Supplier due diligence pack
Everything a school or trust needs in order to complete a DPIA and a supplier assessment for GCSE Tutor, in one page, without having to ask us for it first.
The four answers people ask for first
- What a pupil writes is never stored. Questions and answers are processed and discarded. There is no conversation table in the database, in the browser, or anywhere else.
- Nothing a pupil writes leaves the UK. The tutoring model runs on our own hardware in Barnsley, South Yorkshire. No pupil text is sent to OpenAI, Google, Anthropic or any other AI provider, and none of it is used to train anything.
- Account data is in Switzerland — email address, sign-in times and progress counters, held by Supabase in AWS eu-central-2, Zurich. That is a transfer to a third country, and it needs no additional safeguard: Switzerland holds a UK adequacy decision, and since 1 September 2023 its own revised Federal Act on Data Protection is aligned with the GDPR.
- Everything is deleted on 30 June, every year, whether or not anyone asks. It runs as a scheduled database job, not as a promise to remember.
1. The supplier
| Trading name | GCSE Tutor — www.gcsetutor.app |
|---|---|
| Legal entity | Lucian Paduraru, sole trader, South Yorkshire, United Kingdom |
| ICO registration | Registered with the Information Commissioner's Office |
| Data protection contact | privacy@gcsetutor.app |
| Commercial contact | hello@gcsetutor.app |
| Size | One person. We say this plainly because it changes what you should expect: there is no account manager and no 24/7 service desk, and there is also nobody between you and the person who wrote the software. |
2. What the service does
An online revision service covering 23 GCSE subjects, aligned to the AQA, Edexcel and OCR specifications. A pupil answers a past-paper style question in their own words and the answer is marked against the published criteria, with the reason each mark was won or lost. There are also topic explanations, interactive diagrams and vocabulary practice.
Pupils access it in a browser. There is no app to install, no software on school devices, and nothing to deploy on your network.
3. Roles under UK GDPR
The school or trust is the data controller: it decides which pupils use the service and why. GCSE Tutor is the data processor, acting only on the school's documented instructions. Our Article 28 terms are published in full at gcsetutor.app/schools/dpa, and a signed copy is available on request.
Stripe is a separate controller in its own right for card data; we never see a card number.
4. Personal data processed
Stored
- Email address, and the time of each sign-in.
- Progress counters — XP, level, streak, last study date, and per subject: questions asked, practice sets completed, XP earned. Numbers only.
- Subscription status — plan and expiry.
Processed but not stored
- Questions and answers. A pupil's message goes to the tutoring server, is used to generate a reply, and is then gone. It is not written to a database, not logged, and not retained.
Not collected at all
- No name is required, no date of birth, no address, no phone number, no photo.
- No special category data.
- Card details never reach us; they go directly to Stripe.
Categories of data subject: pupils enrolled by the school, and any staff member given an account.
5. Where the data is
| What | Where | Basis for transfer |
|---|---|---|
| Everything a pupil writes | United Kingdom — our own hardware, Barnsley, South Yorkshire | No transfer. It does not leave the UK. |
| Accounts and progress counters | Switzerland — Supabase, AWS eu-central-2 (Zurich) | UK adequacy regulations for Switzerland |
| Website delivery | Vercel edge network | UK IDTA or adequacy, as applicable to the region serving the request |
| Payments | Stripe | Stripe acts as an independent controller |
6. Sub-processors
These, and no others. We will tell the school before adding one.
| Sub-processor | Purpose |
|---|---|
| Supabase | Database and authentication |
| Vercel | Serves the website |
| Cloudflare | DNS, and the authenticated tunnel to the tutoring server |
| Stripe | Payments |
| Resend | Account email — receipts, password resets |
No AI provider appears on that list, and that is the point. The model runs on hardware we own.
7. Security
- All traffic over HTTPS/TLS.
- Passwords stored only as hashes, by Supabase. We never see them.
- Row-level security on every table, so one account cannot read another's data.
- The tutoring server is not exposed to the internet directly; it is reached through an authenticated tunnel.
- Access to production data is limited to the sole trader named above.
The strongest measure is architectural rather than procedural: because conversations are never written down, a breach of our database cannot expose anything a pupil wrote. The worst case is a list of email addresses and some counters.
8. Retention and deletion
- Questions and answers — not retained at all.
- Every account and its progress data is deleted on 30 June each year, at the end of the exam season, whether or not anyone asks. Nothing carries into the next exam year.
- Accounts with a subscription still running on that date are deleted when it ends.
- On the school's written request, all pupil accounts and progress data are deleted within 30 days and confirmed in writing.
9. Breaches, rights and audit
- Breach. We notify the school without undue delay and in any case within 24 hours of becoming aware, with what we know at the time.
- Data subject rights. Access, rectification, erasure and portability requests are answered within 30 days. Because we hold so little, most requests are satisfied by exporting a few rows.
- Audit. The school may ask for evidence that we are meeting the agreement and we answer in writing within 30 days. For a supplier of this size that is a conversation and a document, not a site visit, and we would rather say so plainly than imply a compliance department that does not exist.
10. Certifications — stated honestly
- ICO registration — yes.
- Article 28 DPA — yes, published and signable.
- Cyber Essentials — not yet held. We would rather tell you that here than have you find it in question 14 of your own form. It takes one to two weeks to obtain and we will start it when a trust tells us it is a condition. If it is a condition for you, say so and we will have it before any pupil data is processed.
- ISO 27001 — no, and we are not going to claim a process we do not run.
11. Accessibility and safeguarding
The service runs in any modern browser on a phone, tablet, Chromebook or laptop, with no GPU requirement and no install. Pupils are not able to message each other; there is no social feature, no profile visible to others, and no user generated content shared between accounts. The only conversation is between a pupil and the tutor, and it is not kept.
12. What a trial looks like
A fortnight free for one class, so the judgement is made on what pupils actually do with it rather than on a demonstration. No card, and nothing to cancel. What we want back is the verdict, including the critical parts — those are more use to us than praise.
13. What we need from you
- Confirmation of who the controller is and who signs.
- Whether you require Cyber Essentials before a pilot, so we can start it now.
- Any questions your DPIA asks that this page has not answered — send them and we will add them here, because the next school will ask the same ones.