Effective date: 18 October 2026
Privacy Policy
1. Introduction
This policy explains how TeachForge.ai collects, uses, stores and deletes personal data. It applies to our website and to the Whiteboard, Workshop, Quest Ladder and Virtual Lab.
We process personal data under the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act. Where we offer the Service to people in the United Kingdom, the UK GDPR and the Data Protection Act 2018 also apply to that processing. Where your local law gives you more, your local law applies.
Learners do not need accounts. They join a lesson by a personal link under a handle their teacher assigns, or by a board's link under a name they choose. A learner never needs to give us their real name, an email address or a date of birth.
2. Who is the controller and who is the processor
The controller is the company named under Company details at the end of this page and on our company details page, established in Estonia and trading as TeachForge.ai. For data protection matters contact privacy@teachforge.ai. We have two distinct roles:
| Data | TeachForge role | School / teacher / tutor role |
|---|---|---|
| Teacher and organisation account data (our customers) | Controller | Their own staff accounts as users of the Service |
| Learner participation data (answers, progress, session cookies, pseudonymous handles) | Processor | Controller — they decide the purpose of the lesson and keep any handle-to-child mapping outside the platform (for example a class spreadsheet) |
We never need a learner's real name or email address. The readable handle on a class list grants access to nothing; only a personal link, or a launch from the school’s own learning platform, starts a learner session. Our data processing agreement (DPA) applies to every account holder who teaches learners, including an individual teacher or tutor.
3. Information we collect
3.1 Account information (teachers and organisations)
When you register we collect your name, email address, and a password (stored hashed). You may add a profile photograph. Organisation admins may provide the organisation’s name, the staff email addresses allowed to join it, and seat and licence details, and, if they choose, the organisation’s country, postal address and tax number for its invoices. When you sign up we may ask how you heard about TeachForge; answering is optional.
When you accept our terms, and our refund policy when you buy, we keep a record of which version you accepted and when, which version of this policy we showed you, and the IP address, browser and language it came from. You may also add a second email address to recover your account.
3.2 Subscription and payment information
Paid plans are sold through Paddle, our merchant of record, which processes the payment. We do not store card numbers. We retain customer and subscription identifiers, plan tier, and billing status needed to run your subscription.
We also keep a copy of the customer record Paddle holds for you: your name, email address, language and billing address, for a business its name and tax number, and whether you agreed to receive marketing emails. When you delete your account, we clear these details from our copy at once.
To apply our once-per-person full refund, we also keep the type, last four digits and expiry date of the card you paid with, as Paddle reports them, and compare them with earlier full refunds.
3.3 Content you create
We store User Content you create — whiteboards, Workshop assets, Quest Ladder materials, Virtual Lab configurations, uploads, and related metadata — so we can provide the Service, including collaboration where you enable it.
3.4 Learner participation data (minimised)
When learners join (no account is required) we may process:
- A pseudonymous internal reference and a teacher-facing readable handle that grants no access
- Personal-link secrets (24 hours unless the teacher chooses otherwise) and session records issued when a learner opens their personal link
- On a board, the name a learner chooses to appear under, with when they joined and which pages they visited, kept until the board is deleted
- For activities that record whose work it is, a password the learner sets the first time (at least eight characters), stored only as a hash; their teacher can reset it but never sees it
- Answers, progress, and the surface an answer came from (for example live whiteboard, homework link, or Virtual Lab gatekeeper)
- Technical connection data (for example IP address) for security, abuse prevention, and reliability
We do not require national IDs, school roll numbers, or photographs of learners to use core teaching features. Teachers and organisations must not upload special-category or highly identifiable learner records unless they have a lawful basis and their own policies allow it.
3.5 Usage and technical data
We automatically process IP address and approximate location derived from it; browser and device type; pages and features used; timestamps; referral information; and performance or error logs.
To show you which devices are signed in to your account, and to warn you of a sign-in from a new one, we set a device cookie (see our Cookie Policy) and keep, for each device, a one-way code made from it, the kind of browser and system, the last IP address and country it was used from, and when it was first and last used.
3.6 Bug reports and session recordings
If you consent to it, your browser keeps a short recording of your own session, stored on your device. Nothing is sent to us unless you report a problem and choose to attach the recording to that report. Recordings carry no name or email address, and values you type into form fields are obscured. We use them only to diagnose the problem you reported. The recording is deleted after 30 days. When your report is resolved, we remove our link to it at once. You can decline this entirely, and change your mind at any time, from our Cookie Policy page. Learner pages are never recorded, whatever you choose.
A bug report itself carries what you write, the full address of the page you were on, your IP address, your browser and screen size, and technical diagnostics from the page; sent from a board, it also carries a snapshot of the board unless you untick it. Page feedback and suggested translations carry what you write, the page address, your IP address and your browser.
3.7 Communications
If you contact us (form, email, WhatsApp Business where configured, or support), we process the message content and contact details you provide.
With a message sent through our contact form we also keep your IP address and the approximate location worked out from it.
