Status and scope
School adoption is pending. This is a vendor evidence pack for review, not an approved school DPIA, legal opinion or certificate. Prepared 25 October 2026. Operator: Karl Todd, sole trader. Privacy contact: tumble.tools@gmail.com. No appointed statutory DPO is claimed. Independent DPO review, registration, Cyber Essentials, supplier agreements and production verification are outstanding.
Tumble supports adult teachers preparing and presenting generic curriculum materials, including primary-school activities. Children may tap a teacher's board. It is not a pupil account, assessment-record, counselling or autonomous tutor service. Pupil personal data must not enter cloud saves, uploads, AI, image searches or feedback, even after school adoption. Gap Analysis is retired; obsolete browser records are removed on app startup. The privacy notice, terms and processor schedule and school adoption process govern the proposed relationship. This pack supplies evidence; it does not accept a contract.
“Implemented” below means source changes and isolated tests. It does not mean these controls are deployed or independently certified. The supplier and retention annexes are included in this download so a school can retain one dated review copy.
Processing record
This record covers recurring activities rather than assuming a small-business exemption. Karl maintains the controller record. For processor work, maintain a separate restricted entry for each accepting school: legal name/address, authorised contact, DPO where applicable, instructions, processing categories, start/end dates and transfer/security annex versions. There are no accepted school entries evidenced by this pack. The public pack must not list private school contacts. This structure follows the Article 30 documentation guidance.
| Activity and role | People, information and source | Purpose/basis and recipients | Retention/security |
|---|---|---|---|
| Teacher accounts; Karl as controller | Adult teachers: email, identity, display name, preferences, credentials managed by Auth; optional Google identity supplied on sign-in | Deliver requested account features under the teacher contract. Supabase; chosen identity provider; hosting receives necessary request metadata | Account lifetime; account erasure. Ownership controls, confirmed-email AI admission and optional authenticator MFA. Auth manages factor secrets; app exports exclude them |
| Saved materials and AI assistance; controller for the teacher service, processor for any school-controlled incidental data under accepted instructions | Teacher-authored lessons, drafts, private files, prompts and generic board context; no authorised pupil records | Prepare/store teaching work. Vercel, Supabase, and approved OpenAI requests. School determines its own lawful basis; accidental pupil information is restricted/removed, not legitimised by the teacher contract | Saved work until deletion; teaching/generation history 30 days; private access and controlled sharing. See annexes for full lifecycle |
| Security and service operation; controller | Teacher/request identifiers, IP/technical metadata at hosting/Auth, AI usage, capabilities and quota records | Legitimate interests in securing and operating the service. Hosting/Auth suppliers and restricted operator access | App operational records mostly 90 days; quota rolling window. Supplier log/session/backup periods still require evidence |
| Feedback/support and privacy requests; controller, with school instructions for incidental pupil data | Teacher contact, comments, request/status records; supplied directly | Resolve problems and requests: legitimate interests and applicable legal duties. Supabase and monitored correspondence mailbox; GitHub export uses either approved processing or the separately disclosed designated-tester policy; the latter does not establish supplier approval | Private feedback 90 days; manual correspondence schedule requires final review. Snapshot defaults off; no pupil details; previously filed copies need separate review |
| School agreements; controller | Adult signatory/contact details and controller instructions supplied by school | Administer the relationship: legitimate interests/legal duties as applicable. Restricted operator correspondence | Local request form sends/stores nothing automatically. Received and accepted records need justified retention and an approved mailbox arrangement before adoption |
| Optional public-page measurement; controller | Minimal permitted page/performance events after consent; no private content, search terms or account identifiers in app events | Consent. Vercel measurement services under approved terms | Off by default; withdrawal, DNT/GPC and strict payload controls. Vendor retention still part of supplier review |
The executable export/erasure inventory covers account-linked application records, indirect children and private Storage bytes. It excludes password hashes, session tokens, factor secrets and unrelated users. Published catalogue content can remain with contributor attribution removed. Age rules, non-expiring saved work and external copies are distinguished in the retention annex. Hosting regions and international access are in the supplier and transfer sections; a UK database region does not prove all processing is domestic.
