Privacy Policy

Last updated: 19 October 2026

1. Introduction

Welcome to educhate.

educhate is a free, independently developed educational platform based in the United Kingdom. It provides educational resources, revision activities and interactive classroom tools designed to support teaching and learning.

educhate is currently operated as a non-commercial, independent educational project.

We are committed to protecting your privacy and handling personal information responsibly and transparently.

This Privacy Policy explains what information we collect, why we collect it, how it is stored, who it may be shared with and your rights under UK data protection legislation.

This policy applies to all users of educhate, including teachers and students.

2. Who operates educhate?

educhate is independently owned and operated by an individual based in the United Kingdom.

Website: educhate.com

Operator: Tom Chate

Country: United Kingdom

The operator is responsible for determining how personal information is used for educhate’s account management and the operation of its educational platform.

Where schools use educhate to deliver classroom activities, the respective data protection responsibilities of the school and educhate will depend on how the service is used and the arrangements in place.

3. Information We Collect

We aim to collect and store only the personal information necessary to operate educhate.

3.1 User Accounts

Teachers and administrators sign in through Clerk, our third-party authentication provider, to access account features. Students can join Digiboards using a session code and a name or nickname without signing in to Clerk.

Users authenticate through a supported identity provider, such as Google or Microsoft.

During authentication, Clerk retrieves information made available by the identity provider, including the user’s first name and last name.

educhate stores the following account information in its MongoDB database:

We use unique Clerk User IDs to manage teacher and administrator accounts. Digiboards student responses are associated with a participant record in a particular session, not with a Clerk account.

Clerk may process additional information, including email addresses, authentication identifiers and session information, to provide its authentication services.

educhate does not require users to create a separate username and password within its own database.

3.2 Interactive Classroom Activities

educhate provides interactive classroom activities, including:

When participating in these activities, users may submit written responses or other information requested by the activity.

To operate these features, educhate processes:

Responses are associated with the participant record for that session. Student names and responses are visible to the teacher running the session. Depending on the activity and settings, results may also be shown on a shared display.

Digiboards responses are not anonymous within a session: they are associated with the participant’s chosen name or nickname.

3.3 Technical Information

When you access educhate, some technical information may be processed automatically by our hosting and authentication providers.

This may include:

This information is used to deliver the website, maintain its functionality and help protect the platform from technical problems or misuse.

3.4 School Enquiries

Visitors can submit a school enquiry without signing in. The form collects a contact name, school name, work email address, enquiry type and any message provided. A role may also be provided but is optional.

School enquiry information is stored in MongoDB so educhate can respond to the enquiry and manage follow-up. Access to enquiry records is restricted to authorised platform administrators.

For abuse prevention, the application processes the request’s source IP address to enforce a submission rate limit. It stores a one-way SHA-256 hash of the source IP in a separate, temporary rate-limit record rather than storing the raw IP address there. These records are scheduled for deletion after the one-hour rate-limit window; deletion by the database’s expiry process may not be immediate.

4. How We Use Your Information

educhate processes personal information to provide and maintain its educational services.

This includes:

User Authentication

To identify registered users, manage account access and enable users to sign in securely.

Educational Activities

To allow users to participate in interactive classroom activities and submit responses.

Session Management

To associate responses with the appropriate classroom session and participant.

Website Operation

To maintain the functionality, reliability and security of the platform.

Support and Communication

To respond to enquiries, investigate reported problems and manage requests relating to personal information.

School Enquiries

To respond to school contact requests and manage follow-up about educhate.

educhate is a free educational platform and does not currently use personal information for targeted advertising or marketing.

Under UK GDPR, organisations must identify an appropriate lawful basis for each purpose for which they process personal information.

For educhate’s own account management, educational access and essential website operations, legitimate interests may be an appropriate lawful basis, where the processing is necessary and users’ rights and freedoms are appropriately protected.

The relevant interests include operating a free educational service, enabling classroom participation and maintaining the security of the platform.

Where personal information is processed on behalf of a school, the school may determine the lawful basis for processing its pupils’ information.

