Who we are
PICRAT Suite is an educational technology platform that helps teachers reflect on, evaluate and improve how they integrate technology into their teaching. It is built around the PICRAT framework (Kimmons, Graham and West, 2020).
For the purposes of UK GDPR and the Data Protection Act 2018, the data controller is Andy Perryer, an individual operating the platform from Dubai, United Arab Emirates. Where you sign up directly, PICRAT Suite acts as the data controller for your account data. Where your account is created or arranged on behalf of a school, multi-academy trust or other organisation, that organisation acts as the data controller and PICRAT Suite acts as the data processor under their instructions. A separate Data Processing Agreement is available to download at picrat.com/dpa, or on request.
If the platform's controller changes in future (for example if it transitions to a corporate owner), this page will be updated and material changes notified through the platform.
PICRAT Suite is not required to appoint a Data Protection Officer under Article 37 of UK GDPR (we do not carry out large-scale processing of special-category data or systematic monitoring as a core activity). Privacy queries are handled by Andy Perryer.
Any questions about this notice or about how your data is handled can be sent to privacy@picrat.com. We aim to respond within five working days.
What we collect and why
We collect personal data only where we have a lawful basis to do so. The two bases we rely on are legitimate interests (operating and improving the platform) and consent (for example, the optional research-use toggle in your Settings, or the optional “what to try next” email). You will never be asked to provide more data than the platform needs to function.
Account data and tool usage data are processed on the basis of legitimate interests in operating the platform to deliver a service you have signed up for. Research-use retention beyond standard periods is processed on the basis of explicit consent, which you can withdraw at any time from Settings. Where a school is the controller, the lawful basis for processing is determined by the school and recorded in the Data Processing Agreement we sign with them.
Personalised emails. If you opt in (there is a box when you set up your account, and a “What to try next” switch in Settings), we send you one short email a few days after you first use a tool, suggesting what to try next based on the tools you have used and the lessons you have created. We do this on the basis of your consent, which you can withdraw at any time. The email is written with help from AI and checked against your actual activity before it is sent. It does not grade you or make any decision about you. If you do not opt in, we do not send it.
Account data
| Data | Why |
|---|---|
| Name and email | Account creation, sign-in, magic-link emails, monthly reports, and, if you opt in, an email about getting more out of PICRAT. |
| School | Links your account to your school. If your school has a school lead on PICRAT, they can see your work as described in Who can see your work. Free-text by default; tied to a verified school record once approved. |
| Your role | For example classroom teacher, trainee or lecturer. Chosen by you. If you haven't chosen, we may suggest one from your email address; you can change it in Settings, and skipping the question removes the suggestion. |
| Country and school details you typed at signup | To find your school and use the right year-group names. |
| Password (hashed) | Stored only as a bcrypt hash with 12 salt rounds. We never see your password in plain text. |
| Teaching profile | Age groups taught, subjects, confidence ratings and goals you choose to share. Used to personalise tool suggestions in the app and in those emails. |
| Login records | Timestamps and session metadata. Used for security and to identify dormant accounts. |
Tool usage data
| Data | Why |
|---|---|
| Lesson text and AI responses | Text you submit to Analyse, Review, Generate or Coach is processed by an AI service to produce feedback. The original text and the AI response are stored against your account so you can revisit them. |
| Practice quiz results | Scenario answers, scores, streaks and progress. Used for progress tracking and to power the school dashboard. |
| Coach conversations | The full message history with the Coach tool, so the conversation can resume across sessions. |
| Page feedback | Optional thumbs up or down plus any free-text comment you leave at the bottom of a page. |
| Reflections | What you write in Learn and on your dashboard. |
| Tool preferences and custom subjects | The tools and subjects you tell us you use, to shape suggestions. |
| Recognitions | If a school lead sends you a recognition, their name and message. |
| Colleagues' names and email addresses | If your school or a school lead invites colleagues, the names and addresses they give us, to send the invitation and one reminder a week later. The name is removed once the invitation is accepted. Deleted 90 days after an invitation expires if it isn't accepted. |
| Emails we send you | A copy of each monthly report and review draft, and a record of which reminder emails were sent, so none is sent twice. |
| Contact form | Your message, plus the IP address and browser it came from, to deal with spam. |
Analytics and reflection data
| Data | Why |
|---|---|
| Page views | Which pages you visit and when. Used to understand how the platform is used and to fix what isn't working. You can switch this off in Settings ("Leave me out of usage statistics"). |
| Interaction events | Button clicks, tool usage timing and similar events. Tied to your account. Also switched off by the Settings option above. |
| Confidence snapshots | Self-reported PICRAT confidence and tech comfort, captured periodically. Optional. |
| AI feedback | Thumbs up or down on AI responses. Used to improve prompt quality. |
We do not collect special-category data (race, religion, health, sexuality, biometrics) and we ask you not to submit it through the AI tools. See the section on lesson content below.