If you apply to become a TeachForge partner, we keep your name, email address, country, how you would reach people, what you write and the language you applied in, so that we can decide on your application and reply to you in that language. We do this because you asked us to consider you for a partner agreement. If we decline your application, we keep our reason with it. If we accept it, it becomes part of your partner record.
As a partner, your partner record holds your name, a contact email address, our notes on how to pay you, and the commission you earn. We use it to carry out our partner agreement with you, and we keep the commission you earned as a billing record because the law requires it.
If we ask you for a few words about TeachForge and you choose to answer, we keep your words. We use them to improve TeachForge, because that is in our legitimate interests. We show them publicly, on our website only, if you tick the box that agrees to it, with the form of your name and the role you choose, and only after we have read them. If we gave you anything in return, we say so beside your words. You can stop them being shown at any time, on the same page or in your account. If your words have been shown, we then keep one copy, which nobody else sees, for 12 months in case of a complaint about them, or until you delete your account, whichever comes first.
If you ask for TeachForge news and offers, when you sign up or later in your account, we keep your answer and a record of each time you gave or withdrew it: when, how, and the wording and language you saw. Once your email address is verified, we add your name, email address and the language you use TeachForge in to our news list, and you confirm by email before any news is sent. News emails go only to people who have said yes. You can stop at any time, with the link in every news email or the switch in your account.
You can also ask for TeachForge news and offers without an account, on our subscribe page. We then keep your email address and the name you give, and send news only after you confirm by email. You can stop at any time, and delete your details from the list, with the link in every news email.
3.8 Cookies
See our Cookie Policy.
4. How we collect information
- Directly from you — registration, profile, content creation, billing, forms, and support.
- Automatically — cookies, server logs, and real-time collaboration connections.
- From third parties — payment confirmation and your customer record from Paddle, our payment provider; bot-detection scores from reCAPTCHA where used; your name, email address and Google account identifier if you choose Sign in with Google; and, when you open TeachForge from your school’s learning platform, that platform’s own identifier for you and, if it matches your school’s student ID format, your student ID. Names the platform shows your teacher are fetched when the page opens and never stored.
5. Legal bases for processing
Under Article 6 GDPR (and Article 6 UK GDPR for users in the United Kingdom) we rely on:
- Contract — providing the Service you request (account, content hosting, paid features).
- Legitimate interests — security, abuse prevention, product improvement, and supporting educators worldwide, balanced against your rights.
- Consent — where required (for example certain non-essential cookies or optional marketing). You may withdraw consent at any time.
- Legal obligation — tax, accounting, and responding to lawful requests.
- Processor instructions — for learner participation data we act only on the documented instructions of the school, teacher, or tutor as controller.
6. How we use information
- Operate accounts, hosting, collaboration, embeds, and support
- Process subscriptions and prevent fraud or abuse
- Improve reliability, accessibility, and teaching tools
- Send transactional messages; send marketing only where permitted
- Enforce our Terms and protect users and the Service
We do not use learner participation data to sell advertising.
7. Sharing
We do not sell personal data. We may share data with:
- Service providers under contracts: hosting, email delivery, payments, bot protection, network security, an IP location service, a password breach check and a staff messaging service
- The AI provider you connect, only when you add your own API key or your own GPU server: it receives the prompt you send and what you paste into it, under that provider's terms
- Collaborators you invite (display name and collaboration presence as needed for the session)
- Authorities where legally required
- Business transfers with appropriate safeguards and notice where required
- With your consent in other cases
An account holder may ask us for the list of these providers at privacy@teachforge.ai.
7a. YouTube
TeachForge uses YouTube API Services so that you can upload a lesson recording to your own YouTube channel. Nothing reaches YouTube unless you connect a channel and choose to upload. When you connect, you agree to the YouTube Terms of Service, and Google handles your data under the Google Privacy Policy.
On Google's own consent screen you give us permission to upload videos to your channel and to view your YouTube account. With that permission we read two things: your channel's name and ID, only to show you which channel a recording will go to; and, after each upload, that one video's upload, processing and privacy status, only to tell you whether the upload worked and to give you its link. We do not read your other videos, your comments, your subscribers or your viewing history.
Google gives us keys that let the upload happen. They are kept in your browser, with your channel's name and ID, and not on our servers. The recording is sent to YouTube and we keep no copy. We share none of this with anyone else.
To disconnect a channel from this device, use its Remove button in the recording panel. To withdraw TeachForge's access everywhere, use Google's security settings at security.google.com/settings/security/permissions. Videos you have uploaded belong to your channel; you manage or delete them on YouTube.
8. International transfers
We are established in Estonia, in the European Union, and we hold your data on our own servers in the United Kingdom, which has an adequacy decision from the European Commission. Some providers process data outside the European Economic Area. Where they do, we rely on an adequacy decision of the European Commission, the EU Standard Contractual Clauses, or another transfer mechanism under Chapter V of the GDPR. For personal data of users in the United Kingdom we additionally use the UK Addendum to the Standard Contractual Clauses or the UK International Data Transfer Agreement. You may ask us for a copy of the safeguards at privacy@teachforge.ai.
