>_ data_protection
Data protection for services and schools
VI-Labs never receives pupil data: the tools keep it on the professional’s device. The only personal data we hold is about the adults who use VI-Labs, and we are its controller.
Last updated 8 November 2026
Roles
| Data | Controller | Does VI-Labs receive it? |
|---|---|---|
| Staff accounts, invitations, Community Lab posts | VI-Labs | Yes |
| Billing contacts and PO numbers | VI-Labs (Stripe also, for payment data) | Yes |
| Pupil assessments, reports, cards and plans made in the tools | Your service or school | No: kept in the browser on your device |
| School staff using Vision in 5 | No personal data is collected | Anonymous counts only |
Because we process no pupil data on your behalf, a data processing agreement for pupil data is not needed. We are happy to complete your supplier or DPIA questionnaire. The privacy notice sets out everything we hold about the adults who use VI-Labs.
Where data is held
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Clerk | Sign-in and accounts | USA | UK–US data bridge or UK contract clauses |
| Stripe | Payments and invoices | USA and EU | UK–US data bridge or UK contract clauses; PCI DSS Level 1 |
| Supabase | Community Lab, simulation playlists, Vision in 5 | EU (Ireland) | EU adequacy |
| Vercel | Website hosting | USA and worldwide edge network | UK–US data bridge or UK contract clauses |
Security
- All traffic is encrypted (HTTPS). Passwords and sign-in are handled by Clerk; card details by Stripe.
- Every subscriber tool checks the visitor’s access on each page load, and the tools’ own deployments are closed to everyone else.
- Database access is limited by row-level security: an anonymous visitor can add an activity count but never read one, and a service sees only its own schools.
- Secret keys are stored as sensitive values that cannot be read back, even by us.
- No analytics, advertising or tracking scripts run on VI-Labs.
Vision in 5 in schools
- Staff need no account, name or email. A school’s access comes from three words in the link.
- We record anonymous activity: lessons started and finished, time on a lesson while the page is visible (at most 30 minutes), and answers to short confidence questions. Nothing sent links one answer to another.
- A service sees activity per school. Confidence answers and “Did you try it?” are shown only for a whole service, from five answers, and never by school.
If something goes wrong
We will tell affected services without undue delay if a breach affects their data, and report it to the ICO within 72 hours where the law requires.
Contact
Daniel Downes, trading as VI-Labs, 23a Oaks Lane, Bradshaw, Bolton BL2 3BR. ICO registration ZC295265. dan@vi-labs.co.uk.