Security & Data Protection

What this page covers

A plain-language summary of what’s actually been built, with enough detail for your school’s IT team or Data Protection Officer to assess it properly before staff sign up — not after. It describes what’s technically in place, not what’s planned; it isn’t a guarantee that ClassLens meets your particular school’s policies, so please check with your DPO before entering real pupil data if you’re at all unsure. See also the Privacy Policy for exactly what data is collected.

Data minimisation

Only a pupil’s first name and the first letter of their surname are ever stored — never a full surname, date of birth, photograph, or any SEN/medical category, and this is enforced at the database level, not just hidden in the interface. The optional “Seating support” note is for practical arrangement details only (e.g. “front”, “extra time”), never a diagnosis — typing a typical SEND label into that field is automatically stripped before saving.

Data retention

RAG observation records older than two years are deleted automatically, every week. On top of that, every teacher is expected to use “Download all and clear” (Settings) at least once per academic year, removing pupil, seating, and observation data that’s no longer needed. Together these are designed to meet the UK GDPR’s storage limitation principle (Article 5(1)(e)): personal data isn’t kept for longer than it’s needed.

Hosting

Pupil and teacher data is stored with Supabase, in Amazon Web Services’ London (eu-west-2) data centre — the data itself physically stays in the UK.

Built on US-incorporated services, though. Supabase Inc. is a US company, even though its servers here are in London — some schools’ policies treat this as relevant (for example under the US CLOUD Act) regardless of where the data physically sits. The same is true of Vercel (application hosting) and Resend (transactional email), both also US-incorporated. If your school has a policy against US-incorporated service providers specifically, this is the point to raise with your DPO.

Access control

Every table in the database enforces Row-Level Security scoped to the signed-in teacher — one teacher can never see another’s classes, pupils, or data. This is checked by the database itself on every request, not just by the application’s own interface, so it holds even against a direct API call.

Encryption

All traffic between your browser and ClassLens is HTTPS-only; Supabase encrypts stored data at rest as standard.

Data processors

Supabase (database, authentication, file storage), Vercel (application hosting), and Resend (transactional email) are the three services that process ClassLens data. Each publishes its own Data Processing Agreement (DPA) — your DPO can request and review these directly as part of your school’s own assessment.

If something goes wrong

ClassLens is built and operated by a single developer, not a dedicated security team — a documented internal procedure exists for responding to a suspected data breach (detection, containment, assessing UK GDPR’s 72-hour notification requirement, and notifying affected schools directly), rather than an ad-hoc response. Details of that procedure are operational rather than published here; your DPO can request a summary.

Backups

ClassLens does not currently provide or guarantee automated backups. See the Terms of Service for what this means in practice, and use Settings → Download all and clear to keep your own copy of your data at any time.