Who can see your work
- You. Everything you create is saved to your account.
- School and regional leads. If someone at your school (or covering your region) is set up as a school or regional lead, they can see your name, which tools you used and when, and your full Analyse, Review and Generate results, including the lesson text you entered. They can see that you had a Coach conversation and when, but not its title or what was said. They can also open your dashboard, including its AI summary.
- The PICRAT administrator. To give support, the administrator can view your account and can sign in as you. Every time this happens it is logged.
PICRAT Suite used to offer public share links; they were retired on 30 September 2026 and every stored copy was deleted.
If your university, college or school asked you to join PICRAT (for example as part of a teacher-education course), your lecturer or a colleague may be set up as a lead and see your work as described above. They are responsible for how they use it.
How we use AI tools
The Analyse, Review, Generate and Coach tools each send the text you provide to a generative AI service that returns a response. We use one AI provider:
- Google (Gemini API). Used by every teacher-facing AI tool. PICRAT Suite uses Google's Gemini API on the paid commercial tier. Under Google's paid-tier terms, customer prompts and responses are not used to train Google's foundation models or improve Google's products, and are retained briefly only for abuse monitoring before deletion. It also writes the personal part of some emails from a short summary of your activity (tools used, titles of lessons you created, subject and phase). Your lesson text is not sent for this.
We send data to Google's Gemini API only for these purposes:
- The tools. The text you enter in Analyse, Review, Generate and Coach, to produce the response you see.
- Your dashboard summary. A short AI-written summary of patterns in your own use of PICRAT (which tools, which cells, which subjects). You can see it, and so can a school or regional lead for your school (see Who can see your work). It describes patterns; it does not grade you.
- Administrator summaries, described below.
- Emails. The lesson idea in the monthly email and the day-7 email is written from your subject and age group. The "what to try next" email, if you opt in, is written from a short summary of your activity.
- Setting up your account. The school name you type is used to find your school, and a custom subject name you add is checked and tidied.
- Organising your saved work. Saved results are sorted by subject and age group.
- Replying to page feedback. The comment you leave at the bottom of a page gets an automated reply, labelled as AI.
Admin teacher summaries. The PICRAT administrator can generate a written summary of an individual teacher's use of the platform, to understand how teachers are getting on and where the tools could help more. To do this, your school, teaching profile and tool activity (including quiz answers, the short summaries and classifications of lessons you analysed, and the titles of your reviews and Coach conversations) are sent to the Gemini API. Your name and email address are not sent. The summary may include a short note on how active you are on PICRAT (for example "getting started" or "at risk of stopping"). It is stored with your account, is seen only by the administrator, and is deleted with your account. It is never used to make decisions about you.
We hold the API keys server-side; they are never exposed to your browser. Anything written by AI is labelled as such where it appears.
Sub-processors
The third parties we use to operate the platform act as sub-processors on our behalf. They process personal data only as needed to deliver their service, and only under contract.
| Provider | Purpose | Region |
|---|---|---|
| Google (Gemini API, paid tier) | Generative AI for lesson analysis, review, generation and coaching, and for administrator summaries of individual teachers' use of the platform. | Globally routed by Google. Google is certified under the UK extension to the EU-US Data Privacy Framework. |
| Heroku (Salesforce) | Application hosting. Production runs in Heroku's EU region (Ireland). | EU (Ireland). Salesforce is bound by approved Binding Corporate Rules for any intra-group transfers. |
| Heroku Postgres | Managed PostgreSQL database. Co-located with the application. | EU (Ireland) |
| SMTP2GO | Transactional email (sign-in links, email confirmations, monthly reports, notifications) and personalised service emails. | EU. PICRAT's account is on SMTP2GO's EU-hosted platform, so email logs and account data are held in the EU. SMTP2GO is a New Zealand company; New Zealand has UK adequacy. Covered by SMTP2GO's Data Processing Agreement. |
| Cloudflare | DNS, content delivery and bot protection (Turnstile) for picrat.com. | Global. Cloudflare is certified under the UK extension to the EU-US Data Privacy Framework, supported by the UK IDTA. |
| Mapbox | Geocoding of school names to place schools on the world map. Only the school name and location are sent, not individual personal data. | United States / global. Transfers covered by Standard Contractual Clauses and the UK IDTA. |
| GoDaddy | Domain registrar for picrat.com. | Global |
| Iconify | Icons on the Analyse and Generate pages. Your browser requests them directly, so Iconify sees your IP address. | Global |
Where a sub-processor is located outside the UK or EEA, we rely on the following transfer mechanisms, as required by Articles 46 and 49 of UK GDPR:
- Google (Gemini API). Transfers are covered by Google's certification under the UK extension to the EU-US Data Privacy Framework, supported by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
- Cloudflare. Transfers covered by Cloudflare's certification under the UK extension to the EU-US Data Privacy Framework, supported by the UK International Data Transfer Addendum.