Vendor DPIA and school completion worksheet
Purpose: reduce preparation effort and support teacher-led classroom activities without building server pupil profiles. Alternatives include existing school tools, locally prepared materials and disabling AI. School reviewers must record why the selected features are necessary, whether generic input is sufficient, and whether a less intrusive alternative meets the need. Nothing in this pack authorises individual pupil assessment or sensitive-data processing on Tumble servers.
Data flow: teacher browser → Tumble hosting → Supabase account/private records; selected generic AI context → Anthropic (default) or OpenAI (testers) → teacher review → optional save/presentation. Private image requests use controlled storage/proxies. Image search goes through Tumble's bounded relay to Wikimedia. Optional measurement is separate and off by default. Obsolete Gap Analysis browser records are deleted on startup; previously downloaded reports remain outside Tumble's control. Email, logs, backup/restore and previously filed GitHub copies are separate flows needing supplier/operational review.
The school must supply expected staff/pupil numbers, ages and SEND/accessibility needs, features, device controls, locations, lawful basis, any Article 9 condition if relevant, and its privacy information. Do not supply pupil records to complete this worksheet. Consult teachers, school DPO, safeguarding/IT leads and representative families/pupils proportionately; record whose views were sought, results, reasons for omitted consultation and unresolved concerns. No such consultation has been completed by this implementation.
Provisional ratings below concern harm to people: disclosure, distress, loss of control, discrimination or learning harm. They are not a production penetration-test score. “High/pending” blocks school acceptance until evidence and mitigations support a new decision.
| Risk | Initial risk; controls/evidence | Residual decision and action owner |
|---|---|---|
| Identifiable pupil input reaches AI, logs or sharing | High. No-pupil rule, local heuristic warnings, media-bearing page capture guards, teaching-mode composer lock; private feedback snapshot off | Medium only with trained/supervising staff and verified deployment; heuristics miss context. School minimises content; Karl verifies service boundaries and incident removal |
| Unauthorized teacher account or cross-owner access | High. Optional TOTP, API assurance checks, database/Storage policies, isolated ownership/export/erasure tests | Medium pending live controls and operator security evidence. School enables MFA, protects devices; Karl verifies Auth, hook, credentials and recovery |
| Previously downloaded pupil reports expose a child | High. Gap Analysis is retired and obsolete browser records are removed; downloaded files and backups are outside app cleanup | School sets custody and deletion rules for files it previously downloaded |
| Supplier access, transfers or retained copies lack safeguards | High. Source minimisation, approved EU routing for school rollout; existing allowlisted testers may use standard processing while approval is pending | High/pending. Karl obtains contracts, actual processing locations, retention and transfer decisions; no school rollout until resolved |
| Wrong, unsuitable or biased generated material harms learning | High for unattended use. Teacher reviews suggestions; AI is optional; outputs can be rejected/edited | Medium only for reviewed teacher-led material; direct learner AI remains unsupported. School checks accuracy, age, representation and curriculum fit |
| Child interprets mascot as a person or gains unsupervised AI access | High for direct child interaction. Mascot displays workflow state; composer locked during teaching | High/pending applicability/design review. Teacher supervision is not a technical child-access barrier; Karl and school DPO must assess the visible character and accessible controls |
| Link disclosure or deletion failure prolongs access | High. Expiring/deletable private shares, source retirement, stale-write fences, retryable Storage/record/Auth erasure | Medium pending deployed cleanup/restore test. School shares only generic materials; Karl monitors deletion backlog and external copies |
Retired local assessment records
Gap Analysis is no longer available. Startup deletes its obsolete browser records, with an explicit retry if an older tab blocks deletion. This cleanup preserves current Workshop drafts and saved lesson content. Existing downloads, printouts and device backups remain the school's responsibility; removing the feature does not delete those copies or make individual marks anonymous.
Decision to complete before adoption
Record: school/controller; scope and lawful basis; consultation summary; DPO advice; each additional measure, owner and due date; revised likelihood/severity/residual risk; decision and reasons; named authorised approver/date; Karl's supplier/operations evidence references; next review date. No fields are pre-signed. If high residual risk cannot be reduced, seek the required prior consultation with the regulator before that processing. Do not treat accepting a high risk in this table as permission to proceed.