[To confirm before publication: the lawful basis for each processing purpose and educhate’s controller or processor role for school activities.]

In particular, the interests and rights of children must be considered carefully when assessing whether legitimate interests can be relied upon.

5. Children’s Privacy

educhate provides educational resources and interactive activities that may be accessed by children, including secondary school students.

We recognise that children’s personal information requires particular protection.

We aim to minimise the amount of personal information collected and retained when children use the platform.

Teachers and administrators authenticate through Clerk. Students can join Digiboards with a session code and a chosen name or nickname.

During Digiboards activities, submitted responses are associated with the participant record for that session, rather than a Clerk User ID.

We encourage users not to include unnecessary personal or sensitive information in classroom responses.

Teachers should ensure that activities are appropriate for their students and avoid requesting unnecessary personal information.

We are committed to providing clear, understandable information about how personal data is used.

6. Third-Party Service Providers

educhate uses third-party technology providers to operate its educational platform.

These providers may process personal information where necessary to deliver their services.

Clerk

Clerk provides authentication and account management.

It enables users to sign in through supported identity providers and manages information required for authentication and account security.

Further information is available through Clerk’s published privacy documentation.

MongoDB

educhate uses MongoDB to store application information, including registered users’ first and last names.

MongoDB is also used to manage information associated with interactive classroom activities.

The MongoDB database is hosted in Europe.

Google Firebase

educhate uses Google Firebase Hosting to deliver its website.

Firebase provides hosting infrastructure and a dashboard containing technical usage information, such as website requests, bandwidth and hosting usage.

Firebase Hosting processes technical information, including IP addresses, to deliver content and monitor usage.

According to Google’s published documentation, Firebase Hosting retains IP address information for a period of a few months.

educhate does not currently use Firebase Analytics or Firebase Performance Monitoring.

External Identity Providers

When users sign in through an external authentication provider, such as Google or Microsoft, that provider processes authentication information in accordance with its own privacy practices.

educhate does not control the independent processing activities of these identity providers.

International Data Transfers

Some of our technology providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, applicable UK data protection requirements and appropriate safeguards must be considered.

[To confirm before publication: relevant processing countries and applicable international transfer arrangements for Clerk, MongoDB and Firebase.]

7. How Long We Keep Your Information

educhate aims to retain personal information only for as long as necessary to provide its educational services.

7.1 School Enquiries

School enquiry details and any associated internal follow-up notes are kept only for as long as needed to respond to and manage the enquiry. We do not currently use a fixed automatic expiry period for these records; they are reviewed and deleted when they are no longer needed.

Rate-limit records contain a one-way hash of the source IP address and are scheduled for deletion after the one-hour rate-limit window, although expiry processing may take additional time.

7.2 Registered User Information

Users’ first and last names are stored in MongoDB to support their educhate account.

This information is retained while it is required for account management.

Users can delete their authentication account through Clerk.

However, deleting a Clerk account does not currently automatically remove corresponding personal information from MongoDB.

Users who wish to request the removal of any remaining personal information can contact educhate using the contact details in this policy.

We will handle valid deletion requests in accordance with applicable data protection requirements.

7.3 Live Classroom Activities

Responses submitted through Digiboards, polls and word clouds are stored while the relevant classroom session remains active.

Teachers can end a session using the controls provided by educhate. Sessions also expire automatically, after eight hours by default.

When a session is ended or expires, participant records and responses are deleted from the live database. An overview of the session and its activity definitions are retained for the configured retention period, which is 30 days by default.

If a teacher closes their browser without ending a session, it remains active until it expires automatically.

7.4 Technical Information

Some technical information may be retained by our hosting and authentication providers for operational, diagnostic and security purposes.

Retention periods depend on the relevant provider and the services being used.

7.5 Backups and Logs

Deletion from the live application database may not necessarily remove information immediately from service-provider backups or technical logs.

[To confirm before publication: whether personal information appears in backups or logs, and the applicable deletion periods.]

8. Account Deletion

Users can delete their educhate account through the account management functionality provided by Clerk.

Deleting an account through Clerk removes the associated Clerk authentication account.

