Privacy Notice
SLT AI provide AI-based services to schools, looking to use AI to improve existing information and approaches to the range of tools used by schools on the day-to-day management and operation, and support strategic planning.
As customers or visitors who want to interact with us and our tools, you should always feel safe and secure about how your data is handled, and we shall always be transparent with you about this.
To do this, we make use of personal data and other information you provide. This notice is to help you understand how we use your personal data on our general website, for marketing and for sales. It will also help to explain how we work to comply with the General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18) and the Privacy and Electronic Communication Regulations (PECR). It is based on the Information Commissioner’s Office’s tool for generation of Privacy Notice and will cover the following:
- Contact details
- What information we collect, use, and why
- Lawful bases and data protection rights
- Where we get personal information from
- How long we keep information
- Who we share information with
- How to complain
To find out more about how we process personal data on behalf of you as a school (i.e. provide users accounts and roles), please look at our Data Processing Agreement here. This covers both our free tools and our subscription services.
Contact Details
In all cases, if you have any questions about the uses of your data, or wish to raise any of your subject rights, then you can contact our Data Protection Officer, Craig McKee, at info@sltai.co.uk
SLT AI is registered with the ICO – ZB378294
Information we Collect
Where we get personal information from:
- Directly from you
- Publicly available sources
Personal Information – we may collect the following information from users:
- Name
- Email address
- Billing information
- School details
Usage Information – in order to enhance and improve our service, we collect and store general information about the queries entered into our AI system. This includes number of tool uses and user feedback to consider further development needs. This information is only visible to staff at SLT AI and are not shared. This does not impact on the Data Processing Agreement that would be in place for free and subscribing members.
Cookies and Analytics – we use cookies and similar tracking technologies to collect information about your use of our website. This helps us analyse trends, administer the website, track users’ movements, and gather demographic information. We also utilise Google Analytics to assist us in understanding website traffic and usage patterns. These analytics services may collect information such as your IP address, browser type, operating system, and referring URLs. These are deemed essential to ensure the delivery of our website.
Google / Microsoft calendar Integration
Information we collect: In addition to the personal information outlined above, with your consent, we collect:
- Calendar data for the upcoming 7-day period
- Calendar event details including: event titles and descriptions
Use of Information
Calendar Data – We use the calendar information we collect for the following purposes:
- To analyse your upcoming schedule and identify relevant activities
- To generate personalised recommendations for tools that may assist with your scheduled activities
- To send targeted emails containing these recommendations
Data Processing
- Calendar data is processed by our AI system to generate contextual recommendations
- We access calendar data in read-only mode; we do not create, modify, or delete any calendar events
- Calendar data is processed automatically and is not manually reviewed by SLT AI staff except for troubleshooting purposes
Use of Information
Personal Information – we may use the personal information we collect for the following purposes:
- To communicate with you, including responding to your inquiries and providing customer support,
- To send you service-related notifications and updates,
- To share a range of resources, including promotional materials, case studies and educational practices
- To process transactions and manage your billing information,
- To comply with legal obligations and protect our rights,
Usage Information – This enables us to ensure that you can access the site and also subsequently sign up to any usage covered under the Data Processing Agreement.
Data Sharing
Data Processors – we make use of contracted service providers to perform various functions necessary to operate our business. These providers have access to personal information only to the extent necessary to perform their functions and are contractually obligated to maintain the confidentiality and security of the data.
Marketing and Communications – To support our communications with customers and potential customers, we use contracted marketing, Brevo. This will include the school details, your email address and your name. This enables us to provide service messages, account messages, resources and marketing communications, as and when required or requested.
Legal Requirements – we may disclose your personal information if required to do so by law or if we believe that such action is necessary to comply with legal obligations, protect our rights or property, or ensure the safety of our users.
AI Model Training – With general use and access to our website, none of your questions, input or responses will be used to train any of our models or any publicly available AI models. We do not share any information that you have entered into, or received from, our AI tools
Google – As a third-party service provider, Google processes authentication and calendar data. Their privacy practices are governed by their own privacy policy.
Email Service Provider – We use our existing email service provider, Brevo, to send recommendation emails based on calendar analysis.
Data Storage
Our website is hosted in the UK.
Data Security
We implement reasonable security measures to protect the confidentiality, integrity, and availability of user information, including the review of any of our partners/contractors/data processors. All information held or transferred is done over encrypted transfer, making use of security analysis tools and, where appropriate, with partners who have undergone security assessments.
Google Calendar Security Measures
- OAuth 2.0 authentication protocols to ensure secure access to calendar data
- Limited permission scope (read-only access)
- Secure API connections using HTTPS
- Data encryption during transit and at rest
Google / Microsoft calendar Controls
- You can revoke calendar access permissions at any time through your Google / Microsoft account settings or through your School Information page
- You can request deletion of any stored calendar data by contacting our Data Protection Officer via info@sltai.co.uk
Data Retention (how long we keep information)
We only retain personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.
Who we Share Information With
Data Processors:
- Siteground – This data processor does the following activities for us: Website and platform host.
- Woopayments – This data processor does the following activities for us: Payment Services
- Xero – This data processor does the following activities for us: Payment Services and Accounting
- Brevo – This data processor does the following activity for us: Customer relationship management
- Google Cloud – This data processor handles the following activities for us: Authentication and Calendar API access.
- OpenAI – This data processor does the following activities for us: AI query processing and response generation
- Anthropic – This data processor does the following activities for us: AI query processing and response generation
- Google – This data processor does the following activities for us: AI query processing and response generation
- Mistral – This data processor does the following activities for us: AI query processing and response generation
We only retain personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.
Payment Processing
To ensure the financial safety and security of customers, we have chosen to work with payment providers who are noted for their stringent security measures and practices, as mentioned in our list of Data Processors.
For both options we do not collect, store, or process your payment information. All payment data is securely handled by our payment processors. They are compliant with relevant data protection laws and regulations, including, where applicable, the Payment Card Industry Data Security Standard (PCI DSS). In order to complete a payment or invoice, you will be required to provide certain payment details, including but not limited to your credit/debit card number, card expiration date, CVV, and billing address.
Card payment: we use a specific payment processor, Woopayments, to process debit and credit card payments made through our website.
Invoicing: For invoicing purposes, we use Xero accounting software.
For more information on how your payment information is processed and secured, please refer to the privacy policies of Woopayments (Stripe) and Xero.
Information Sharing – we may share limited information with our payment processors and accounting software for the purposes of processing payments, managing invoices, resolving disputes, and for other related services. This information does not include sensitive payment details such as your full credit card number or CVV.
Lawful Basis and Data Protection Rights
Our lawful bases for collecting or using personal information to provide services and goods are:
- Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
- Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
- Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
- Where interest is expressed in particular tools, we may suggest alternatives as part of sharing case studies and best practices.
Our lawful bases for collecting or using personal information for the operation of customer accounts and guarantees are:
- Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Our lawful bases for collecting or using personal information for service updates or marketing purposes are:
- Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
- Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
- Where interest is expressed in particular tools, we may suggest alternatives as part of sharing case studies and best practices.
Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:
- Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Our lawful bases for collecting and processing your Calendar data are:
- Consent – We will obtain your explicit consent before accessing your Google / Microsoft Calendar data. You can withdraw this consent at any time through your account settings or by contacting our Data Protection Officer.
- Legitimate interests – Processing calendar data enables us to provide personalised recommendations that benefit you in your professional capacity.
Changes to this Privacy Notice
We reserve the right to modify or update this Privacy Notice from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify users of any material changes through our website, by service messages and/or by other means.