https://www.thediscourse.ai/assets/PrivacyPolicy-BD7YjD75.js

1import{j as e}from"./react-vendor-73cbJX8F.js";import{N as a}from"./Navbar-s95tppu-.js";import{S as t,J as s,K as o,F as r}from"./index-Nh9HzkYu.js";/* empty css                 */import"./AccessibilitySettings-DekBRKxb.js";/* empty css                              */import"./framer-motion-CXnF6ox9.js";const i=()=>e.jsxs(e.Fragment,{children:[e.jsx(t,{title:"Privacy Policy - Discourse AI",description:"Learn how Discourse AI collects, uses, safeguards, and retains personal data in line with UK GDPR and EU GDPR standards."}),e.jsx(a,{}),e.jsxs("div",{className:"legal-page",children:[e.jsxs("div",{className:"legal-container",children:[e.jsx("h1",{className:"legal-title",children:"Privacy Policy"}),e.jsxs("p",{className:"legal-meta",children:["Version ",s," • Last updated ",o]}),e.jsx("p",{className:"legal-text",children:"We are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information in compliance with the UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), and, where applicable, the EU GDPR."}),e.jsxs("div",{className:"bg-slate-800/40 border border-slate-700 p-6 rounded-2xl mb-10",children:[e.jsx("h2",{className:"legal-section-title",children:"Regulatory Information"}),e.jsxs("ul",{className:"legal-list",children:[e.jsx("li",{children:"Data controller: The Discourse AI Limited"}),e.jsx("li",{children:"Registered in England & Wales, company number 16690342"}),e.jsx("li",{children:"Registered office: Unit A, 82 James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE"}),e.jsx("li",{children:"Data protection contact: [email protected]"}),e.jsx("li",{children:"ICO registration number: 00013811876"})]})]}),e.jsx("h2",{className:"legal-section-title",children:"Data Controller"}),e.jsx("p",{className:"legal-text",children:"The Discourse AI Limited, a private limited company registered in England & Wales (company number 16690342), registered office Unit A, 82 James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. Contact: [email protected]"}),e.jsx("p",{className:"legal-text",children:"We are not required to appoint a statutory Data Protection Officer under Article 37 UK GDPR. Data protection is overseen by our Data Protection Lead, who can be contacted at [email protected]."}),e.jsx("h2",{className:"legal-section-title",children:"What data we collect"}),e.jsxs("ul",{className:"legal-list",children:[e.jsx("li",{children:"Account data: name, email, password hash"}),e.jsx("li",{children:"Usage data: app interactions, diagnostics, and service logs"}),e.jsx("li",{children:"Payment data: processed by Stripe (web) or Apple/Google via RevenueCat (mobile apps); we do not store full card details"}),e.jsx("li",{children:"Learning data: course activity, quiz submissions, progress records, and completion data"}),e.jsx("li",{children:'Accessibility preferences: optional display settings such as dyslexia-friendly and reduced-visual-stimulation modes (see "Accessibility preferences" below)'}),e.jsx("li",{children:"Support data: correspondence sent to our support or administrative contacts"})]}),e.jsx("p",{className:"legal-text",children:"Account data (name, email, password) is required to create and operate your account — without it we cannot provide the service. All other data is either generated by your use of the platform or provided optionally; choosing not to provide optional data (for example accessibility preferences or marketing consent) does not affect your access to the service."}),e.jsx("h2",{className:"legal-section-title",children:"Children and young people"}),e.jsx("p",{className:"legal-text",children:'Discourse AI is used in schools by pupils, including children under 18. Where a school or trust provides the service, pupil accounts are set up and managed by the school, which acts as the data controller for pupil data (see "Schools and organisation accounts" below). For individual (non-school) accounts, you must be at least 13 years old — the age at which a child can consent to information society services under section 9 of the Data Protection Act 2018 — or have the consent of a parent or guardian.'}),e.jsx("p",{className:"legal-text",children:"We design the service with the ICO's Age Appropriate Design Code (Children's Code) and the children's higher-protection duty under the Data (Use and Access) Act 2025 in mind: we collect only the data needed to run the service, we do not show advertising, we do not sell personal data, we do not use pupil data to train AI models, and privacy-protective settings are the default."}),e.jsxs("p",{className:"legal-text",children:[e.jsx("strong",{children:"For pupils — the short version:"})," when you use Discourse AI we keep your name, your school email, and a record of the courses and quizzes you do, so that you and your teachers can see your progress. We keep it safe, we don't sell it, we don't use it to train AI, and we don't show you adverts. If anything worries you, ask your teacher, or email us at [email protected]."]}),e.jsx("h2",{className:"legal-section-title",children:"How we use AI"}),e.jsx("p",{className:"legal-text",children:"Discourse AI uses large language models to generate courses, quizzes, feedback, and tutoring responses. Our AI provider is Mistral AI, a company based in France (EU). When you generate a course or chat with the tutor, your prompt and the relevant course context are sent to Mistral AI's API to produce the response."}),e.jsxs("ul",{className:"legal-list",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Your data is not used to train AI models."})," Neither we nor Mistral AI use learner prompts, pupil data, or course content to train or improve models."]}),e.jsx("li",{children:"AI requests are processed within the EU and are not retained by the provider beyond what is needed to return the response and operate the service."}),e.jsx("li",{children:"We do not send more personal data to the AI provider than 

