Everything Delta holds; pupils' names only in encrypted form | Frankfurt region (EU), set in render.yaml | US company. Point-in-time recovery copies kept for 3 or 7 days depending on the workspace plan; logical exports kept 7 days (render.com/docs/postgresql-backups, read 27 September 2026). Render's data processing addendum supplements its terms of service (render.com/dpa, read 7 October 2026). Transfer safeguard: the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge). |
| Resend | Sign-in and invitation emails to advisers; the safeguarding email to a school's safeguarding lead; a notice to staff that a message is waiting; the daily operations email to Delta's operator | An adviser's email address and sign-in link; or a place label, a username, a date and the minimal flagged passage with the pupil's name taken out; a notice that a message is waiting, with no name and no words from it; the daily email carries counts and internal identifiers only | The region set for Delta's sending domain at Resend | US company. Transfer safeguard: the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge). |
| Sentry (Functional Software, Inc.) | Crash reporting, only if SENTRY_DSN is set | Scrubbed error events: an error's type and where in the code it happened, never its words; no request data, cookies, headers, query strings, local variables, labels or usernames | Sentry's EU or US servers, depending on the address Delta's reports are sent to | US company. send_default_pii=False, include_local_variables=False. Transfer safeguard: the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge). |
| Mistral AI SAS | Personal statement feedback, interview practice turns and feedback, choosing passages for practice questions from a pupil's own work, and the narrow wellbeing check on pupils' writing (including reading log entries, notes on tasks and messages), only for a school whose feature has been switched on | The pupil's statement answers, interview transcript, reading log entry, task note or message, with the pupil's own name replaced by "[name]" and any email address or telephone number taken out, and with the authored question context; never the place label, username, adviser or school | EU endpoint https://api.eu.mistral.ai only (France) | Zero data retention arranged directly with Mistral and confirmed by the founder on 27 September 2026 (founder's statement; the written confirmation is held by the founder). |
| AssemblyAI, Inc. (recommended) or Speechmatics (Cantab Research Ltd) | Turns one spoken interview answer into text, only for a school whose interview practice is on and only when a pupil chooses to speak | One recording of one answer, with no place, school, adviser or question context; the text that comes back has the pupil's own name replaced before it goes anywhere else | AssemblyAI EU endpoint api.eu.assemblyai.com ("data stays in the EU"); or Speechmatics EU1 eu1.asr.api.speechmatics.com | Only one is configured in a deployment. Delta deletes the provider's job before the same request returns. AssemblyAI does not use files sent to its EU servers for model training; Speechmatics' standard terms (clause 10.3) license transcripts for improving its software, which is why AssemblyAI is recommended. Transfer safeguard for AssemblyAI, a US company: the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge). Speechmatics is a UK company. |
Transfers outside the UK
Delta is hosted in the EU. Several providers are US companies (Render, Resend, Sentry and AssemblyAI). The safeguard for each is the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge): each is certified under it (the Data Privacy Framework list, read 7 October 2026), and each one's own terms fall back on the International Data Transfer Addendum to the EU standard contractual clauses if that ever ceases to apply.
Your rights
You can ask for a copy of your information, ask for it to be corrected or deleted, object to its use, or ask us to restrict it, by writing to the contact above. You can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
Delta sets only strictly necessary cookies: one that keeps you signed in, one that protects forms, one that lasts 10 minutes between your password and your two-step code, and one that lasts 15 minutes while you reset a password. No analytics or advertising cookies.