DfE AI self-assessment
Reference: DfE generative AI product safety standards, updated 19 January 2026. This is Tumble's assessment of its own implementation, not DfE endorsement. Teacher-led preparation is the intended use. Direct learner chat, automated pupil decisions and counselling are unsupported. Supervised board interaction still makes learner-facing risks relevant; the following gaps must not be marked “not applicable” merely because an adult owns the account.
| Area | Tumble assessment and next evidence |
|---|---|
| Stated purpose and use cases | Generic teacher preparation/presentation is documented. School defines permitted ages, subjects and accessibility needs; no pupil-profile use case |
| Filtering | Provider moderation and input guards exist; no complete age/SEND/multilingual safety evaluation. Learner output exposure needs teacher review; direct learner AI is not approved |
| Monitoring and reporting | Private feedback and operational failure records exist. No pupil monitoring, named-learner alerting or DSL pipeline is implemented. Those direct-learner functions are outside supported scope, not certified as satisfied |
| Security | Source has ownership controls, request isolation, MFA and bounded access. The hosted Auth confirmation/TOTP settings are observed, but deployment of the new controls, operator device security and remaining supplier settings still need acceptance |
| Privacy | No-pupil boundary, rights controls, retention, notices and this DPIA exist. Contracts, transfers and school sign-off remain pending |
| Intellectual property | Teacher must have rights to inputs; image credits are preserved. Generated output still needs rights/provenance review |
| Design/testing | Isolated functional, browser and security tests exist. Independent safety, child-user, SEND and adversarial evaluations are not evidenced |
| Governance | Named privacy contact, complaints route and incident procedure exist. Independent review and operational rehearsals are pending |
| Cognitive development | No independent personalised pupil tutor is offered. School checks that reviewed material promotes thinking rather than simply presenting answers; educational impact is unvalidated |
| Emotional/social development | A named, animated character with a face and “ideas” can imply agency. Its workflow purpose is not a time-limited pedagogical roleplay exception. No blanket alignment claim; assess neutral presentation or additional teaching-mode restrictions before approval |
| Mental health | No counselling, distress detection or crisis/DSL workflow is offered. Keep pupils with their teacher and school safeguarding procedure; do not route disclosures into AI |
| Manipulation | No advertising profile or pupil reward scheme is intended. Review generated wording and visible prompts for overconfidence, pressure, flattery and relationship cues; no comprehensive adversarial evidence yet |
Mascot evidence reviewed: the rendered state is derived from work/review/error signals, not a pupil personality model; seasonal outfits are date-based. Teaching mode reduces its prominence and locks the composer, but the character remains visible and opens the Tumble dialog. This limits some use without eliminating perceived personhood. Retaining it requires a documented school/DPO decision supported by appropriate design/testing evidence; the current assessment leaves that decision open.
Children's code assessment
Provisional conclusion: treat child access as likely and design/review on that basis. Primary activities, games and supervised board tapping make access foreseeable. No child accounts are intended, but teacher authentication and written terms alone do not prove children cannot interact. The regulator's scope guidance extends beyond services specifically aimed at children; a commercial education supplier cannot simply adopt the school's public-service exception.
Current protections: minimise inputs; prohibit server pupil records; keep private work private; disable optional measurement by default; no requested child geolocation, advertising profile or emotional profiling; no public pupil account creation flow is offered as a supported use. Unknown/mixed audience pages do not obtain extra data to prove age. Apply cautious defaults to all users. Teachers retain responsibility for supervision and school safeguarding; that does not replace the supplier's duties.
Outstanding: independent applicability advice; representative child/family/SEND consultation; age-appropriate comprehension and misuse testing; mascot/AI access design decision; confirmation that published links and pupil-controlled boards cannot bypass the intended boundaries. Do not collect birth dates or identity documents as an unreviewed workaround. Review before adoption, at least annually (next review by 25 October 2027), and immediately for pupil accounts, homework access, chat changes, profiling, new telemetry, incidents or evidence of unsupervised use.