1is needed — prompts are about course content, not your account profile."})]}),e.jsx("h2",{className:"legal-section-title",children:"Automated decision-making"}),e.jsx("p",{className:"legal-text",children:"We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (Article 22 UK GDPR). AI-generated quiz marking and feedback are learning aids: they do not determine grades, qualifications, or access to education, and where the service is used by a school, teachers retain oversight of learner assessment."}),e.jsx("h2",{className:"legal-section-title",children:"Accessibility preferences"}),e.jsx("p",{className:"legal-text",children:"Optional accessibility settings (such as dyslexia-friendly display or reduced visual stimulation) could be understood as revealing information about your health. We store these only as display preferences, we process them solely to adjust how the interface looks for you, on the basis of your explicit consent (Article 9(2)(a) UK GDPR), and we do not use them for profiling, analytics, or any other purpose. You can change or clear these settings at any time."}),e.jsx("h2",{className:"legal-section-title",children:"Why we process your data (legal bases)"}),e.jsxs("ul",{className:"legal-list",children:[e.jsx("li",{children:"To create and manage your account (contract necessity)"}),e.jsx("li",{children:"To provide core app functionality, including AI course generation (contract necessity)"}),e.jsx("li",{children:"To communicate important service updates (legitimate interests)"}),e.jsx("li",{children:"To secure the platform and prevent abuse (legitimate interests)"}),e.jsx("li",{children:"To comply with legal obligations"}),e.jsx("li",{children:"Optional communications and accessibility preferences (consent)"})]}),e.jsx("h2",{className:"legal-section-title",children:"How long we keep data"}),e.jsx("p",{className:"legal-text",children:"We keep personal data only as long as necessary for the purposes above or as required by law:"}),e.jsxs("ul",{className:"legal-list",children:[e.jsx("li",{children:"Account and learning records: while your account is active, then deleted within 12 months of account closure"}),e.jsx("li",{children:"School-managed accounts: retention and deletion follow the school's instructions under the Data Processing Agreement, with data deleted or returned at the end of the contract"}),e.jsx("li",{children:"Payment and billing records: 6 years, as required by UK accounting and tax law"}),e.jsx("li",{children:"Support correspondence: 24 months after the enquiry is resolved"}),e.jsx("li",{children:"Security and service logs: up to 12 months"})]}),e.jsx("p",{className:"legal-text",children:"These periods are enforced automatically by a scheduled retention process, not applied by hand. Records that reach the end of their window are deleted; where a record must be kept for a legitimate purpose beyond that point — for example the anti-abuse checks that stop one person claiming unlimited free credits — the identifying fields are stripped and only an irreversible one-way value is retained."}),e.jsx("h2",{className:"legal-section-title",children:"Backups and deletion"}),e.jsx("p",{className:"legal-text",children:"We keep encrypted backups so that your courses, progress, and certificates survive a hardware failure or other incident. Backups are held separately from the live service, encrypted, and are themselves deleted on a rolling schedule — recent copies are kept for days, older ones for up to 12 months."}),e.jsx("p",{className:"legal-text",children:"When you delete your account, your data is removed from the live service immediately. It can still exist inside backups taken before your request until those backups expire on the schedule above. Those backups are not used for day-to-day processing; they exist only to restore the service after an incident. If a backup ever has to be restored, our restore process automatically re-applies every deletion request made since that backup was taken, so restoring cannot bring your data back. We keep a record that your account was deleted — stored as an irreversible one-way value rather than your email address — so the account cannot be reopened by someone else."}),e.jsx("h2",{className:"legal-section-title",children:"Schools and organisation accounts"}),e.jsx("p",{className:"legal-text",children:"Where Discourse AI is provided to a school, college, university, employer, or other organisation, that organisation acts as the data controller for learner and staff data, and Discourse AI acts as a processor for the contracted services. Our Data Processing Agreement sets out the controller-processor allocation in more detail."}),e.jsx("p",{className:"legal-text",children:'In these cases, we may receive your personal data from your school or employer rather than from you directly — for example when your school 

