Who is responsible
Karl Todd, trading as Tumble, operates tumble.tools as a sole trader. Contact tumble.tools@gmail.com for privacy questions, rights requests, incidents or complaints. Karl is the controller for teacher account information, service administration and security. ICO registration has not yet been completed; there is no registration number to publish. This is an outstanding school adoption requirement, not an exemption claim.
Schools control their educational records. Where unexpected school personal information reaches the service, Karl acts only on the school's documented instructions under the processor schedule in the terms. Staff cannot approve a school contract merely by creating a personal account. School adoption requires an authorised representative and written acceptance.
What belongs in Tumble
Use generic curriculum and lesson content. Never enter pupil names, photographs, contact details, individual results, health/SEND information or other pupil personal data into saved work, AI prompts, uploads, image searches or feedback. School adoption does not lift this restriction. Warnings and automated checks cannot detect every personal detail.
Gap Analysis has been retired. The app removes its obsolete browser records on startup. Previously downloaded reports remain under your control; do not upload individual marks or other pupil information to Tumble's server or AI. See browser storage.
Information and purposes
| Information | Purpose and legal basis for our controller processing |
|---|---|
| Email address, authentication identity, optional display name, account settings and saved teaching work | Provide the service you request and manage your account: performance of our contract with you. Authentication providers also handle credentials; we do not ask you to email passwords. |
| Request/security metadata, access permissions, quotas, operational usage and failure records | Protect accounts, investigate abuse and keep the service reliable: legitimate interests in a secure, functioning service, balanced against your rights. We restrict access and avoid content in application error logs. |
| AI waitlist request: request time, the declaration version you accepted (adult teacher, no pupil data, no direct pupil use) and the operator's approval or revocation dates | Decide by hand who can try beta AI features and keep a record of your declaration: legitimate interests in offering AI only to adult teachers and protecting children. Only you and the operator can see it; the daily owner notice reports a count with no identifiers. |
| Support messages, feedback, privacy requests and correspondence | Answer you and improve faults: legitimate interests; meet applicable legal duties where a request concerns those duties. Do not include pupil details. |
| School controller/signatory and contact records sent to us | Administer a prospective or accepted school agreement: legitimate interests in managing that relationship, and legal obligations where applicable. The school determines its own lawful basis for staff information it supplies. |
| Optional public-page measurement and performance events | Consent, requested in Privacy choices. Off by default. We do not rely on the statistical-purposes exception for this implementation. |
Optional two-step verification stores authenticator enrollment information with Supabase Auth. The setup key and codes are used only for setup/verification; they are not included in account exports or application analytics.
You provide most account/content information directly. Optional Google sign-in supplies your account identity and profile information when you choose it; the app does not load your Google profile picture. Necessary hosting and authentication services receive network and technical information when you connect. If required account information is not supplied, account features cannot work; optional measurement is never required.
AI, recipients and international processing
The default AI provider is Anthropic: Claude Haiku 5.5, with Claude Sonnet 5.5 as its backup, for text and page understanding. OpenAI text models and generated pictures are available only to confirmed testers. Gemini has been removed from the application runtime. Relevant prompts and permitted page context are sent only when AI features are used. We do not sell personal information or use school content to train our own models. Anthropic acts as our processor under the Data Processing Addendum incorporated into its Commercial Terms, with UK Addendum transfer terms. It does not train models on API content. It deletes API inputs and outputs within 30 days by default, but content flagged by its safety systems can be kept for up to 2 years. Claude requests are processed in any of Anthropic's global regions; no EU or UK processing option is available. Zero data retention is not in place. OpenAI's API policy excludes training by default unless a customer opts in; we do not authorise that opt-in. EU and provider retention approval remain launch checks for school use. Read AI transparency before using AI.
Our supplier list names hosting, storage/authentication, AI and other services, their purposes and known locations. London hosting or storage does not mean every support, log or subprocessor operation stays in the UK. Any restricted transfer needs an applicable lawful safeguard and assessment. Executed agreements and some production settings are still unverified; school adoption is not approved. We may disclose limited information when law requires it, to deal with a security incident, or to a school controller for its own records, with appropriate checks.
Feedback during testing
Designated adult testers can submit ratings and comments to help improve Tumble. Feedback is stored in Tumble's database. After the testing notice has been published and the testers informed, eligible new feedback from the designated accounts may be copied automatically into the private tumbletools/tumble-app GitHub repository. The operator and authorised repository collaborators can read those copies.
Copies can include the rating, comment, relevant tool or resource identifier and label, submission time, permitted context and any item setup included with the feedback. Feedback record identifiers are used to avoid duplicate filing. The filing process does not copy your account email, display name or user ID, but these records are not guaranteed to be anonymous. Do not include personal information about yourself or anyone else, especially pupil names, contact details, health/SEND information, photographs or individual results. An automated check holds suspected personal information for private review; it can miss information and is not a guarantee of anonymity.
We use GitHub Free and have not agreed a data-processing agreement with GitHub. Supplier contract and international-transfer safeguards for personal-data copies remain unresolved. The operator has authorised this restricted testing workflow; that decision does not establish legal compliance, supplier approval or school approval. Testing and notice wording do not remove applicable data-protection obligations. Other accounts and feedback submitted before the configured notice cutoff are excluded from testing export.
Feedback collection in Tumble continues when GitHub export is off. Tumble feedback is subject to the 90-day retention schedule and earlier account-deletion/privacy-request handling. GitHub copies require separate review/removal: closing an issue does not erase its text. We review them on a privacy request and at least every 90 days while retained. Contact tumble.tools@gmail.com to raise a concern or request removal. Participating in testing does not waive your rights. See retention and suppliers.
Retention and your choices
The retention schedule distinguishes saved work, 30-day teaching/generation history, 90-day operational records, browser copies and supplier backups. Due records wait for the next successful cleanup; a configured job is not proof that production has run it. Public resources and recipients' copies have separate lifecycles.
Account lets you correct your display name, export account data and files, clear teaching/generation history and request account erasure after a recent sign-in. Email changes and other corrections can be requested through the privacy contact. Privacy choices withdraws optional measurement consent; withdrawal does not change the lawfulness of earlier processing. Do Not Track and Global Privacy Control also disable measurement. No advertising profiles or automated decisions with legal or similarly significant effects are made about you or pupils.
Rights, requests and complaints
Depending on the circumstances, you can ask for access, correction, erasure, restriction or portability, and object to legitimate-interest processing. Contact us without sending pupil records or identity documents at first; we will request proportionate verification if needed. We normally respond to rights requests within one month; if the law permits an extension, we explain it and the reason. Requests about school-controlled information are referred promptly to the school, with assistance rather than an independent decision by us.
For a data protection complaint, email tumble.tools@gmail.com with what happened and the outcome you seek. We acknowledge receipt within 30 days, make enquiries, keep you informed and communicate an outcome without undue delay. You can complain to the UK Information Commission, known as the ICO, through its complaints service; contacting us first does not remove your statutory rights. See the ICO complaints guidance.
Changes
This notice carries a date and version. Material changes are explained on Trust and notified to accepted schools through their recorded contact. Changing a notice alone does not extend a school's processing instructions or authorise a new subprocessor.