- Heroku (Salesforce). Production data is hosted in the EU (Ireland). Salesforce is bound by Binding Corporate Rules approved for intra-group transfers.
- Other providers. Where any other sub-processor is located outside the UK or EEA, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or an equivalent approved transfer mechanism.
Schools in the United Arab Emirates. PICRAT Suite is operated from Dubai. The platform and its database are hosted in the EU (Ireland), outside the UAE, and the sub-processors above process some data in their own regions. If your school needs to assess this under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) or a free-zone data protection regime, email privacy@picrat.com. We will sign the Data Processing Agreement and provide the documentation your assessment needs.
Cookies and similar technologies
PICRAT Suite sets one cookie. It also keeps a few values in your browser's storage. We do not use marketing, advertising or third-party analytics cookies.
| Item | Type | Purpose | Lifetime |
|---|---|---|---|
| connect.sid | HTTP cookie (httpOnly, Secure, SameSite=Lax) | Keeps you signed in. | 30 days |
| picrat_session_id | Session storage | A random code for this browser tab, sent with usage events so we can see how people move through the site. Used only for our own statistics, and not used at all if you switch statistics off in Settings. | Until the tab closes |
| picrat_interaction_count, picrat_checkin_dismissed | Session and local storage | Time the occasional confidence check-in and stop it repeating. Not sent to us. | Tab / until cleared |
| Tour, tip and "seen" flags | Local storage | Remember which tips and tours you've already seen. Not sent to us. | Until cleared |
| coach_context, generate_prefill | Session storage | Carry your lesson text from one tool to another when you click through. Not sent to us until you submit. | Until the tab closes |
Under the Privacy and Electronic Communications Regulations (PECR), storage that is strictly necessary for the service you asked for needs no consent. The session code used for our statistics relies on the UK exemption for statistical purposes, and you can switch it off at any time in Settings ("Leave me out of usage statistics"). You can clear all of these values using your browser's site-data controls.
How long we keep your data
We retain data only as long as it is needed for the purpose for which it was collected. An account is treated as dormant after two years without sign-in.
| Data | Retention | Then |
|---|---|---|
| Active account data | For the life of the account | Deleted on account closure |
| Dormant account (no sign-in for 2 years) | 2 years from last sign-in | Account deleted. Usage analytics are kept without any link to you. |
| Lesson text and AI responses (Analyse, Review) | 2 years after the account becomes dormant; 3 years total once orphaned | User reference removed at 2 years; row hard-deleted at 3 years |
| Coach conversations | 1 year after the last message | Hard-deleted |
| Practice quiz data | 2 years after the account becomes dormant | Anonymised |
| Interaction events | 12 months from creation | Hard-deleted |
| Confidence snapshots | 2 years from creation | Anonymised if research consent given, otherwise hard-deleted |
| Accounts created with a password whose email address is never confirmed | 30 days from sign-up | Account and everything in it hard-deleted |
| Magic-link tokens | 24 hours from creation (sign-in links expire after 30 minutes; email confirmation links after 24 hours) | Hard-deleted |
| Sessions (connect.sid) | 30 days | Pruned automatically |
| Contact form submissions | 1 year from submission | Hard-deleted |
| “What to try next” email (draft and sent copy) | 1 year from creation | Wording and activity summary deleted; a record that the email was sent is kept so it is never sent twice |
| Admin and impersonation audit logs | IP address and any email address removed after 1 year; the action record is retained | IP and email removed |
| Page views | 12 months from creation | Hard-deleted |
| Page feedback | While your account exists; 2 years after it is deleted | Hard-deleted |
| Invitations not accepted | 90 days after they expire | Hard-deleted |
| Copies of monthly reports and review drafts | 1 year | Copy deleted; a record that it was sent is kept |
| Accounts deactivated by the administrator (spam or duplicates) | 30 days | Account deleted |
If you opt in to research use via Settings, de-identified usage data (your name, email and school removed, and your account replaced by a code) may be kept for educational research. We still treat it as personal data and protect it in the same way. Turning the setting off stops your data being included in any new research export.
