Outleap
Menu

Privacy and data

Trust pack · current as at 26 September 2026

Outleap Data-Flow Description

How account, workflow and AI feedback data moves through Outleap and its providers.

These documents describe the new Outleap, which reaches schools on 2 November 2026. Schools using Outleap today can ask for their current copies at hello@outleap.io.

Download (.docx) Download (.md)

Status: Current service flow as at 26 September 2026. This document should be read with the DPA, DPIA starter, retention schedule and subprocessor list.

1. Account and application data

  1. A student or staff member connects to the Outleap web application over TLS.
  2. Firebase Authentication verifies the account.
  3. Firebase Hosting proxies /api/** to the Outleap API in Google Cloud europe-west2 (London).
  4. The API applies role and school scoping before reading or writing Firestore.
  5. Core account, statement, evidence, feedback and workflow records remain in the configured Google Cloud/Firebase environment.

2. AI-assisted workflows

  1. Within an authorised workflow, a student asks for AI-assisted feedback on their own writing, or for drafting support (a first CV built from their own evidence, or a reworded CV point), or has a note about something they have done sorted into a piece of evidence. Where enabled, Outleap also reads a course page the student keeps, or an advert or link they paste, to find what it asks for.
  2. The API sends the relevant student-provided content, or the course page or advert being read, and the minimum workflow context needed to provide that support to an approved AI service provider over encrypted transport.
  3. Current AI service providers are listed in the subprocessor list. Processing is configured for UK/EU regions.
  4. The provider returns a response to the API, which validates it before use.
  5. The API stores the resulting feedback, the CV the student asked for, or a course page's reading, with bounded operational metadata in Firestore. Feedback on a cover letter or an application answer can include suggested wording, which is stored with the feedback and not shown in the product views. A reworded CV point, a sorted piece of evidence and an advert's reading are returned to the student and stored only if the student chooses to keep them. Stored records are visible only through the normal authorised product views.

Outleap does not send passwords, authentication tokens or unrelated student records to AI providers. Application logs must not contain student content, prompts or AI outputs.

3. Other flows

  • Transactional email sends the recipient address and necessary message content to Postmark.
  • Data-subject requests, deletion and export are actioned by Outleap on the school's documented instructions, subject to agreed retention and legal obligations.

For questions, and for privacy and data-rights requests, email hello@outleap.io.