Demo Area
Log In

Olex.AI DPIA Support Document

Download DPIA Support Document - PDF

Last update: 13 February  2026

Note to Customer: This document is a guide provided by School Reviewer Limited (t/a Olex.AI) to assist schools and Trusts in understanding our product. As the Data Controller, you must complete your own assessment and seek your own legal or data protection guidance.

1

Project Description

  • Service Name: AI
  • Supplier: School Reviewer Limited (No. 08861959)
  • Nature of Processing: AI-driven essay review and feedback. This includes translating handwritten essays into digital format and providing AI-generated assessment and progress analysis.
  • Scope of Data:
    • Students: Names, email addresses (via SSO), UPN, date of birth, year level, class, and essay content
    • Staff: Names, email addresses (via SSO), UPN, date of birth.

2

Roles and Responsibilities

  • Data Controller: The School or Multi-Academy Trust.
  • Data Processor: School Reviewer Limited (Olex.AI).
  • Sub-processors: Full list of Sub-processors available in our AI Data Processors documentation.

3

AI Processing & Privacy Safeguards

  • Model Training:AI does not train AI models on customer data. Both OpenAI and Google Gemini (which are used as sub-processors) confirm they do not train models on data sent via the Olex.AI API.
  • Anonymisation: Student usernames associated with essay submissions are anonymised before submission to AI processors (OpenAI/Google Gemini).
  • Data Minimisation:AI does not require or encourage the inclusion of personal data within the text of the essays themselves. Notices on Olex.AI advise users to avoid including personal data within their essay submissions.
  • AI Handwriting Transcription: Students can trigger “OlexReader” calls directly to scan and translate handwriting (OCR), but schools can disable this feature to maintain control. This AI process is strictly guard-railed to only perform this OCR task.

4

Data Security and Location

  • Encryption: Data is encrypted both in transit and at rest.
  • Primary Hosting: All primary servers are Amazon Web Services (AWS) located within the UK.
  • International Transfers: Transfers to international recipients (e.g., OpenAI in the USA) are protected by appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA).

5

Data Retention

  • User Accounts: Information will be deleted at the earlier of (i) a deletion request by a Customer, or (ii) upon expiry or termination of the Agreement.
  • AI API Retention: (Anonymised) essay data sent to OpenAI/Google Gemini for processing is retained by OpenAI for maximum 30 days and Google Gemini for maximum 55 days for abuse investigation only, then deleted.

7

Safeguarding and DfE AI Safety Standards

This section details how Olex.AI aligns with the DfE AI Safety Standards and Keeping Children Safe in Education (KCSIE) expectations regarding filtering and monitoring.

  • Content Filtering & Moderation:AI employs mechanisms to moderate and filter for inappropriate content within student handwriting uploads.
  • Teacher Notification: Any inappropriate content flagged by these filters will be automatically reported to teachers for intervention.
  • Restricted Direct Interaction: Student direct interaction with AI is limited to the transcription of handwritten essays via OlexReader.
  • Teacher Oversight (Human-in-the-Loop): No AI-generated feedback or assessment data is released to the student until it has been reviewed and approved by a teacher.
  • AI Imagery Safeguards: Generation of AI imagery utilises a multi-layered moderation system, and all images require final teacher approval before being shared with students.
  • Service Control: Schools maintain the ability to disable direct student AI features (such as OlexReader) individually upon request to ensure total local control over student AI interactions.