Your rights
Under UK GDPR you have the following rights, all of which are exercisable without charge:
- Information. This notice is the principal way we provide you with information about how we process your personal data. You can request further detail at any time using the contact address at the top.
- Access. Use the "Export all my data" button on your Settings page to download a structured JSON file containing everything we hold about you.
- Rectification. Update your profile and account details from Settings.
- Erasure. Use the "Delete my account" button on Settings. Your account and everything linked to it are deleted straight away. Some records (usage analytics, lesson analyses and reviews, and Coach conversations) are kept for a limited time without any link to you, as set out in the retention table, then deleted.
- Restriction of processing. You can ask us to keep your data but stop active processing of it (for example while you contest the accuracy of your data or object to processing). Email the address above and we will mark your records as restricted.
- Portability. The JSON export is provided in a structured, machine-readable format.
- Object. If you wish to object to any specific processing, contact us using the address at the top of this notice. You can object at any time to our use of your activity to personalise emails; unsubscribing, or turning off “What to try next” in Settings, stops it straight away.
- Withdraw consent. The research-use toggle, the usage statistics switch and the “What to try next” email switch in Settings can be changed at any time. Every report and reminder email has an unsubscribe link, and you can turn them off in Settings.
- Not be subject to automated decision-making. PICRAT Suite does not make automated decisions that produce legal or similarly significant effects about you. The AI tools, your dashboard summary and the administrator's summaries describe what you did and suggest ideas. They are not used to make decisions about you, and they do not grade you or your teaching.
- Complain to a regulator. If you are not satisfied with our response you can complain to the UK Information Commissioner's Office at ico.org.uk.
Security
We protect your data with the following technical and organisational measures:
- Passwords hashed with bcrypt (12 salt rounds); never stored in plain text.
- Session cookies set httpOnly, Secure and SameSite=Lax.
- Sign-in flow regenerates the session ID to prevent session fixation.
- All database queries use parameterised placeholders to prevent SQL injection.
- HTTP security headers via Helmet, including a Content Security Policy and HSTS.
- Rate limiting on authentication routes, the AI proxy and write-side API endpoints.
- HTTPS enforced in production with automatic HTTP to HTTPS redirect.
- AI API keys held server-side only; never exposed to the browser.
- Routine application updates and dependency patching.
No system can be made perfectly secure. If you become aware of a security issue, please email privacy@picrat.com with the subject line "security" and we will acknowledge within two working days.
Personal data breaches
If we become aware of a personal data breach that affects your data, we will notify the relevant data controllers (your school, where applicable) without undue delay and in any case within 72 hours of becoming aware of it, in line with Article 33 of UK GDPR. Notification will include the nature of the breach, the categories and approximate numbers of data subjects affected, the likely consequences, and the measures taken or proposed to address it. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly under Article 34.
Children's data
PICRAT Suite is built for use by teachers (adults). Pupils do not have accounts and do not access the platform directly. Registration requires an email address and is intended for adults who teach or support teaching: teachers and school staff, trainee teachers and students on teacher-education courses, lecturers and other education professionals. You must be 18 or over to create an account.
Because teachers may submit lesson plans through the AI tools, we ask all users not to include identifiable pupil information (names, dates of birth, attendance records, SEN diagnoses, or anything that could identify an individual child). Where pupil data is inadvertently submitted, it is processed and retained on the same schedule as other lesson text above and can be deleted on request.
The Information Commissioner's Office's Age Appropriate Design Code (Children's Code) applies to services likely to be accessed by children. PICRAT Suite is not such a service: it is teacher-facing, requires registration, and contains no content directed at children. If pupil-facing features are added in future, this section will be updated and the Code's standards applied.
Changes to this notice
We review this notice at least annually and update it when our processing changes. Material changes are communicated through the platform. The date at the top of the page reflects the most recent revision.
Contact
For data-protection queries, requests or complaints, email privacy@picrat.com. If your school's data protection officer needs a signed Data Processing Agreement, an updated sub-processor list, or any further documentation to complete a Data Protection Impact Assessment, please email the same address. If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner's Office at ico.org.uk.
This notice is written to be readable. It is not a substitute for legal advice. If your school's data-protection officer needs additional documentation (for example a signed Data Processing Agreement or sub-processor list), email the address above and we will respond.