Privacy Policy — Student Wayfinder

1. Who we are and our role

Student Wayfinder is a careers-discovery platform for UK secondary school students, operated by PublicTech Solutions ("we", "us", "our").

Depending on how Student Wayfinder is provided, we may act either as a data controller or a data processor. Where schools provide student accounts, the school will generally act as the data controller for pupil information and we process that information on their behalf under written instructions. We remain the controller for information relating to our own business operations, security, billing, support and legal compliance, and for accounts purchased directly by parents or individuals.

General enquiries and data protection requests: support@studentwayfinder.org. Safeguarding concerns: support@studentwayfinder.org. PublicTech Solutions is registered with the UK Information Commissioner's Office (ICO) under registration number ZC207694.

School deployments

Where Student Wayfinder is provided through a school or academy trust, the school is generally responsible for determining which pupils use the service and for providing appropriate privacy information to parents and pupils. We process pupil information only in accordance with our agreement with the school and applicable data protection law.

2. What data we collect

Account data: name, email address, chosen role (student, teacher, admin), and school join code.
Assessment data: your answers to the personality preferences assessment and the resulting personality profile.
Chat data: messages you send to the AI careers assistant and the responses generated.
Billing data: for parent and school customers, billing name, email and payment metadata handled by Stripe. We never see or store full card numbers.
Support data: support requests, quote or access requests, and correspondence with us.
Technical data: IP address, browser type, operating system, device identifiers, approximate location derived from IP address, login timestamps, audit logs, error reports and security logs.

3. Why we use it (lawful basis)

Contract: to deliver the service you or your school has signed up for, and to administer accounts and billing.
Legitimate interests: to improve platform functionality, maintain service reliability, prevent misuse, detect fraud and ensure network and information security. We balance these interests against your rights and freedoms.
Legal obligation: to keep billing and tax records, respond to lawful requests, and meet safeguarding-related legal duties.
Consent: for optional communications, which you can withdraw at any time without affecting prior processing.
Vital interests: in rare cases where there is reason to believe someone is at risk of serious harm.

Where Student Wayfinder is provided by a school, the school is responsible for ensuring there is an appropriate lawful basis for providing pupil information to Student Wayfinder and for any parental notification or consent required by its own policies.

We do not sell personal data. We do not use student data to train third-party AI models.

4. AI careers assistant

The AI careers assistant is powered by Google's Gemini family of models, accessed through the Lovable AI Gateway. When you send a message, the content of your conversation (and a system instruction describing how the assistant should behave) is transmitted to the model provider so that a response can be generated. We minimise the personal information sent to the AI provider and only transmit information necessary to generate a response.

The AI assistant generates responses based on information supplied during your conversation. Human review of conversations only occurs where necessary to investigate technical issues, safeguard users or comply with legal obligations. Conversations are not used to train the underlying AI models.

Messages are screened by automated safeguards designed to encourage age-appropriate interactions and to keep discussion focused on careers and industries. Responses may be inaccurate or incomplete and should not be treated as professional careers, legal, medical or financial advice.

Automated decision-making and profiling. The personality assessment produces a profile and suggested career areas, which is a form of profiling. Student Wayfinder does not make solely automated decisions that produce legal effects or similarly significant effects on individuals. Results are informational only and do not restrict any education, qualification or employment opportunity.

5. Who we share it with (processors)

Lovable Cloud — hosting infrastructure, authentication and database services.
Google Ireland Limited and Google LLC (Gemini AI services) — used to generate AI careers assistant responses.
Stripe Payments Europe Ltd — payment processing for parent and school subscriptions.
Resend — transactional email (join codes, receipts, account notifications).

We have written agreements in place with all processors requiring them to process personal data only on our instructions and to maintain appropriate security measures. We may also disclose personal data where required by law, to protect our legal rights, or to a school's designated safeguarding lead or emergency services where there is a safeguarding concern.

6. International transfers

Personal data is primarily stored within the UK or European Economic Area. Some of our processors (including Google Ireland Limited and Google LLC and certain infrastructure and email providers) operate in, or provide support from, countries outside the UK, including the United States.

Where personal data is transferred outside the UK, we rely on an appropriate safeguard under Article 46 UK GDPR — normally UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where applicable) or the International Data Transfer Agreement / EU Standard Contractual Clauses with the UK Addendum, together with a transfer risk assessment. A copy of the relevant safeguards is available on request from support@studentwayfinder.org.

