How Atlas Study looks after your data

Who we are

Atlas Study is a service of EDS Education Ltd, a company registered in England and Wales with company number 11334874. EDS Education Ltd is the data controller for Atlas Study when you use our direct consumer services, parent services, billing, support, public website, and Atlas Review/Live services. That means we decide why and how personal data is used for those parts of Atlas Study.

Where a school provides or controls learner data, the school will usually be the data controller and EDS Education will usually act as the school's processor under written instructions or a data processing agreement. This controller/processor posture is reviewed before school launch claims expand.

Sahil Ahmad is the Atlas Study privacy lead and data-protection contact. Atlas Study does not currently claim a formal DPO appointment. You can contact us about privacy at support@edseducation.com.

What we collect

• Account details, such as name, email address, role, and age band.
• Learning data, such as subjects, progress, answers, marks, notes, and flashcards. Teacher-assigned homework is School-context data only.
• In a class test, or homework your teacher set with Focus mode: when you leave the page and for how long, and when you stop for a few minutes (not in a test you answer on paper). In a class test, also how fast a long typed answer appeared (a word count and seconds, never what you typed or your keys). Only the teacher who set the work sees it.
• In homework while your teacher runs live work: when you leave the homework page and for how long. Only your teacher sees it.
• When a pupil sits a test on Atlas, we keep how long they spend on each question; only the teacher who set the test, or a teacher who takes over the class, sees it, and it is deleted with their answers to that test.
• Personal family links and, separately, School memberships, classes, and invitation status where those contexts apply.
• Messages sent in Atlas Study between school staff, parents and carers, and pupils, including any files sent with them.
• Billing records for paid plans, handled through Stripe.
• Security records, such as sign-in activity and audit logs.
• Cookie and consent-audit records, including choices, consent-session identifiers, user agent, and hashed IP address.
• Review/Live learning records, credit state, tutor-support records, and recording notices where those services are enabled.

Personal and School separation

A Personal learner does not need a school, organisation, class, or teacher. Personal pages do not use School homework, messages, reports, behaviour, attendance, classes, or teacher controls. People who have both contexts choose the active context before Atlas loads context-sensitive navigation, entitlement, learning, AI, billing, or analytics data.

A linked Personal parent can receive appropriate progress, activity, strengths, and next-step information. Raw AI conversations, private learner notes, and wellbeing answers are not automatically shared with parents. School information is available only after explicitly entering an authorised School context.

Why we use it

• To create and protect your account.
• To provide tutoring, practice, marking, and revision.
• To show progress to students and, where permitted, to parents, guardians, teachers, or school staff.
• To process subscriptions, invoices, refunds, and plan access.
• To meet legal, security, accounting, and consumer-rights obligations.
• To improve Atlas Study where you have allowed optional analytics cookies.

Legal basis

We use different legal bases depending on the data and purpose: contract for providing the service you sign up for, legal obligation for accounting records, legitimate interests for security and service improvement, and consent for optional cookies and some communications.

Who can see it

Students can see their own account and learning data. Parents, guardians, teachers, school coordinators, and Atlas Study administrators can see only the parts of the service their role needs. AI chat transcripts and wellbeing data are not shared with parents or guardians through Atlas Study parent visibility controls.

School statutory records, raw report files, AI provider internals, and sensitive support records need a manual privacy review before they are shared or exported.

Personal wellbeing, voice, and uploaded work

The answer stays in this browser tab for the current session and is not written to the Atlas database. The Personal check-in is optional, is not a School record, and is not shown through parent controls.

Voice Tutor asks for microphone permission for each session. The browser or device may provide speech recognition. Atlas receives the resulting text and stores it in the learner's private tutor conversation; Atlas does not store raw audio.

Atlas checks the declared type, size, and matching file signature. Atlas does not run a dedicated malware scanner, so do not upload executable or untrusted files. Written-work uploads use a published retention deadline and deletion workflow. Private Image Analysis sources remain in the learner's source library until the learner deletes them or an applicable account-retention process removes them.

Suppliers we use

We use trusted suppliers to run Atlas Study, including Supabase for database, authentication, and storage; Stripe for payments; OpenAI and Anthropic (Claude) for AI features such as Ask Atlas and reading uploaded papers; Resend for email, including sending message emails to parents and staff that contain the message text; Vercel for hosting and analytics tooling; Google for Sign in with Google and for importing class lists from Google Classroom when a school uses it; and GitHub for private code hosting. Some suppliers may process data outside the UK. Where that happens, we rely on appropriate transfer safeguards.

Resend stores its delivery records of the emails it sends (not their content) in the United States. We rely on the Standard Contractual Clauses and the UK International Data Transfer Addendum in Resend's data processing agreement for that transfer.

We review subprocessors and providers before new live uses, especially where children's data, AI/OCR processing, email, payments, storage, or school records are involved.

Emails about messages

When someone sends you a message in Atlas Study, we can email you to let you know. Emails to parents, carers and school staff include the message: who sent it, its subject and its text (long messages are cut short). An email to a teacher about a pupil's message includes the pupil's name and what they wrote. Files sent with a message are never attached; the email only says there is one. Emails to pupils never include the message.

Once an email reaches your inbox it is kept by your email provider, not by us. You can switch these emails off at any time with the link at the bottom of each email or in your settings, and a school can switch them off for everyone at that school.

How long we keep it

We keep account and learning records while the account is active. We keep billing and audit records for as long as we need them for legal, dispute, and accounting reasons. We delete or anonymise data when it is no longer needed.

Our email supplier does not keep the content of the emails it sends; it keeps only delivery records (such as the address, the time and whether the email arrived) for 30 days.

Records of when you left a homework page are deleted after the end of the school year they were made in.

Atlas Study does not check messages for safety concerns.

Review/Live recordings, if enabled, have a 28-day default retention target unless a dispute, legal, billing, or regulatory hold applies.

Your rights

You can ask for a copy of your personal data, ask us to correct inaccurate data, ask us to delete data, object to some uses, limit some uses, or ask for data portability. Children have data protection rights too, and we will handle requests in an age-appropriate way.

A request for a copy of personal data is called a Subject Access Request. Self-service exports are limited to safe account and learning data. Chat transcripts, wellbeing information, school statutory records, Stripe internals, provider internals, and third-party records may need a manual review, redaction, and recipient-authentication check.

You can also complain to the UK Information Commissioner's Office if you are unhappy with how we use personal data.

Cookies

Strictly necessary cookies keep Atlas Study secure and signed in. Optional analytics and marketing cookies stay off until a user chooses to allow them. Cookie choices are saved with a timestamp, policy version, consent-session identifier, user agent, and hashed IP address. We do not store the raw IP address in the consent audit row.