Transfer assessment record
Status: not approved. UK legislation now calls the TRA a data protection test; use the current regulator guidance. Where relying on contractual safeguards, a documented, proportionate conclusion and binding safeguards are needed; an EU endpoint or a supplier web page alone is insufficient. No adequacy/DPF certification or signed SCC/UK Addendum is inferred here.
| Supplier | Mapped flow and mitigation | Missing evidence and decision |
|---|---|---|
| Supabase | Teacher identity, saved content, private images and operational records; London project region observed; ownership/MFA/minimisation implemented | Exact contracting/importing entities, support/log/SMTP/onward countries, applicable DPA, transfer route and current certifications, UK Addendum/IDTA where needed, access requests/challenge practices, deletion/backup evidence. Karl: pending, no school approval |
| Anthropic | Default generic text/page context for Claude Haiku 5.5 and Sonnet 5.5; global processing; 30-day default retention, up to 2 years for flagged content; no training on API content; no pupil data | Exact contracting entity, subprocessor locations, onward access, executed Console terms and UK transfer assessment. No EU/UK processing option. Karl: pending, no school approval |
| OpenAI | Generic text/page context and image prompts for confirmed testers only; existing allowlisted testers may use the standard endpoint; approved EU routing remains a school-rollout gate; no pupil data; store:false for text | Actual organisation/project approval, legal entity, eligible regional models/features, retention exceptions, support/onward access, signed terms and UK transfer safeguard. Karl: pending, no school approval |
For each restricted flow complete: exporter/controller or processor role; importer; countries and onward recipients; categories/volume/frequency; chosen current legal route; contract/module/addendum dates; assessment of access laws/practices, redress and enforcement using current qualified evidence; likelihood and impact for the actual data; supplementary measures; residual protection conclusion; reviewer/date and recheck trigger. Transport encryption does not protect data while a provider processes plaintext. If safeguards are inadequate, stop or change that flow; do not invent a routine-consent exception. School reviewers need the completed assessment or an appropriately redacted evidence copy before acceptance. Other suppliers in the annex require the same classification where relevant.
Security, incidents and exit
Implemented and tested locally: account ownership/RLS; verified-factor MFA at app API, Data API and private Storage boundaries; private image access; default-off measurement; constrained browser destinations; private feedback; bounded sharing metadata; request-local AI draft state; export/correction; resumable account erasure; history expiry and share withdrawal. Tests use synthetic data and disposable services. There is no independent penetration-test or Cyber Essentials certificate to attach. Production migration/configuration, restore testing, operator access and supplier evidence remain open.
MFA uses an authenticator app; teachers should keep a second factor securely. No recovery codes or automatic email-only reset are offered. Existing downloaded files and issued access credentials have separate lifetimes: MFA is not an instant recall mechanism for an already authenticated/compromised session. Factor recovery requires verified identity, recorded operator approval, session revocation and expiry handling. Never email passwords, OTPs or setup keys.
Report suspected incidents promptly to tumble.tools@gmail.com, without including pupil data in the first message. Karl records awareness time, contains access, preserves minimal evidence, identifies affected schools/people, and assesses harm. As processor, notify the school's verified privacy contact without undue delay, aiming for an initial notice within 24 hours; send facts available and follow-up updates rather than waiting for certainty. As controller, assess reportability immediately: notify the regulator within 72 hours of awareness where required, explain delay, and notify affected people without undue delay where high risk requires it. Record decisions, including non-reporting reasons, containment and corrective action. These timelines follow the breach guidance; the internal 24-hour target is not a waiting period.
Exit: export owned records/files through Account; delete private work/shares or the account; clear local devices; review downloaded/shared copies and previously filed feedback; obtain supplier deletion/backup evidence. Restoring a backup must not revive erased accounts or retired links. The retention annex describes schedules and limits.
Parent and pupil factsheet
For families: Tumble is a tool the teacher can use to prepare and show lessons. The teacher should not put children's names, photos, individual results or sensitive information into Tumble's online storage or AI. AI can make mistakes, so an adult must check material. Some board activities let children tap or move things under supervision. Tumble does not provide a child account or private AI friend. A separate local marks tool may run on the school's device; its reports are still school records. Ask your school which features it uses, why, how it protects reports and how to exercise rights. School adoption is still awaiting review.
For pupils: Your teacher chooses the activity and checks the answers. The Tumble picture is part of a computer tool, not a person or a friend. Do not type your name, address, photo or anything private into it. If something looks wrong, worries you, or asks for a secret, stop and tell your teacher. You can ask your teacher for help or another way to do the activity.
