Data processing agreement
The moment you add a student, you decide why their data is processed and we process it on your instructions. That makes you the controller and us the processor, and UK GDPR Article 28 requires it in writing. This is that writing.
Version 1.0 · 31 August 2026 · ICO registration ZC111613
What we process, and what we cannot
Only where a tutor adds a student. A student who finds Chuleta on their own gives us nothing at all, and there is no personal data for anyone to be controller of.
What exists
What does not
Sub-processors
Everyone who touches the data, and why.
| Who | For | Personal data? |
|---|---|---|
| Vercel | Hosting | Yes |
| Supabase | Database | Yes |
| Clerk | Tutor sign-in — never a student | Tutors only |
| Resend | Email to tutors | Tutors only |
| ElevenLabs | Audio, generated months in advance | No |
We give 30 days’ notice before adding or replacing any of them, and you may object.
Deletion
Delete a student from the interface at any time. On request we delete a named pupil within five working days, and everything within 30 days of you stopping.
Deleting a tutor never destroys a pupil’s history — the record is detached rather than cascaded, so another teacher who still needs it keeps it.
Breach
We tell you within 24 hours of becoming aware: what happened, which pupils, the likely consequences and what we are doing. You notify the ICO — that is your decision as controller, and we give you everything you need to make it.
Honest about the gaps
Two things are not finished, and you should know before you decide rather than after:
This is a draft and is not legal advice. If your DPO wants the full text, our own data protection impact assessment, or a schema dump, email us and you get all three.
Wording for your privacy notice
We use Chuleta (chuleta.co.uk) for Spanish vocabulary practice. We provide a first name and year group only. Pupils do not create accounts and do not give an email address. Chuleta processes this on our instructions under a written agreement, and deletes it when we ask. No advertising, no tracking, no profiling.