School Data Privacy & Processing Terms

1. Scope And Relationship To Other Terms

These School Data Privacy & Processing Terms apply to TeacherGPT school accounts in New Zealand and supplement the TeacherGPT Privacy Policy and Terms of Use. They form part of the agreement for schools using TeacherGPT unless replaced by a signed written agreement.

These terms apply to authenticated school account use. Public trial, demo, or unauthenticated experiences, if available, are not part of a school account unless the resulting content is copied into an authenticated school account.

2. Roles

For school account content, the school decides what information its authorised users enter into TeacherGPT. TeacherGPT processes that information to provide, secure, support, and maintain the service.

TeacherGPT also processes limited operational information for account administration, billing, security, abuse prevention, troubleshooting, legal compliance, and aggregated or de-identified service analytics.

3. Information Processed For School Accounts

Depending on how a school uses TeacherGPT, school account data may include:

• staff account details, such as name, email address, school, role, account status, and authentication information;
• school account settings, seats, school-wide instructions, and administrator settings;
• teaching context, such as year level, classroom context, curriculum selections, te reo Māori preferences, and immersion settings;
• prompts, chat messages, uploaded files, uploaded images, generated resources, report-comment drafts, Google Slides records, online games, and generated images;
• usage metadata, such as feature use, message counts, timestamps, model usage, diagnostics, and performance information;
• billing and subscription metadata, such as invoice, seat, subscription, and payment-related account information.

4. No AI Model Training

TeacherGPT does not use school prompts, uploaded documents, uploaded images, chat history, generated resources, student personal information, or other school account data to train, fine-tune, or improve TeacherGPT-owned or third-party foundation AI models.

TeacherGPT uses commercial/API services from OpenAI and Anthropic to provide AI response generation and related AI features. TeacherGPT will not opt school account data into third-party AI model training.

5. Student Data

TeacherGPT is designed for teachers, school leaders, and education professionals. It is not intended for direct student account use.

School users should not include unnecessary personal information about students in prompts, uploads, or generated resources. Where student information is needed for a legitimate teaching purpose, users should minimise identifiability, for example by using initials, pseudonyms, or de-identified excerpts.

TeacherGPT does not sell student personal information and does not use student personal information for advertising or targeted marketing.

6. School Account Privacy And Access

TeacherGPT maintains logical segregation of school accounts through school, user, role, permission, and ownership controls.

• School administrators can invite, manage, and deactivate staff accounts associated with their school.
• Teacher chats and private generated resources are visible to the owning teacher account.
• School owners can access and manage student report workspaces for staff in their school account, including student report details, report-comment drafts, generated report comments, and report downloads.
• School administrators receive school usage analytics and user-management controls, but not routine access to individual teacher chat contents.
• Authorised TeacherGPT personnel may access account data where necessary for support, security, troubleshooting, abuse prevention, legal compliance, or service operations.

TeacherGPT supports Google login using verified Google accounts and email/password login.

7. Hosting, Storage, And Overseas Processing

TeacherGPT stores primary application data at rest on DigitalOcean infrastructure located in Sydney, Australia.

TeacherGPT is provided for New Zealand schools under New Zealand law, including the Privacy Act 2020. Some sub-processors are headquartered in, or may process data in, countries outside New Zealand, including Australia, the United States, the European Union, and other locations used by those sub-processors.

TeacherGPT identifies the overseas sub-processors it uses and relies on their published or commercial privacy, security, and data-processing terms for the services they provide.

8. Retention And Deletion

School account data is retained while needed to provide the service, preserve user history, support school administration, comply with legal obligations, prevent abuse, resolve disputes, or maintain billing and accounting records.

Users may delete chats and associated resources where that functionality is available. Users may delete their account through TeacherGPT or request deletion by contacting support@teachergpt.co.nz.

Where a school, parent, caregiver, or authorised requester asks for deletion of student personal information, TeacherGPT will support the school in identifying and deleting relevant data from active production systems. This includes uploaded files and generated outputs where they are within TeacherGPT's control and not required to be retained by law.

Unless a shorter timeframe is agreed in writing or required by law, TeacherGPT will complete verified deletion requests from active production systems within 10 business days after receiving sufficient information to identify the relevant data and confirm authority for the request.

TeacherGPT maintains rolling backups for disaster recovery. Backups are retained for 7 days. Data deleted from active production systems ages out of rolling backups within the 7-day backup retention window, unless preservation is required by law or for a documented security investigation.

9. Security Measures

TeacherGPT maintains technical and organisational measures designed to protect school account data against unauthorised access, disclosure, alteration, loss, or destruction. Current measures include:

• encrypted web application traffic;
• authenticated access to core product areas;
• account login protections, including Google login support, password-strength requirements, and protected password storage;
• role-based school account permissions and user-status controls;
• access controls that limit chats, messages, and resources to authorised users;
• protective application controls designed to reduce common web-application risks and abuse;
• additional isolation and browser safeguards for generated or untrusted content;
• monitoring and diagnostics to support reliability, incident investigation, and security response;
• disaster-recovery backup processes.

10. Security Incidents And Privacy Breaches

TeacherGPT will investigate suspected security incidents affecting school account data. After confirming a security incident involving school account data, TeacherGPT will notify the school without undue delay and, where practicable, within 72 hours of confirmation.

TeacherGPT will reasonably cooperate with the school's assessment of whether an incident is a notifiable privacy breach under the Privacy Act 2020.

11. AI Output, Curriculum, And Te Tiriti Context

TeacherGPT provides AI-assisted drafting, resource generation, planning, feedback, and classroom support. Outputs may be inaccurate, incomplete, culturally inappropriate, or unsuitable without professional review.

TeacherGPT includes New Zealand-specific configuration, curriculum context, achievement objective support, and settings for te reo Māori, reo rua/partial immersion, and rumaki/full immersion resource generation. These features are intended to reduce generic or overseas-context outputs, but they do not replace teacher judgement, local iwi/hapū guidance, cultural review, or expert te reo Māori review.

Schools and teachers remain responsible for reviewing, verifying, and approving AI-generated outputs before using them with students, whānau, colleagues, or the wider school community.

12. Sub-processors

TeacherGPT uses trusted sub-processors to provide, secure, monitor, support, and improve the service.

13. School Responsibilities

Schools using TeacherGPT should:

• ensure only authorised staff use school-managed TeacherGPT accounts;
• maintain their own acceptable-use, AI-use, privacy, and student-data handling policies;
• instruct users not to include unnecessary student personal information in prompts, uploads, or generated resources;
• review AI-generated outputs before classroom, parent/caregiver, reporting, or administrative use;
• obtain any required consents or provide any required notices for school use of AI tools and overseas processing;
• notify TeacherGPT promptly if deletion, access, correction, investigation, or support is needed for student personal information;
• manage school admin permissions and deactivate staff accounts when access is no longer required.

14. Certifications, Questionnaires, And Signed Terms

TeacherGPT will reasonably respond to school security and privacy questionnaires, Privacy Impact Assessment requests, and vendor review requests.

TeacherGPT does not currently claim to hold its own independently verifiable ISO 27001 or SOC 2 Type II certification unless separately stated in writing. Some sub-processors may hold their own security certifications.

Schools that require a signed copy of these terms or a separate data processing addendum can contact support@teachergpt.co.nz.

15. Contact

Privacy, deletion, access, correction, and security questions can be sent to support@teachergpt.co.nz.