Standard supplier questionnaire answers
| Question | Current answer |
|---|---|
| Legal identity/privacy contact? | Karl Todd, sole trader, tumble.tools@gmail.com; no appointed statutory DPO claimed. Business/registration address requires owner confirmation before contracting |
| Registration and certification? | Registration/fee assessment is deferred and not completed; no current registration number or Cyber Essentials/Plus certificate. School adoption remains pending. No logo or assurance badge is used |
| Controller/processor roles? | Karl controls teacher/service administration; schools control educational records. Written processor instructions apply only within the accepted service scope; pupil server processing remains prohibited |
| Hosting and AI? | Supabase Free/London observed; Vercel Hobby production still reports iad1. This release configures London and awaits deployed verification. This release uses Anthropic by default (global processing, standard retention) and OpenAI for testers; the current production OpenAI project shows Standard retention, so approved retention and EU processing remain pending. Detailed supplier annex follows |
| Training, sale, profiling? | No authorised training opt-in or sale of personal information. No pupil profiling or automated significant decisions offered. Provider terms/retention require final evidence |
| Security and availability? | Controls/test evidence summarised above. No certified uptime, backup/restore guarantee or independent security assessment claimed; Supabase Free has no included project backups; recovery, production email and other operational arrangements need review |
| Rights, retention and exit? | Account export/correction/history clearing/erasure, local clearing and share withdrawal implemented. Supplier copies and school-held exports are separate; full schedule follows |
| Breach, audits and subprocessor changes? | Monitored privacy contact and proposed processor schedule provide notification, assistance, review/audit and change-notice arrangements. School agreements need bilateral acceptance |
| Can a school approve this pack alone? | No. Complete the school DPIA and contracting review, resolve the evidence gaps and obtain written acceptance; the local request form is not acceptance |
Review and outstanding evidence
Karl owns the vendor evidence and reviews it before adoption, on material changes/incidents and at least annually. Schools own their local decisions. Required evidence: registration/fee outcome and certificate; scoped Cyber Essentials assessment/certificate (Plus planned later); independent school DPO review of notice/DPA/children/mascot/AI applicability; executed suppliers and transfer decisions; live Auth/MFA/retention/region checks and synthetic restore/erasure exercise; operator device/cloud-account security and mailbox arrangement; school-specific consultation and approval. Registration/certification submissions, purchases and external messages have not been made by this implementation. Future verified certificate references must state entity, scope, issue/expiry dates and verification link; until then this status stays pending.
Feedback during testing
Designated adult testers can submit ratings and comments to help improve Tumble. Feedback is stored in Tumble's database. After the testing notice has been published and the testers informed, eligible new feedback from the designated accounts may be copied automatically into the private tumbletools/tumble-app GitHub repository. The operator and authorised repository collaborators can read those copies.
Copies can include the rating, comment, relevant tool or resource identifier and label, submission time, permitted context and any item setup included with the feedback. Feedback record identifiers are used to avoid duplicate filing. The filing process does not copy your account email, display name or user ID, but these records are not guaranteed to be anonymous. Do not include personal information about yourself or anyone else, especially pupil names, contact details, health/SEND information, photographs or individual results. An automated check holds suspected personal information for private review; it can miss information and is not a guarantee of anonymity.
We use GitHub Free and have not agreed a data-processing agreement with GitHub. Supplier contract and international-transfer safeguards for personal-data copies remain unresolved. The operator has authorised this restricted testing workflow; that decision does not establish legal compliance, supplier approval or school approval. Testing and notice wording do not remove applicable data-protection obligations. Other accounts and feedback submitted before the configured notice cutoff are excluded from testing export.
Feedback collection in Tumble continues when GitHub export is off. Tumble feedback is subject to the 90-day retention schedule and earlier account-deletion/privacy-request handling. GitHub copies require separate review/removal: closing an issue does not erase its text. We review them on a privacy request and at least every 90 days while retained. Contact tumble.tools@gmail.com to raise a concern or request removal. Participating in testing does not waive your rights. See retention and suppliers.
