Privacy Policy

1. Who we are

Noodlet is operated by Ideonate Ltd ("we", "us", "our"). We are the data controller for the personal data of teachers and website visitors. Session Mode does not collect learner identity. Where a UK school uses Class Mode, the school is the controller for pupil data and Noodlet acts as its processor — see section 6.

Contact us at hello@noodlet.com for any privacy-related questions.

2. Data we collect

Teachers

• Name and email address (account registration)
• School name and country
• Lesson content you create or upload
• Class rosters, only where Class Mode has been agreed with a UK school
• Assignment activity — which lessons are assigned to which classes
• Login timestamps and basic usage data

Students

In Session Mode, we collect no learner name, username, account, email address, or school identifier. Each learner has only a temporary numbered seat. In Class Mode, identity and access are managed by the school or teacher; students do not create accounts themselves. We may then collect:

• Display name or school-managed username
• Assignment progress and scores
• Login timestamps

Lesson code runs in an isolated sandbox on a separate domain and has no access to student account data, cookies, or any other personal information. This is an architectural guarantee — see our Safety & privacy page.

Website visitors

• IP address and approximate location
• Browser type and referring URL
• Pages visited and time spent (aggregate, not individually tracked)

We do not use third-party advertising trackers or sell visitor data.

3. How we use your data

• Delivering the service — running classes, storing lessons, tracking assignment progress.
• Account management — password resets, notifications about your account or this policy.
• Security and abuse prevention — detecting fraudulent accounts and misuse of the platform.
• Product improvement — aggregate, anonymised usage patterns to understand how the platform is used. We do not profile individual teachers or students for this purpose.
• Legal compliance — retaining records where required by law.

4. Lawful basis (UK GDPR)

For teachers and website visitors, we process personal data on the following bases:

• Contract — processing necessary to provide the service you have signed up for (account data, lesson storage, class management).
• Legitimate interests — security, fraud prevention, and aggregate product analytics.
• Legal obligation — where we are required to retain records by law.

Session Mode does not process learner identity. For pupil data in Class Mode, the lawful basis is determined by the UK school as data controller and recorded in the school's formal agreement with Noodlet. See section 6.

5. What we hold about learners

Rather than describe how we relate to any particular law, here is plainly what we do and do not hold. Your own legal advisers can map that onto whichever framework applies to you.

Session Mode — no learner identity

A teacher can group activities into a class and share one link for it, which they reuse from lesson to lesson. Anyone who opens it is an anonymous seat number. There is no account, login, or field for a learner's name, email address or school ID — not left blank, but absent from our systems. The teacher can watch seats working live, but nothing identifies them to us or follows them into another session. If a teacher labels seats on their own screen, those labels stay in that browser. Seats and activity clear within 24 hours.

Class Mode — UK schools by agreement

A class that remembers people between lessons does hold personal data: a display name, an optional account username, and the results of the activities assigned to them. Student identity and access are managed by the school or teacher, not created independently by a child. Because this is pupil personal data, Class Mode is currently available only to UK schools after terms have been agreed in writing.

Evaluation classes — adults only, and time-limited

So that a school can try the real thing before signing anything, we can enable evaluation classes: identical to a real class, but intended for consenting adult testers rather than pupils, marked EVALUATION throughout, and limited to 35 people. Testers confirm they are adults before starting. An evaluation class stops accepting activity 21 days after it is created and is deleted in full at 90 days.

Never

• We do not sell personal data, or use learner data for advertising or to train AI models.
• Learners cannot reach an AI model through Noodlet. Lesson code runs sealed off from the network.
• There is no public catalogue and no way for learners to share anything with each other.

6. Student data — controller and processor

Session Mode holds no student personal data. Where Class Mode is enabled under a formal agreement, the UK school is the data controller and Noodlet is the data processor, acting only on the school's documented instructions.

This means:

• We process student data only to deliver the service the teacher has set up.
• We do not use student data for our own purposes (advertising, AI training, analytics profiles).
• The processing terms and retention period form part of the school's agreement with Noodlet.
• We will notify the school promptly of any personal data breach affecting student data.

7. How long we keep data

We may retain data beyond these periods where required by law or to resolve disputes. Archived backups are purged on a rolling 90-day cycle.

8. Who we share data with

We do not sell personal data. We share data only with the sub-processors needed to run the service:

• Cloud infrastructure — hosting, databases, and object storage.
• Email delivery — transactional emails (password resets, notifications).
• Error tracking and product analytics — so we can tell when something is broken. No learner-originated data is sent to either.

There is no AI provider on this list. Teachers build lessons using whichever AI tool they already use, on their own machine; Noodlet itself does not send anything to an AI model. Learners cannot reach one either — lesson code runs sealed off from the network.

We maintain a full sub-processor list, including the region each one operates in, and will share it on request. We may disclose data to law enforcement or regulators where required by law.

9. Where your data is held

Personal data stays in the UK or EU. That covers everything, not just the main database: backups, file storage, application logs and error reports, analytics, and the service that sends our emails. It applies in every mode — including live-session data that only exists for a few hours — and to teachers and adult testers as well as pupils.

This is the same wherever you teach. We do not shard data by region or hold it closer to you; a teacher in Texas has their data in the UK or EU like everyone else.

To be straightforward about why: US hosting would not be unlawful for a UK school, and we are not suggesting otherwise. We keep everything in the UK/EU because it removes a question every data protection officer has to ask.

If that ever has to change for a particular service, we will tell schools before it happens rather than after, so they have the chance to object.

10. Your rights

Under UK GDPR and applicable US law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data (subject to legal retention requirements).
• Portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to limit processing while a dispute is resolved.
• Object — object to processing based on legitimate interests.

For student data, rights requests should come via the school (as data controller). We will assist schools in fulfilling them. Email hello@noodlet.com for any rights request and we will respond within 30 days.

If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

11. Children

Session Mode does not ask children for identity or an account. In Class Mode, identity and access are created and managed by the UK school or teacher under its agreement with Noodlet; students do not self-register. We do not display advertising to students.

For age-appropriate information written for students themselves, see our Student Privacy Notice.

12. Changes to this policy

We will post any changes to this page and update the date at the top. For material changes affecting teacher accounts, we will also notify you by email at least 30 days before they take effect.