However, the deletion of an authentication account does not currently trigger the automatic deletion of all associated information stored in educhate’s MongoDB database.

Users may request the deletion of remaining personal information by contacting educhate.

We may need to verify the identity of the person making a request before removing personal information.

Where a valid request is received, we will take appropriate steps to remove the relevant personal information, subject to any applicable legal exceptions.

Account deletion does not necessarily result in the immediate removal of information from third-party backups or technical logs.

9. Cookies and Similar Technologies

educhate does not use analytics or advertising cookies.

Essential Authentication Cookies

Clerk may use essential cookies or similar browser storage to maintain authentication sessions and allow signed-in teachers and administrators to remain signed in.

These technologies help provide the secure authentication functionality required to access educhate.

Strictly necessary authentication cookies generally do not require consent under UK cookie rules, although users must still receive appropriate information about them.

Analytics and Advertising

educhate does not currently use:

Firebase Hosting’s standard technical usage dashboard is used to monitor website hosting activity.

The website also uses local browser storage, which is separate from cookies, for preferences and to save certain learning activity state. Digiboards uses local storage to help a student reconnect to a session.

10. How We Protect Your Information

educhate aims to protect personal information through appropriate technical and organisational security measures.

The platform uses established third-party services for authentication, data storage and website hosting.

Access to personal information should be restricted to authorised individuals and systems where necessary.

We aim to minimise unnecessary collection and retention of personal information.

No website or online service can guarantee complete security.

If you believe you have identified a security or privacy concern involving educhate, please contact us using the details provided in this policy.

11. Your Data Protection Rights

Under UK GDPR, individuals have rights relating to their personal information.

Depending on the circumstances, these may include:

Right of Access

You may request a copy of the personal information held about you.

Right to Rectification

You may request that inaccurate or incomplete personal information be corrected.

Right to Erasure

You may request the deletion of your personal information where the right applies.

Right to Restrict Processing

You may request that the use of your personal information be restricted in certain circumstances.

Right to Data Portability

Where applicable, you may request that your information be provided in a commonly used, machine-readable format.

Right to Object

Where educhate relies on legitimate interests to process your personal information, you have the right to object to that processing.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent.

To exercise your rights, please contact educhate.

We will respond to valid requests without undue delay and normally within one calendar month, subject to applicable legal provisions.

12. Information for Schools and Teachers

Schools and teachers may use educhate to support teaching and learning.

Where a school uses educhate to process pupils’ personal information, the school and educhate must establish their respective responsibilities under applicable data protection legislation.

Depending on the circumstances, a school may act as the data controller for classroom activities, with educhate acting as a data processor.

Schools remain responsible for determining whether the technologies they use are appropriate for their pupils and educational activities.

Teachers using educhate should:

Where educhate processes personal information on a school’s behalf, appropriate data processing arrangements may be required.

13. Information Commissioner’s Office (ICO)

educhate is currently operated as a free, independently developed educational project.

In October 2026, educhate’s operator completed the Information Commissioner’s Office (ICO) data protection fee self-assessment.

Based on the information provided, the assessment indicated that educhate was not required to pay the ICO data protection fee at that time.

This exemption relates specifically to the ICO data protection fee and does not constitute approval or certification by the ICO.

It does not remove any applicable responsibilities under UK GDPR or the Data Protection Act 2018.

educhate will review its position if its activities, structure or data-processing arrangements change.

The ICO confirms that organisations exempt from paying the fee must still comply with their applicable data protection obligations.

14. Complaints

If you have concerns about how educhate handles your personal information, we encourage you to contact us so that we can investigate.

You also have the right to complain to the Information Commissioner’s Office, the UK’s independent data protection regulator.

You can find further information about raising a complaint on the ICO website.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

When the policy is updated, the revision date at the top of this page will be changed.

Where significant changes affect the way personal information is processed, we will provide additional notice where appropriate.

16. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data protection rights or want to raise a concern about how your information is handled, please contact:

educhate

Website: educhate.com

Operator: Tom Chate

Location: United Kingdom