Annex A — Supplier list
Current status
This register describes the application and the supplier evidence available on 25 October 2026, with the GitHub testing and Claude beta updates of 26 October 2026. School adoption is not approved. Contracts, plan settings and deployed behaviour must be verified before a school's supplier annex is accepted. UK hosting alone is not a guarantee about all processing or international access.
| Service | Purpose and data | Location and safeguards / outstanding evidence |
|---|---|---|
| Vercel | Hosting, request/security logs; optional public-page analytics and performance measurement | This release configures functions for London; the earlier production deployment observed on 25 October 2026 reports the US region iad1. London execution awaits release verification. CDN, support and subprocessors can operate internationally. Current plan is Hobby; coverage under Vercel's published Pro/Enterprise DPA is not established. Eligible agreement/hosting and UK transfer safeguards are required. |
| Supabase | Teacher accounts, authentication, saved resources, history, feedback, usage records and private files | Project region verified as London (eu-west-2). The Free plan and built-in email were observed on 25 October 2026. Included project backups are unavailable; recovery covering database and uploaded file bytes is not established. Confirmation and TOTP are enabled, but production application enforcement, password/session suitability and log retention still need acceptance. Applicable DPA, UK transfer terms/assessment and international support/email processing remain to be recorded. |
| Anthropic | AI prompts, relevant permitted page context and text/vision responses for the default Claude models | Beta default from 26 October 2026. Anthropic acts as our processor under the Data Processing Addendum incorporated into its Commercial Terms, with UK Addendum transfer terms. It does not train models on API content. It deletes API inputs and outputs within 30 days by default, but content flagged by its safety systems can be kept for up to 2 years. Claude requests are processed in any of Anthropic's global regions; no EU or UK processing option is available. Zero data retention is not in place. Requests set global processing. The subprocessor list and the operator's Console agreement and settings are recorded separately. School adoption is not approved for this route. |
| OpenAI | AI prompts, relevant permitted page context, text/vision responses and generated images, for confirmed testers only | Existing approved testers can use the standard API endpoint while school-rollout approval is pending. EU routing is enabled only with the corresponding approved processing and retention settings. On 25 October 2026 the owner-confirmed production project showed Global residency and Standard retention, with API data sharing disabled. Provider approval, agreement, model eligibility and deployed release settings remain unverified. No promise of zero retention. UK safeguards/assessment must cover any applicable international access. |
| Supabase built-in authentication email | Sign-in and security email addresses/messages | The dashboard confirms built-in email and no custom SMTP. It warns this rate-limited service is unsuitable for production. A suitable production provider arrangement, contract, locations, delivery-log retention and transfer safeguards are a launch gate. |
| tldraw | Canvas software, licence validation | Canvas fonts/icons are served by Tumble. Hobby/trial licence telemetry can include the page URL; browser policy blocks it. A vendor-permitted configuration and suitable licence/contract remain unresolved. Blocking a request is not contractual approval. |
| Wikimedia Commons | Subject searches and image requests sent by Tumble's server | Wikimedia sees the search term/image path and server connection. The relay does not forward your browser IP, cookies, user agent or referrer. Wikimedia's infrastructure/terms apply; do not search for personal information. Image attribution/licences remain attached. |
| GitHub | Code hosting; automatic eligible tester feedback copies as private issues/comments and rating tallies | Owner confirmed GitHub Free and no agreed DPA on 26 October 2026. Designated adult testers can have new feedback copied after publication and notification, under an explicit testing policy. Copies are accessible to the operator and authorised repository collaborators. The personal-information filter can miss information; contract and international-transfer safeguards remain unresolved. Testing does not establish legal compliance or school approval. Other users and earlier feedback remain excluded; approved general export requires a separate evidenced decision. Historic and testing copies need separate review/removal. |
| Google email | Privacy/support correspondence sent to tumble.tools@gmail.com | The published contact is a Gmail address. Account/contract coverage, access/MFA, transfers and retention for business correspondence remain unverified. Send minimal initial details; do not send pupil records, credentials or identity documents unless a suitable secure route has been agreed. |
| Google sign-in | Optional identity service chosen by you | Google receives a request when you choose Google sign-in and processes it under its own terms. No background Google profile pictures are loaded. This is distinct from an automatically authorised school subprocessor. |
Gemini is retired from the application runtime. Historic assets and usage labels may still refer to it. Deployed removal, redundant-key revocation and any provider-side historical retention must be verified; retiring a provider does not erase earlier copies automatically.
Agreements and restricted transfers
The operator must preserve applicable executed agreements, subprocessor details, locations, UK safeguards (such as approved contractual provisions where appropriate), transfer assessments and review dates before school adoption. We do not claim a particular certification, adequacy decision or executed mechanism without evidence. The school receives the confirmed annex before signing. Published supplier terms can be read at Vercel DPA, Supabase DPA and OpenAI DPA; a link alone does not prove account coverage.
