1. Introduction

Project Designer ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

The service is designed to support schools' data-protection obligations. Personal data is disclosed only as described below, including to the service providers needed to operate Project Designer.

2. Information We Collect

2.1 Personal Information

Name, email address, school affiliation
Authentication credentials (via Google OAuth)
Profile data (job role, subject specialization)
Project and curriculum data you create
File uploads (documents, images, resources)

2.2 Automatically Collected Data

IP address (anonymized for analytics)
Browser type, device type, operating system
Pages visited, features used, time spent
Crash reports and error logs

3. How We Use Your Information

Service Delivery: Create accounts, store curriculum, enable collaboration
Improvement: Analyze usage patterns, improve features, fix bugs
Security: Detect abuse, prevent fraud, enforce terms
Communication: Send service updates, support responses (with your consent)
Legal Compliance: Fulfill GDPR, safeguarding, and regulatory requirements

4. Data Sharing & Third Parties

We do not sell personal data. We disclose data only where needed to provide and secure the service, follow school instructions, or meet legal obligations, including to:

Service Providers: Cloud hosting (encrypted), payment processing (Stripe), email delivery
School Administrators: Only within your school (data isolation enforced)
Legal Requirements: Law enforcement, court orders, safety threats

Appropriate contractual and international-transfer safeguards are documented in the applicable school DPA and current sub-processor schedule.

5. Data Retention

Active Accounts: Data retained while account is active
School Instructions: School-controlled data is returned or deleted on verified instruction, subject to legal obligations and the agreed DPA
Operational Records: Security, support and transaction records are retained only for documented operational or legal needs
Backups: Deletion from technical backups follows the hosting provider's recovery lifecycle; backup data is not used for normal product operation

6. Your GDPR Rights

If you are in the EU or UK, you have the right to:

Access: Request a copy of your data
Rectification: Correct inaccurate data
Erasure: Request deletion ("right to be forgotten")
Restrict: Limit how your data is used
Portability: Export your data in standard format
Object: Opt out of marketing communications

To exercise these rights, email privacy@projectdesigner.app. We will verify identity and authority, coordinate with the relevant school controller where appropriate, and respond within the applicable statutory timeframe.

7. Security

We protect your data with:

HTTPS for data in transit and hosting-provider controls for stored data
School-scoped row-level access rules and role-aware permissions
Authenticated server functions for sensitive operations
Dependency scanning and security regression tests
Incident investigation and notification procedures

8. Student Safeguarding

Because Project Designer is used by students, we implement special protections:

Student work is restricted to the student and authorised school staff
Students receive only assigned, published learning content
There is no student-to-student direct messaging feature
Assessment answer keys and grading rubrics are not delivered before submission
Schools control enrolment, lawful basis, notices and retention instructions

9. Cookies & Tracking

We use cookies only with your consent. See our Cookie Policy for details.

Analytics are disabled until you accept consent.

10. Contact Us

Questions about privacy? Contact us or email privacy@projectdesigner.app

Privacy Policy