Privacy policy for schools

The participating school decides which classroom activities take place and which work it publishes. Its responsible legal body—such as its Board of Management or ETB—must be identified in the school’s notice. Contact the school office or its named data-protection contact about a school project.

The platform operator’s legal identity, privacy contact and controller/processor roles are to confirm. Where the operator processes school information on the school’s instructions, those arrangements must be documented in a data-processing agreement. Separate operator purposes, such as account administration, also need a stated lawful basis.

• Staff accounts: names, email addresses, authentication records and school roles support login and administration.
• Classroom work: class/project details, a contributor name if entered, drafts, uploaded files, titles, credits, feedback and review status support creating and checking experiences. Pupils join with a class code; the student workflow does not require a pupil email address. A browser-specific work key distinguishes drafts.
• Media: photos, voices, written memories, videos, panoramas and models may contain personal information. Sources include pupils, staff, interview participants and archives identified in project credits. Schools should use only material appropriate for the activity.
• Technical operation: authentication and hosting services handle connection information. Error reporting can include the page path and error details. The deployed logging, analytics and cookie configuration needs verification before this draft is final.

The platform’s review workflow uses teacher decisions, not automated grading or automated publication. External AI generation is described separately below.

The school must record a lawful basis for each purpose. Depending on its circumstances, classroom processing may rely on a legally grounded public task or legal obligation. Public publication needs a separate assessment; classroom participation does not itself authorise online sharing. If consent is used, it must be freely given, specific, informed and withdrawable. The applicable bases and any underlying legislation are to confirm for each school.

A class code and work key are needed to save and retrieve pupil work; staff login is needed for teacher functions. Public viewing does not require a pupil account. AR camera permission is optional: the normal story page remains available. The school should explain alternatives where a child does not take part in optional recording or publicity.

School access controls separate private school projects from public experiences. Submitted pupil work can be reviewed by authorised staff. Approval into a project is separate from publication. School pages and experiences become public only through the relevant staff publishing controls.

Published stories and their media can be opened through public links or QR codes, including by people outside the school. They may be copied, downloaded or indexed. Unpublishing stops future access through the platform’s public media checks, but cannot recall copies already obtained by others.

The application uses Supabase for authentication, database and media storage, Lovable for the website environment, and Google Fonts for font delivery. Loading external fonts sends a request to Google. The operator must confirm the contracting entities, full provider list, access arrangements, hosting locations and any international-transfer safeguards. This draft makes no promise that every service or backup is stored only in Ireland or the EEA.

The AR camera opens after a user action and permission. Recognition and rendering happen in the browser. Starting AR does not start a microphone recording. An audio or video file deliberately uploaded to a project is stored as project content; that is different from the live AR camera view.

Links to ChatGPT, Meshy and HeyGen open separate services. The guide does not automatically send project files to them. If a teacher chooses to upload an image or script there, that service’s terms and privacy arrangements apply. Schools should assess the service before use, use permitted material and label AI-created historical scenes as reconstructions.

The site uses browser storage for login/class sessions and the pupil’s private work key. Older local drafts can also use localStorage and IndexedDB. Clearing browser data may remove access to local drafts or the key needed to retrieve school drafts; it does not delete records already stored online.

Retention periods are to confirm. The school and operator must agree periods or clear criteria for accounts, unfinished work, submitted work, published projects, technical logs and backups. A classroom project ending does not currently mean its records are automatically deleted. Archival school history may need a different assessment from identifiable pupil contributions.

Contact the school to request correction, withdrawal from publication or deletion. Staff can unpublish an experience; removing a public page is not the same as deleting underlying files, records or backups. Full deletion requests may require operator assistance.

Depending on the circumstances, you may request access, correction, deletion, restricted use or a portable copy, and object to processing. You may withdraw consent where it is the basis used, without changing the lawfulness of earlier use. These rights have conditions and exceptions. Children have their own rights; a parent’s request must take account of the child’s circumstances.

Start with the school office or its data-protection contact. Include the project or experience link and the help you need. Reasonable identity checks may be required. The controller must normally respond within one month; a necessary extension of up to two further months must be explained within the first month.

You can complain to Ireland’s Data Protection Commission. The Department’s DPO handles Department processing, not privacy requests for this independent platform.

The platform uses authenticated staff access, role checks, private media storage and publication checks. Class codes and browser work keys should be kept private. Report unexpected access, a lost shared device or an incorrectly published item to the school promptly so it can involve the operator and assess the incident. No website can guarantee absolute security.

• School controller identity and contact, and DPO contact where applicable.
• Platform operator’s legal name, address, privacy email and allocation of responsibilities.
• Purpose-specific lawful bases, publication permissions and the school/operator agreement.
• Retention/deletion schedule, backup handling, providers, locations and transfer safeguards.
• Deployed cookies, analytics, font and diagnostic services; any required consent controls.
• School review of risks to children and whether a data-protection impact assessment is needed.

The school’s authorised decision-maker and data-protection adviser should review the completed notice. Material changes should be explained to schools and families; the date above should be updated when the notice changes.

• Department of Education and Youth: data protection
• Department: GDPR privacy notices
• Data Protection Commission: Schools Toolkit
• DPC: what a privacy notice must explain
• DPC: children’s data protection rights
• DPC: responding to rights requests