Get notice of supplier changes
Email tumble.tools@gmail.com with your work contact address and, if relevant, the school controller name. Ask to receive supplier change notices. We confirm receipt and registration; opening an email link does not subscribe you. Notices are operational, not marketing. Reply to stop voluntary notices or update the address. Accepted schools must maintain a reachable contractual privacy contact.
For accepted schools, the DPA requires at least 30 days' advance notice and a route to object before a new or replacement subprocessor is used. Proposed changes and objection outcomes are recorded. Urgent changes need specific written authorisation or suspension of affected processing.
Annex B — Retention schedule
What these periods mean
These are the application retention rules prepared for deployment. Due records are deleted on the next successful daily cleanup; outages and a backlog can delay physical removal. Share access stops at its expiry even before cleanup. Production job execution and supplier log/backup periods are still unverified school adoption gates. Contact tumble.tools@gmail.com for the status or a deletion request.
| Data | Application retention |
|---|---|
| Account, profile, preferences, saved lessons/resources, folders and private catalogue entries | Until you remove the item or erase the account. Saved teaching material is separate from generation history. |
| Teaching sessions, observations, adaptations and flashcard generation history | 30 days from creation; earlier on Account history clear, related source deletion or account erasure. Saved follow-up lesson content remains until removed. |
| AI request/routing/tool records and operational usage | 90 days from the generation chain/event; earlier account erasure. Quota counters keep the current UTC day and previous 7 days. Short continuation validity is separate from record retention. |
| AI waitlist request and declaration | While the account exists, so access decisions stay accountable; removed on account erasure. |
| Private feedback and public-resource share events | 90 days, or earlier applicable account/resource deletion. GitHub copies are a separate operator process. |
| Shared Workshop snapshots | Until owner/source/account deletion or chosen expiry. New links default to 30 days; options are 1, 7, 30 days or no expiry. A withdrawn/expired token cannot be reused. |
| Private generated images, observation pictures and other private files | While referenced by saved, shared or published material. Unreferenced files at least 24 hours old are selected for removal on the next successful cleanup. Save a wanted generated image into a lesson within that grace period. |
| Published teaching resources | Publication lifecycle and catalogue removal. Account erasure removes author attribution; published content may remain. Ask for removal of personal prose or an improperly published resource. |
| Minimal deletion fences and operational status | Prevent old offline retries or withdrawn links from reappearing. Account-related fences are removed with account erasure where safe; permanent token digests retain no raw token, snapshot or account attribution. |
| Browser drafts and local teaching history | Browser storage explains expiry, sign-out and clear-device controls. Obsolete Gap Analysis browser records are removed on startup; downloaded reports and device backups are outside this cleanup. |
Account rights and files
Account provides export with file bytes, profile correction, history clearing and confirmed account erasure after recent sign-in. Erasure removes private files through the storage service before account records and authentication. A failed operation remains retryable; do not treat an error as completed deletion. School records and published personal prose may need manual assistance. Withdrawing a share prevents future access but cannot delete another person's download or printed copy.
Supplier copies and administrative records
Hosting, authentication, email and storage logs/backups follow actual supplier settings. Their production retention periods and recovery procedures are not yet verified; we cannot promise immediate erasure from backups. The observed Supabase Free plan has no included project backups. External/manual copies and recovery have not been established, and database backups alone would not cover uploaded file bytes. Before school adoption the agreed annex must specify those periods. Deleted data must not be made live again after restoration. AI supplier retention is described in AI transparency, not inferred from application settings.
Support, complaints, adoption and notice-subscription correspondence is handled by Karl through the published mailbox. Proposed handling is to review ordinary support and withdrawn/unsuccessful adoption requests after 12 months; keep only information still needed for an unresolved matter. Keep active school agreements and minimum completion/notice records for their operational and documented legal purpose, with an agreed, justified post-termination period before acceptance. These manual periods and mailbox access/backup controls require owner/DPO confirmation; automated database cleanup does not clean email. No indefinite blanket retention or completed mailbox purge is claimed.
GitHub feedback copies are reviewed on a privacy request and at least every 90 days while retained. Closing an issue is not erasure: personal text/attachments must be removed separately. Downloads, device backups and school-held copies remain the holder's responsibility.