When a school adopts a learning platform, it is trusting that platform with children’s personal data — and it remains accountable for that data. So it is fair for schools to ask exactly how a platform protects student data. This article explains, transparently, how AI Buddy is designed to protect the data of the pupils who use it, mapped to the data protection principles schools are required to uphold.
Quick summary
- AI Buddy is built on a privacy-by-design foundation, aligned to UK GDPR.
- Pupil data is minimised and pseudonymised — only necessary information is shared.
- Data is encrypted and hosted on AWS, with anonymisation on account closure.
- Governance includes a documented data protection policy, DPIA, defined data subject rights, staff training and regular reviews.
- AI Buddy is not endorsed or certified by Ofsted — it is built to support the areas Ofsted evaluates, and to protect pupil data.
Privacy by design, not as an afterthought
AI Buddy, built by Tutopiya, treats data protection as a core design principle rather than a bolt-on. Privacy considerations are built into how the platform collects, shares and stores information — the “data protection by design and default” approach UK GDPR expects. This is the foundation everything else rests on.
Data minimisation and pseudonymisation
AI Buddy is designed to collect and share only what is necessary:
- Student identity is pseudonymised — for example, a student’s first name is shown with only the initial of the last name.
- Only relevant information is shared with a tutor — such as country, syllabus, subject and academic performance — not a pupil’s full personal profile.
Holding and sharing less data is the most effective protection, reducing risk by design.
Secure, encrypted hosting
Pupil data is stored securely on AWS, with encryption applied to data transmitted across the network and additional layers of protection. Reputable, encrypted cloud infrastructure means data is protected against unauthorised access, loss or disclosure.
Responsible retention and anonymisation
AI Buddy follows a considered retention approach: data is kept only as long as necessary, and when an account is disabled or no longer active, personal data is anonymised — irreversibly removing identifying information so individuals cannot be re-identified, while retaining value for analysis. This balances data utility with data protection.
Transparency and consent
- A data protection and privacy policy and a privacy notice for parents are available on the platform for pupils, parents and tutors to view.
- Stakeholders are informed about how their data is used, with confirmation sought for data storage.
Transparency is a GDPR principle, and AI Buddy is designed to make its data practices visible.
Data subject rights
AI Buddy’s governance supports the data subject rights UK GDPR grants — the rights to access, rectify, erase, restrict and object to processing — with processes to address requests and the right to complain to the relevant data protection authority.
Documented governance and DPIAs
AI Buddy’s data protection is documented, not just claimed:
- a Data Protection Impact Assessment (DPIA) identifying risks and mitigations,
- data protection and GDPR policies,
- staff data protection training, and
- regular reviews and audits to ensure ongoing compliance.
This documentation makes a school’s own vetting and DPIA more straightforward — see Questions Schools Should Ask Every EdTech Provider.
Quality assurance and oversight
Learning sessions on the platform are recorded, monitored and evaluated by a quality assurance team, supporting both educational quality and a safe, accountable online environment — see Safeguarding in Online Learning Environments.
How this maps to what schools must do
| School obligation | How AI Buddy supports it |
|---|---|
| Data minimisation | Minimised, pseudonymised pupil data |
| Security | Encrypted AWS hosting |
| Storage limitation | Retention with anonymisation on closure |
| Transparency | Privacy policy and parent notice on platform |
| Data subject rights | Processes for access, rectification, erasure, restriction, objection |
| Accountability | Documented DPIA, policies, training and audits |
Frequently asked questions
How does AI Buddy minimise pupil data?
It collects and shares only necessary information and pseudonymises student identity (for example, first name with last-name initial).
Where is AI Buddy’s data stored?
Securely on AWS, with encryption in transit and additional protection layers.
What happens to data when an account is closed?
Personal data is anonymised — irreversibly removing identifying information — while retaining value for analysis.
Does AI Buddy support data subject rights?
Yes. Its governance supports the rights to access, rectification, erasure, restriction and objection, with processes to address requests.
Is AI Buddy endorsed by Ofsted?
No. AI Buddy is not endorsed or certified by Ofsted. It is designed to support the areas Ofsted evaluates and to protect pupil data.
Does AI Buddy have a DPIA?
Yes. It maintains a documented DPIA identifying risks and mitigations, which supports a school’s own assessment.
Conclusion
AI Buddy protects student data the way schools are required to: by minimising and pseudonymising data, securing it with encryption, retaining it responsibly, being transparent, supporting data subject rights, and documenting its governance through DPIAs, policies, training and audits. Because a school remains accountable for the data it entrusts to any platform, this design is intended to make that trust well-placed — and the school’s own compliance easier.
How AI Buddy supports schools
Protecting student data is inseparable from AI Buddy’s wider purpose: supporting schools in strengthening the areas evaluated during Ofsted inspections — curriculum-aligned practice, assessment, learning-gap insight and leadership analytics — on a platform that is secure and GDPR-aligned by design. AI Buddy is not endorsed or certified by Ofsted; it is built so that strengthening teaching and learning never comes at the cost of pupil privacy.
Discover how AI Buddy helps schools strengthen teaching, learning and evidence-informed school improvement. Or start a short consultation with our schools team using the form below.
Sources
- Information Commissioner’s Office, Data protection by design and default (ICO)
- Information Commissioner’s Office, UK GDPR guidance and resources (ICO)
- Data Protection Act 2018 (legislation.gov.uk)