Privacy notice

Your school is the data controller and decides why and how student data is used. Outleap acts as a processor under the signed school agreement and Data Processing Agreement. This page is a procurement summary and should be read alongside the trust pack and the agreed contract.

What we process today

The processing below is live in the current product. Each item runs only for the cohorts and modules your school has activated:

• Evidence Bank entries that students build and own.
• The UCAS three-question personal statement workflow, including AI feedback on drafts.
• CVs, cover letters, competency answers and non-university applications.
• Cohort visibility for staff, including progress, exception flags and logged interventions where a workflow involves submission or staff review.

UK GDPR alignment

Lawful basis

The school, as data controller, decides and documents the lawful basis for processing in its own records and DPIA. Schools typically rely on a public task or legitimate interests basis for structured educational support, or contractual necessity where Outleap is engaged as part of the post-18 programme. We support that assessment; we do not make it for the school.

Data minimisation

We collect only what the platform needs to operate: student name, email, school affiliation, Evidence Bank entries, UCAS statement drafts and feedback, CVs, cover letters, competency answers, non-university application records, and the cohort metadata staff need to track progress. We do not profile students for marketing and do not share data beyond what is needed for service delivery, support, security and the agreed subprocessors.

Purpose limitation

Student data is processed only to run the modules your school has activated: evidence capture, the UCAS statement workflow, CV and application support, and cohort visibility. It is not used to train AI models, for advertising, or for any purpose outside the school’s application workflow.

Children’s data

Outleap is used by an under-18 cohort, so we design to the ICO’s Age Appropriate Design Code: high privacy by default, data minimisation, and the best interests of the child as a primary consideration. There are no nudges that weaken a student’s privacy.

Data residency and security

UK/EU hosting

The platform runs on Google Cloud and Firebase. The API is hosted in Google Cloud europe-west2 (London), and core platform records remain stored in UK/EU-oriented Google Cloud services. AI processing uses approved providers, including Google Vertex AI and Amazon Bedrock, in UK/EU regions.

Encryption

Data is encrypted in transit with modern TLS and at rest with AES-256 via Google Cloud’s default encryption. Database access is authenticated and role-scoped.

Environment isolation

Staging and production are fully separated: different Firebase and GCP projects, and different data stores. The Firestore database is locked to the backend only; client applications cannot read or write it directly.

Retention and access

Retention

Student data is retained according to the retention schedule agreed with your school, with different windows for account metadata, evidence, submissions, feedback, application records and audit events. The template schedule is in the trust pack and requires school and legal review before adoption.

Access controls

Role-based access is enforced at both the application and infrastructure level. Students see only their own data, teachers see only their assigned students, and school admins see only their own school. Cross-school access is prevented by design.

Data subject rights

Rights are exercised through your school as the controller. We support schools with access, rectification, erasure, portability and related requests, subject to identity checks, school instructions, safeguarding duties and any lawful retention obligations.

Personal data breaches

Outleap will notify the school without undue delay, and in any event within 72 hours of confirming a personal data breach affecting school data.

AI data handling

No training on pupil data

Student content and AI outputs are not used to train Outleap models. AI processing uses the student’s own evidence, drafts and relevant workflow context only to provide the authorised service. Provider retention and transfer terms are documented through the DPA and subprocessor schedule.

Advisory, bounded AI

AI feedback is advisory and bounded to the student’s own work. Staff can see the feedback each student receives through the normal product views, so school support and safeguarding processes remain owned by the school. Automated safeguarding alert delivery, routing and hold workflows are not part of the service. AI is a tool inside the workflow, not an autonomous decision-maker, and it makes no admissions, safeguarding, academic or school decisions.

Subprocessors

Google Cloud and Firebase

Hosting, database, authentication (password and email-link sign-in) and the task queue. Hosted in Google Cloud, primarily in UK/EU regions as set out above.

Google Vertex AI

AI feedback on students’ own writing; on a student’s request, a first CV built from their own evidence or a reworded CV point; sorting a note into a piece of evidence; and reading an advert a student pastes. Processing takes place in UK/EU Google Cloud regions.

Amazon Web Services (Amazon Bedrock)

AI feedback on students’ UCAS personal statements, where Outleap routes that feedback to it. Processing takes place in supported EU AWS regions.

Postmark

Transactional email. Postmark is US-based, so this involves a transfer outside the UK; appropriate safeguards are set out in the contract schedule.

International transfers

Core platform records are hosted in the UK and EU where possible. Some service providers may process personal data in EU regions outside the UK. Where personal data leaves the UK, including transactional email through Postmark, we document the applicable UK adequacy basis or other appropriate safeguard in the contract schedule.

Your rights and complaints

Students, parents and staff can exercise their data protection rights by contacting their school as the data controller, or by emailing hello@outleap.io and we will route the request to the school. If you are not satisfied with how a concern is handled, you have the right to complain to the Information Commissioner’s Office at ico.org.uk.

Controller and contact

Outleap Limited (Company No. 14277395), 3rd Floor, 86–90 Paul Street, London EC2A 4NE. ICO registration ZB393894. For privacy and data-rights enquiries, contact hello@outleap.io. We have not appointed a Data Protection Officer, which is not required under UK GDPR Article 37; the company director is our data-protection contact.

For a plain-language summary written for students, see the student privacy notice.

Cookies

This website, outleap.io, uses no analytics, sets no cookies and keeps nothing in your browser. The walkthrough form sends what you type, the page you came from and any campaign tags in the address. What the Outleap app keeps in your browser is set out in the cookies notice.

If you contact us

When you ask for a walkthrough on this website, Outleap Limited is the controller of the details you send. We use them to arrange and hold the walkthrough and to reply to you. Our lawful basis is our legitimate interests in answering a request you made.

We keep what you type into the form, the page you came from and any campaign tags in the address, in Google Cloud Firestore, in UK and EU regions. A notification of your request, with what you sent, is emailed to hello@outleap.io. To stop the form being abused, the network address a request comes from is used to limit how many requests it can send, and is kept only as a one-way hash.

You can ask to see, correct or delete these details, or object to our using them, by emailing hello@outleap.io. You can also complain to the Information Commissioner’s Office at ico.org.uk.

The full trust pack

For procurement, the trust pack includes a DPA template, DPIA starter, subprocessor list, data-flow description, retention policy and AI-safety policy. To review them with your team, book a trust review.