Ask Ed Privacy Notice

1. Who we are
Ask Ed is provided by Original Midnight Limited, registered in England and Wales at 81 Burton Road, Derby, DE1 1TJ, company number 16535696.

Privacy contact: privacy@justasked.ai  In most cases, your school is the data controller for personal data processed through Ask Ed, and Ask Ed acts as a data processor on the school's instructions. This means the school decides what data is processed and why, and Ask Ed handles it under a written agreement (a Data Processing Agreement) with the school. For limited operational data (such as service logs and aggregated usage statistics), Ask Ed acts as a controller in its own right. Those uses are described in section 4.

​

2. Who this notice covers
This notice covers: Parents and carers who use the Ask Ed app to ask questions and receive messages from their school. School staff who use the Ask Ed admin portal to manage content, contacts, and communications. Children whose names and class information are held in Ask Ed so that messages and answers can be directed correctly.
 

3. What data we process
Parent and carer data Full name, Mobile phone number, The class(es) and child(ren) the parent is linked to, Messages sent to and received from Ask Ed, Communication preferences (e.g. language, opt-ins), App and device information necessary to deliver the service (e.g. app version, operating system, device identifier for push notifications)

 

Child data Child's name, Class or year group, The parents or carers linked to that child. Ask Ed does not process: child contact details, academic records, attendance, SEN information, safeguarding records, health data, photographs, or any special category data about children.

 

School staff data Name and work email address (for admin portal access only — staff email is not collected for parents), Role within the school, Sign-in and security logs.

 

School content Documents and resources uploaded by school staff to form the AI assistant's knowledge base, Messages and broadcasts authored by staff.

Operational data Service logs, error reports, and performance metrics, Aggregated and anonymised usage statistics.

4. Why we process it, and our lawful basis​

​​

Purpose: Routing parent queries to the AI assistant and returning answers​. Data used: Parent name, phone, child name, class, message content.  Lawful basis: (UK GDPR) Public task (state schools) or legitimate interests of the school (independent schools), under the school's instructions as controller.

​​

Purpose: Sending operational messages from the school to parents (term dates, reminders, class updates).  Data used: Parent name, phone, class, child name.  Lawful basis (UK GDPR): Public task or legitimate interests.

 

Purpose: Targeted broadcasts beyond essential operational messaging. Data used: Parent name, phone, preferences. Lawful basis (UK GDPR): Consent — parents can opt in or out at any time.

 

Purpose: Tailoring answers to the correct class or year group. Data used: Class, child name. Lawful basis (UK GDPR): Public task or legitimate interests.

 

Purpose: Maintaining the admin portal for school staff. Data used: Staff name, email, sign-in data. Lawful basis (UK GDPR): Contract with the school, plus legitimate interests for security. 

 

Purpose: Service reliability, debugging, security monitoring. Data used: Operational logs. Lawful basis (UK GDPR): Legitimate interests (Ask Ed as controller). 

 

Purpose: Reporting and product improvement. Data used: Aggregated, anonymised usage data. Lawful basis (UK GDPR): Legitimate interests (Ask Ed as controller).

Where the lawful basis is consent, parents can withdraw it at any time through the app or by contacting the school. Withdrawing consent does not affect lawful processing carried out before withdrawal.

​

Where the lawful basis is legitimate interests, we have considered the impact on parents and children and concluded the processing is necessary, proportionate, and reasonably expected in the context of a school communication service. A full legitimate interests assessment is available to schools on request.

​

5. Children's data

 

Ask Ed processes children's data on behalf of schools and treats this with particular care.

​

• The only child data held is name and class (or year group), used to route messages and tailor answers to the correct context.
• No academic, behavioural, attendance, health, safeguarding, or special category data about children is processed.
• No profiling or automated decision-making is carried out about any child.
• Infant and primary school aged children do not interact with Ask Ed directly — the service is used by parents and school staff.
• We follow the principles of the ICO's Age Appropriate Design Code where they apply to a service that processes children's data, including data minimisation, transparency, and privacy by default.

​

If you have concerns about how your child's data is used, please contact your school's Data Protection Officer.

​

6. How the AI assistant works

 

When a parent sends a question, Ask Ed:

 

1. Retrieves the most relevant passages from the school's uploaded documents using a retrieval system (RAG — retrieval-augmented generation).
2. Sends those passages, along with the parent's question and minimal context (such as the relevant class), to a large language model provided by Google (Gemini API).
3. Returns the model's answer to the parent through the app.

