Privacy & Data

ReportAssist is designed for UK primary schools and built with data minimisation and UK GDPR principles in mind.

Data minimisation by design

The tool is built to work from first names only. You are strongly encouraged not to enter surnames, dates of birth, addresses, or any safeguarding or medical information. Only enter the academic and pastoral data needed to write a report.

What we store

• Your account details (name and email).
• Structured pupil data you enter (attainment, behaviours, traits, notes).
• Reports generated and any edits you make.
• An activity log of report and pupil changes.

How AI is used

When you generate a report, the pupil data you entered is sent securely to an AI model provider to draft the text. It is processed to generate your report and is not used to train models. AI calls are made server-side; your data is not exposed to the browser of other users.

How your data is used

When you generate or refine a report, we send only what the model needs to draft the text:

• Pupil first name, year group, attainment levels, learning behaviours, traits and the notes you have entered.
• Your school context and any writing voice samples saved in Settings, so the draft sounds like you.
• The tone, length and report type you pick for that run.

We do not send:

• Pupil surnames, dates of birth, addresses or contact details.
• Your email address, account password or billing information.
• Data belonging to other teachers or other pupils on your account.

Requests are routed through the Lovable AI Gateway to the underlying model provider. Data sent this way is used only to generate your response and is not used to train the underlying models. Drafts, edits and activity logs are stored in your private account so you can review, refine or delete them at any time.

Access & security

Your pupil data and reports are private to your account and protected by row-level security, so no other user can read them. Data is encrypted in transit.

Your rights

You can edit or delete any pupil and any report at any time from within the app. Deleting a pupil permanently removes their data and associated reports.

Your role under UK GDPR

Your school is the data controller for pupil information. You are responsible for ensuring you have the appropriate lawful basis and authorisation to process the data you enter.