Privacy policy

LessonLoom ("we", "us", "our") provides an online platform that helps teachers, tutors and schools generate curriculum-aligned teaching resources. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, LessonLoom is the data controller for the personal data described in this policy. You can contact us about privacy at any time through the contact form on our website.

We collect and store the following categories of personal data:

• Account data: your name, email address, password (stored only as a secure hash), plan details and branding preferences such as your school name and logo.
• Content data: the teaching resources, schemes of work, class profiles and other materials you create or upload while using the service.
• Usage data: technical information about how you use the service, such as pages visited and features used, collected to keep the service secure and to improve it.
• Billing data: your subscription status, plan and transaction history. Your full payment card details are processed by our payment provider and are never stored by us.

No student personal data. LessonLoom is designed so that you never need to enter student personal data. Class profiles hold aggregate information only, such as ability mix and the number of students needing extra support. Please do not enter student names or other identifying details into the service.

• To provide the service, including generating the resources you request (performance of our contract with you).
• To manage your subscription, take payment and send service messages such as trial reminders and receipts (performance of our contract).
• To keep the service secure, prevent abuse and enforce usage limits (our legitimate interests).
• To improve the service, using aggregated and anonymised usage information (our legitimate interests).
• To meet legal obligations, such as tax and accounting records (legal obligation).

We do not sell your personal data, and we do not use it for advertising.

We use a small number of trusted processors to run the service:

• Hosting and database provider: stores your account and content data securely on our behalf.
• AI provider: resource generation is processed by an AI provider on our servers. The prompts you enter are sent to generate your resources; they are not used to train public models.
• Payment provider: processes deposits and subscription payments. Card details go directly to them and never touch our servers.
• Email provider: sends account, trial reminder and receipt emails.

Where these processors are based outside the UK, transfers are protected by appropriate safeguards such as the International Data Transfer Agreement or an adequacy regulation.

We keep your account and content data for as long as your account is active. If you delete your account, your packs, schemes of work and class profiles are removed. Billing and transaction records are kept for the period required by UK tax and accounting law, normally six years.

Under UK data protection law you have the right to:

• access a copy of your personal data;
• correct inaccurate data;
• have your data deleted;
• export your data in a portable format;
• object to or restrict certain processing; and
• withdraw consent where processing is based on consent.

You can export your account data or delete your account permanently from Settings at any time. For anything else, please contact us and we will respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we handle your data.

We use only essential cookies and similar storage needed to keep you signed in and to operate the service. We do not use advertising or tracking cookies.

We apply appropriate technical and organisational measures to protect your data, including encryption in transit, access controls and row-level isolation of each account's content. No method of transmission over the internet is completely secure, but we work to protect your data and will notify you and the ICO of any personal data breach where the law requires it.

If we make material changes to this policy we will notify you by email or through the service before the changes take effect. The date at the top of this page shows when it was last updated.

For any privacy question, request or concern, please contact us through the contact form on our website and we will be glad to help.