1creates your account or uploads a class list. Where that happens, the organisation is responsible for telling you about the processing, this notice describes what we do with the data, and the categories of data we receive are those listed under "What data we collect" above.'}),e.jsx("h2",{className:"legal-section-title",children:"Your rights"}),e.jsxs("ul",{className:"legal-list",children:[e.jsx("li",{children:"Access, rectification, erasure"}),e.jsx("li",{children:"Restriction and objection to processing"}),e.jsx("li",{children:"Data portability"}),e.jsx("li",{children:"Withdraw consent at any time (does not affect prior processing)"}),e.jsx("li",{children:'Complain to us directly about how we use your data (see "Complaints" below)'}),e.jsx("li",{children:"Complain to the Information Commissioner's Office or your local data protection authority"})]}),e.jsx("p",{className:"legal-text",children:"You can exercise two of these rights yourself, without contacting us and without waiting: download everything we hold about you from your account settings (data portability), and delete your account and personal data from the same place (erasure). For anything else, contact [email protected]. If your account is managed by a school or employer, you may also need to contact that organisation first so that controller responsibilities are handled correctly."}),e.jsx("p",{className:"legal-text",children:"Where we are required to keep certain records by law — for example billing records, or safeguarding records held on behalf of a school — those are retained for the periods set out above even after an erasure request, and we will tell you when that applies to you."}),e.jsx("h2",{className:"legal-section-title",children:"Complaints"}),e.jsx("p",{className:"legal-text",children:'You have the right to complain to us directly about how we process your personal data (section 164A, Data Protection Act 2018). Email [email protected] with "Data protection complaint" in the subject line. We will acknowledge your complaint within 30 days, investigate it, and tell you the outcome without undue delay.'}),e.jsx("p",{className:"legal-text",children:"You can also complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint, or by phone on 0303 123 1113. If you are in the EU, you may complain to your local supervisory authority."}),e.jsx("h2",{className:"legal-section-title",children:"Subprocessors"}),e.jsx("p",{className:"legal-text",children:"We use the following service providers to deliver the platform:"}),e.jsxs("ul",{className:"legal-list",children:[e.jsx("li",{children:"Hostinger — application hosting and transactional email (UK/EEA data centres)"}),e.jsx("li",{children:"Mistral AI (France) — AI course generation and tutoring responses"}),e.jsx("li",{children:"Stripe — web payment processing (UK entity; US parent)"}),e.jsx("li",{children:"Apple, Google, and RevenueCat (US) — in-app purchase processing for the mobile apps"}),e.jsx("li",{children:"PostHog (EU cloud, hosted in the EEA) — product analytics"}),e.jsx("li",{children:"Cloudflare — content delivery, network security, and encrypted off-site backup storage (EU jurisdiction)"})]}),e.jsx("p",{className:"legal-text",children:"We will update this list when subprocessors change. School customers are notified of subprocessor changes under the Data Processing Agreement."}),e.jsx("h2",{className:"legal-section-title",children:"International transfers"}),e.jsx("p",{className:"legal-text",children:"Personal data is primarily stored and processed in the UK and EEA. Where a subprocessor processes personal data outside the UK — principally Stripe, RevenueCat, and Cloudflare in the United States — we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, alongside the UK adequacy arrangements for the US (the UK Extension to the EU-US Data Privacy Framework) where the recipient is certified. You can request a copy of the relevant transfer safeguards by emailing [email protected]."}),e.jsx("p",{className:"legal-text",children:"Our backups are held in Cloudflare's European Union jurisdiction, so the data itself stays in the EU. They are also encrypted by us before they leave our servers, using a key Cloudflare does not hold — so the backup provider stores data it cannot read."}),e.jsx("h2",{className:"legal-section-title",children:"Security"}),e.jsxs("ul",{className:"legal-list",children:[e.jsx("li",{children:"Personal data is encrypted in transit (TLS) and at rest"}),e.jsx("li",{children:"Passwords are stored as salted hashes, never in plain text"}),e.jsx("li",{children:"Access to production systems and personal data is restricted and access-controlled"}),e.jsx("li",{children:"SSO and two-factor authentication are available for school staff and students"}),e.jsx("li",{children:"Hosting is in UK/EEA data centres, with Cloudflare providing network-level protection"}),e.jsx("li",{children:"Encrypted backups are taken automatically and held separately from the live service, so your courses, progress and certificates can be restored after a hardware failure or other incident"}),e.jsx("li",{children:"Restores are rehearsed on a schedule rather than assumed to work, and backups that cannot be restored are reported as a failure"})]}),e.jsx("h2",{className:"legal-section-title",children:"Data breach handling"}),e.jsx("p",{className:"legal-text",children:"If we become aware of a personal data breach affecting customer or school data, we will investigate promptly, take corrective action, and notify affected customers or controllers without undue delay where notification is required, and the ICO within 72 hours where the breach is reportable."}),e.jsx("h2",{className:"legal-section-title",children:"Changes to this policy"}),e.jsx("p",{className:"legal-text",children:"When we make material changes to this policy we will update the version number and date above and, where the change significantly affects you, notify you by email or in the app before it takes effect."}),e.jsx("h2",{className:"legal-section-title",children:"Contact"}),e.jsx("p",{className:"legal-text",children:"To exercise your rights or ask questions, contact [email protected]. To complain to the ICO, visit ico.org.uk/make-a-complaint or call 0303 123 1113."}),e.jsxs("div",{className:"flex flex-wrap gap-4 mt-10",children:[e.jsx("a",{href:"/cookie-policy",className:"cta-button secondary",children:"Cookie Policy"}),e.jsx("a",{href:"/gdpr-faqs",className:"cta-button secondary",children:"GDPR FAQs"}),e.jsx("a",{href:"/data-processing-agreement",className:"cta-button secondary",children:"Data Processing Agreement"})]})]}),e.jsx(r,{})]})]});

1export{i as default};