Privacy Policy

1. Who we are

Noodlet is operated by Ideonate Ltd ("we", "us", "our"). We are the data controller for the personal data of teachers and website visitors. For student data, the teacher's school or institution is the data controller and Noodlet acts as data processor — see section 6 for details.

Contact us at hello@noodlet.com for any privacy-related questions.

2. Data we collect

Teachers

• Name and email address (account registration)
• School name and country
• Lesson content you create or upload
• Class rosters (student names or identifiers you enter)
• Assignment activity — which lessons are assigned to which classes
• Login timestamps and basic usage data

Students

Students do not register directly. Teachers create student accounts on their behalf. We collect only what is needed to run assignments:

• Name or username (as entered by the teacher)
• Assignment progress and scores
• Login timestamps

Lesson code runs in an isolated sandbox on a separate domain and has no access to student account data, cookies, or any other personal information. This is an architectural guarantee — see our Safety & privacy page.

Website visitors

• IP address and approximate location
• Browser type and referring URL
• Pages visited and time spent (aggregate, not individually tracked)

We do not use third-party advertising trackers or sell visitor data.

3. How we use your data

• Delivering the service — running classes, storing lessons, tracking assignment progress.
• Account management — password resets, notifications about your account or this policy.
• Security and abuse prevention — detecting fraudulent accounts and misuse of the platform.
• Product improvement — aggregate, anonymised usage patterns to understand how the platform is used. We do not profile individual teachers or students for this purpose.
• Legal compliance — retaining records where required by law.

4. Lawful basis (UK GDPR)

For teachers and website visitors, we process personal data on the following bases:

• Contract — processing necessary to provide the service you have signed up for (account data, lesson storage, class management).
• Legitimate interests — security, fraud prevention, and aggregate product analytics.
• Legal obligation — where we are required to retain records by law.

For student data, the lawful basis is determined by the teacher's school as data controller — typically public task or legitimate interests. See section 6.

5. US data protection

FERPA

Student data held on Noodlet may constitute education records under the Family Educational Rights and Privacy Act (FERPA). Noodlet acts as a school official with a legitimate educational interest. Schools must include Noodlet in their Annual Notification of FERPA Rights to parents.

COPPA

We do not knowingly collect personal information directly from children under 13 without school consent. When teachers enrol students under 13, they act as the agent of the parent under the COPPA school consent exception. Teachers are solely responsible for providing required COPPA notices to parents and for notifying us immediately if a parent withdraws consent.

We extend these protections to all jurisdictions, not only the United States.

6. Student data — controller and processor

For student personal data, the teacher's school or institution is the data controller and Noodlet is the data processor, acting only on the school's documented instructions.

This means:

• We process student data only to deliver the service the teacher has set up.
• We do not use student data for our own purposes (advertising, AI training, analytics profiles).
• Schools can request a Data Processing Agreement (DPA) — email hello@noodlet.com.
• We will notify the school promptly of any personal data breach affecting student data.

7. How long we keep data

We may retain data beyond these periods where required by law or to resolve disputes. Archived backups are purged on a rolling 90-day cycle.

8. Who we share data with

We do not sell personal data. We share data only with the sub-processors needed to run the service:

• Cloud infrastructure — hosting, databases, and object storage.
• AI provider — lesson generation requests pass through an AI API. Request content may include lesson prompts but does not include student personal data.
• Email delivery — transactional emails (password resets, notifications).

We maintain a full sub-processor list and will share it on request. We may disclose data to law enforcement or regulators where required by law.

9. International transfers

Where personal data is transferred outside the UK or EEA, we ensure the transfer is covered by appropriate safeguards — either an adequacy decision or Standard Contractual Clauses (SCCs).

10. Your rights

Under UK GDPR and applicable US law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data (subject to legal retention requirements).
• Portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to limit processing while a dispute is resolved.
• Object — object to processing based on legitimate interests.

For student data, rights requests should come via the school (as data controller). We will assist schools in fulfilling them. Email hello@noodlet.com for any rights request and we will respond within 30 days.

If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

11. Children

Students do not self-register on Noodlet. All student accounts are created and managed by teachers. We do not knowingly collect personal data directly from children and we do not display advertising to students.

For age-appropriate information written for students themselves, see our Student Privacy Notice.

12. Changes to this policy

We will post any changes to this page and update the date at the top. For material changes affecting teacher accounts, we will also notify you by email at least 30 days before they take effect.