​

Important points:

• No training on your data. Google does not use Gemini API inputs or outputs to train its models. This is governed by Google's Gemini API terms.
• Minimal context sent. Child names are not sent to the model unless directly relevant to answering a parent's question (for example, where a parent uses their child's name in the query itself).
• Caching. To improve speed and reduce cost, Ask Ed may store recent question-and-answer pairs for short periods. Cached entries are scoped to the school and are deleted on a rolling basis.
• No automated decisions with legal or significant effects are made about parents or children. The AI provides information; it does not make decisions on the school's behalf.
• Accuracy. The AI answers based on the school's own documents. Parents should contact the school directly for anything urgent, sensitive, or where they need a definitive answer.

 

7. Sub-processors

 

Ask Ed uses the following sub-processors to deliver the service. We maintain an up-to-date list and will notify schools of material changes.

 

Sub-processor: Google (Gemini API). Purpose: AI model inference. Location: US / global

Sub-processor: Laravel Forge. Purpose: Application hosting and database. Location: UK

Sub-processor: Cronitor. Purpose: Service monitoring and error reporting. Location:US

Sub-processor:Intercom (where enabled). Purpose: Admin support messaging. Location: US / Ireland

Sub-processor:Wonde (where integrated). Purpose: School information system (MIS) data sync. Location: UK

Sub-processor: Firebase. Purpose: Delivery of push notifications. Location: US / global

 

A current sub-processor list is available to schools on request.

​​

8. International data transfers

 

Some of our sub-processors are based outside the UK. Where personal data is transferred outside the UK, we rely on appropriate safeguards under UK GDPR, including:

​

• The UK International Data Transfer Agreement (IDTA), or
• Standard Contractual Clauses with the UK Addendum, or
• Transfers to countries with a UK adequacy decision.

​

We also apply supplementary measures including encryption in transit and at rest.

 

9. How long we keep data

 

Data: Parent contact data (name, phone, links to children). Retention: For as long as the parent is associated with the school, plus 30 days after removal.

Data: Child name and class. Retention: For as long as the child is enrolled at the school, plus 30 days after removal

 

Data: Parent–assistant message history. Retention: 12 months by default; schools may request shorter retention

 

Data: School-uploaded documents. Retention: Retained until removed by the school or until the school's contract ends, then deleted within 30 days

 

Data: Admin portal staff accounts. Retention: Until removed by the school, then deleted within 30 days

 

Data: Operational logs. Retention: Up to 90 days

 

Data: Backups. Retention: Up to 35 days; deletions propagate through backups within this period

 

Data: Aggregated, anonymised analytics. Retention: Retained indefinitely (no longer personal data)

 

Schools can request earlier deletion of any data at any time.

 

10. Your rights

 

You have the following rights under UK GDPR:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data in certain circumstances.
• Restriction — ask us to limit how we use your data.
• Objection — object to processing based on legitimate interests.
• Portability — receive your data in a portable format.
• Withdraw consent — where processing is based on consent.
• Complain to the ICO — at ico.org.uk or 0303 123 1113.

​

Because the school is the data controller for most processing, please direct rights requests to your school's Data Protection Officer in the first instance. Ask Ed will support the school in responding within statutory timeframes (usually one month).

​

11. Security

 

We protect personal data through:

• Encryption in transit (TLS) and at rest.
• Role-based access control for school staff in the admin portal.
• Whitelisted access for parents — only phone numbers registered by the school can use the parent app.
• Authentication and session protection, including CSRF protection on admin forms.
• Least-privilege access for Ask Ed staff, with access limited to those who need it for support, operations, or development.
• Monitoring and logging to detect and respond to incidents.
• Regular review of dependencies, sub-processors, and security practices.

​

If a personal data breach occurs that is likely to affect your school's data, we will notify the school without undue delay and within 72 hours of becoming aware, in line with Article 33 UK GDPR.

 

12. Messaging, broadcasts, and notifications

​

• Operational messages (such as school updates, term dates, and replies to parent questions) are sent under the school's lawful basis as controller — these are part of the service the school has commissioned.
• Non-essential broadcasts are sent only where parents have opted in.
• Push notifications are delivered through the parent app. You can disable notifications in your device settings at any time.
• Ask Ed does not use parent or child data for any marketing of its own products.

​

13. Changes to this notice

 

We may update this notice to reflect changes in the service, our sub-processors, or the law. Material changes will be communicated to schools, and the effective date at the top of this notice will be updated. Older versions are available on request.

 

14. Contact

 

Ask Ed privacy contact: privacy@justasked.ai
Your school's DPO: contact your school office for details
Information Commissioner's Office: ico.org.uk | 0303 123 1113