What Outleap does with your students’ data, and what it will not do.

AI feedback on a student’s own statement, CV, cover letters and application answers; on the statement, in rounds.

Nothing changes in a draft unless the student chooses it.

Outleap helps students express their own evidence.

A student can type in what a course asks for.

A student can add an opportunity they found themselves, from its link.

Outleap sorts what a student writes about something they’ve done into points they check.

It does not write the statement for them.

It does not predict or promise an offer, score or grade a student, or make any decision about a student.

Where Outleap cannot check a requirement against what it knows, it says “Can’t tell”. It does not guess.

Staff can see every round of feedback on a student’s personal statement, and the student’s saved CV, cover letters and answers, with any comment a colleague adds.

They also see each application’s status and counts, the title of its next step, evidence titles and deadlines.

On Outleap’s staff screens, staff see which requirements a student meets, never the grades they typed in, what they looked at and didn’t keep, or their plans.

A tutor sees only the students assigned to them.

Outleap does not watch for or report safeguarding concerns; a concern follows the school’s own safeguarding route.

AI feedback does not flag, hold or report anything a student writes; the feedback comes back as usual.

If staff read something worrying in a student’s statement rounds, the school’s own safeguarding policy applies.

Hosted on Google Cloud in UK and EU regions.

Emails go through Postmark, in the US, under the transfer safeguard in the contract.

Sign-in is handled by Firebase Authentication, a Google service that may process sign-in details outside the UK and EU, under the safeguards in the contract.

Pupil data is not used to train AI models, by Outleap or its providers.

AI processing uses approved providers, including Google Vertex AI and Amazon Bedrock, in UK/EU regions.

The full list is in the subprocessor list below.

Students sign in with their school email address and a password set up with a code from their school. Staff sign in with a link emailed to them.

Passwords are held by Firebase Authentication; Outleap does not store or log them.

Course details come from HESA Discover Uni, the official UK dataset of university courses, shown with their source.

An apprenticeship’s details and requirements come from its vacancy on Find an apprenticeship, the Department for Education’s service for England, shown with their source.

Every course and vacancy card names its source and the date Outleap took its data in.

Workflow actions are recorded in an audit log.

Outleap’s application logs leave out student content and AI output.

Data is encrypted in transit and at rest.

Each person sees only what their role allows, inside their own school or college.

Outleap’s own services run with only the access they need.

Outleap does not yet hold a security certification such as Cyber Essentials.

By default, account records are kept for the contract and a year after, and a student’s work and feedback until the end of their application cycle and one to two years after.

Each kind of data is in the retention schedule below. A school can ask for its data to be returned or deleted.

Ask your school or college.

For questions, and for privacy and data-rights requests, email hello@outleap.io.

The privacy notice, and the privacy notice for students and parents, say more.