Pilot rule: use non-sensitive teaching material only
Do not upload pupil names, SEND/SEN information, health information, safeguarding information, assessment records tied to identifiable pupils, or other personal/confidential data to this pilot/development environment.
What Planner currently stores
- Licensed-user identity information needed for access control, such as email, display name, identity-provider binding and last sign-in.
- Hashed session tokens for authenticated sessions.
- Converted Office PDFs temporarily, scoped to the signed-in user and expiring after 15 minutes.
- Saved .vct Books only when the teacher explicitly saves/downloads them; they are not automatically uploaded to a central document library.
AI processing
- When AI planning is requested, the canonical PDF and extracted source context are sent server-side to the Gemini Developer API.
- The API key stays on the Planner server and is not exposed to the teacher's browser.
- The current Planner does not use Google Drive or Workspace Studio to move teaching files around.
- Model output is returned as Planner JSON and held only for the short-lived planning job.
Before production use with school data
A production deployment needs the boring-but-important paperwork and controls as well as good code: a documented controller/processor model, lawful basis, DPIA where appropriate, data-processing terms, subprocessor information, retention/deletion policy, incident handling, access controls and the school's approval of the AI service being used.
This page intentionally does not claim “GDPR compliant” as a magic badge. Compliance depends on the deployed service, contracts, configuration, data actually processed and the organisation using it.