7. How long we keep it

Account data, assessment results and chat history are retained while your account is active. When you delete your account, or a school cancels its subscription, the associated personal data is normally deleted within 1 month, unless we are legally required to retain it for longer or need to retain it to establish, exercise or defend legal claims or to complete a safeguarding investigation.

Security and audit logs: normally up to 12 months.
Support correspondence: normally up to 24 months.
Safeguarding incident records: retained as long as necessary, then deleted.
Billing and tax records: up to 7 years, as required by UK accounting law.

Backups containing deleted data are overwritten on our normal rotation shortly afterwards.

8. Children and safeguarding

Student Wayfinder is designed for UK secondary school students in Years 7–13, typically aged 11 to 18. Accounts are not intended for children under 11.

For school deployments, the school acts as the sponsoring organisation and controller for pupil information and is responsible for ensuring an appropriate lawful basis and for obtaining any parental consent or notification required by its safeguarding and data protection policies. Where a parent purchases access directly, the parent is responsible for supervising their child's use.

Students should not disclose sensitive personal information (for example about health, home circumstances, or other identifiable individuals) within AI conversations. The AI careers assistant applies safeguards designed to encourage age-appropriate interactions, keeps discussion focused on careers and industries, and signposts users in distress to Childline (0800 1111). Conversations that trigger a safeguarding concern may be reviewed by authorised personnel where reasonably necessary for safeguarding, security or compliance with legal obligations and, where appropriate, referred to the school's designated safeguarding lead.

Student Wayfinder is not an emergency service. If there is reason to believe a user may be at immediate risk of harm, schools or appropriate emergency services should be contacted.

9. Security

We take appropriate technical and organisational measures to protect personal data, including:

Encryption in transit (TLS) and encryption at rest, including backups.
Hashed passwords, and multi-factor authentication enabled for administrator accounts where supported by the underlying platform.
Row-level security in the database so users can only read their own data, and least-privilege access controls for staff.
Access, audit and security logging, with monitoring for unusual activity.
Regular dependency and vulnerability scanning of our application and platform.

Business continuity. The service runs on managed cloud infrastructure with automated, encrypted backups. We maintain procedures intended to enable recovery following a service interruption or data-loss event.

10. Security incidents

If a personal data breach occurs, we will investigate promptly and notify affected individuals and regulators where required by law. Where we act as a processor for a school, we will notify the school without undue delay after becoming aware of a breach affecting its data and assist it in meeting its own notification obligations.

11. Your rights (UK GDPR)

Subject to certain conditions, you have the right to:

be informed about how your data is used (this policy);
access a copy of your personal data;
have inaccurate data corrected;
have your data erased;
restrict processing;
data portability (receive or transfer your data in a usable format);
object to processing based on our legitimate interests, and to direct marketing;
withdraw consent at any time, where processing is based on consent (this does not affect processing carried out before withdrawal);
not be subject to a solely automated decision producing legal or similarly significant effects.

To exercise any of these rights, email support@studentwayfinder.org. We respond within one month, which may be extended by up to two further months for complex requests. We may ask for proof of identity before responding to a request. Where a school is the controller for pupil data, we will normally direct the request to the school and assist it in responding.

12. Complaints

If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at https://ico.org.uk or on 0303 123 1113. You do not need to contact us before complaining to the ICO.

13. Cookies

We use only strictly necessary cookies and equivalent browser storage:

authentication cookies/tokens that keep you signed in;
session cookies that maintain your session state;
security and CSRF-protection cookies.

We do not use advertising cookies, and we do not use third-party analytics or tracking cookies. Because these cookies are strictly necessary to deliver the service you have requested, consent is not required, but you can block cookies in your browser (the service will not work correctly without them).

The controller for cookies and equivalent browser storage set by Student Wayfinder is PublicTech Solutions, registered with the UK Information Commissioner's Office (ICO) under registration number ZC207694. Questions about cookies can be sent to support@studentwayfinder.org.

14. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or a prominent in-app notice. This is version 1.0, effective 7 July 2026, with a scheduled review date of 7 July 2027.

15. Careers guidance disclaimer

Student Wayfinder provides educational guidance only and should not be relied upon as the sole basis for educational, employment or career decisions.

16. Governing law

This Privacy Policy is governed by the laws of England and Wales.