8a. Anonymous site measurement
We count how our own pages are used, without cookies and without keeping anything that identifies you. A browser that sends the Global Privacy Control signal is not measured. When one of our pages runs into an error, it sends us a report that carries no personal details.
9. Retention, deletion, and community content
We keep personal data only as long as we need it, or as long as the law requires:
Account deletion / erasure. You may delete your account or email privacy@teachforge.ai to exercise your right to erasure. Private cloud content associated with your account is erased, and subscriptions are cancelled with the payment provider where applicable. Some records may be retained where the law requires (for example limited billing records).
How long we keep each kind of data:
| Data | Kept for |
|---|---|
| Account record | While the account is open, then erased on deletion |
| Your acceptance of our Organisation Agreement for an organisation, or your earlier statement that an organisation accepts our Terms, with your name and role as you wrote them | Until the organisation’s account is deleted, including after your own account is deleted |
| Your entry on our news list | Until you stop the news emails, and 30 days more |
| Sign-in records | 90 days |
| Emails we send | 30 days |
| Messages sent through the contact form, and the email address given with a bug report | 12 months |
| An application to become a partner | 12 months from when you applied, or 12 months from when we declined it, or until you delete your account, whichever comes first. If we accepted it, as long as your partner record |
| A partner record | While the partnership lasts, then until 12 months after it ends, or until you delete your account, whichever comes first. If you never linked an account, it is removed sooner once the partnership has ended and 12 months have passed since we accepted you. The commission you earned is then kept as a billing record |
| Words you wrote about TeachForge when we asked you, which you did not agree to show | 2 years from when you sent them, or until you delete your account, whichever comes first |
| Words you agreed to show | While they are shown. When you stop them being shown, we keep one copy, which nobody else sees, for 12 months, or until you delete your account, whichever comes first, then delete it Words that were never shown are deleted at once |
| A record of your agreement to show your words (the statement you agreed to, the date, and when you withdrew) | Until your account is deleted |
| Bug-report session recordings | 30 days. When your report is resolved, we remove our link to it at once |
| Records of a data-rights request | 3 years after the request is closed |
| Billing records | As long as tax and accounting law requires — seven years under the Estonian Accounting Act |
| Learner participation data (answers, progress) | Until the teacher or school erases it, or the teacher account is deleted |
| Learner access links | 24 hours, unless the teacher chooses otherwise |
| Boards not opened for a year | Deleted after we email the board's owner; our Terms of Service give the dates |
Erased data may remain in our backup copies for a limited time, until they are overwritten.
Community library exception (by design). If you submit content that is approved into the community library, TeachForge keeps a platform-owned copy so other educators are not left without materials mid-term. Your private copy is erased with your account; withdrawing a community submission removes the shared copy according to community rules, without deleting other teachers' adapted private copies.
10. Security
We protect personal data with technical and organisational measures appropriate to the risk.
11. Your rights
Depending on applicable law (the GDPR, and the UK GDPR for users in the United Kingdom), you may have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You also have rights regarding solely automated decision-making; we do not currently take solely automated decisions that produce legal or similarly significant effects about you.
Learner rights requests arrive through the school, teacher, or tutor as controller. We assist them and can erase participation data by handle. Anyone — including a learner or a parent without an account, who never has to give us a name — can also ask us directly using our data request form; where the school is the controller we pass the request to it and tell you we have done so. Teachers and organisation admins email privacy@teachforge.ai for their own account rights, and we respond within one month. Portability is self-service: you can request a machine-readable export of your account data from your account settings and download it as a single archive when it is ready. Learner participation data is exported through the controller.
12. Children and safeguarding
Direct TeachForge.ai accounts are intended for teachers and education professionals aged 16+. We do not knowingly create accounts for under-16s. Learners participate through teacher-led sessions without needing a learner account, and a learner never needs to give us their real name, an email address or a date of birth. For schools in the United States, the school authorises our processing of learner participation data for an educational purpose; our position under the Children's Online Privacy Protection Act is available to schools on request. See our Safeguarding Statement.
13. Worldwide users
TeachForge is built for educators in many countries and languages. Local laws may grant additional rights. Where a stricter local rule applies to you, we will honour it to the extent required. Contact us if you need a region-specific discussion for a school, ministry, or NGO programme.
14. Changes
We may update this policy. We will revise the effective date on this page and, for material changes, provide reasonable notice.
15. Contact and complaints
Data protection: privacy@teachforge.ai
General enquiries: hello@teachforge.ai
Our registered company name, number and registered office are on our company details page.
Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) — https://www.aki.ee — which accepts complaints in Estonian or English. You may also complain to the data protection authority of the EU country where you live or work. If you are in the United Kingdom you have the right to complain to us directly, and we will acknowledge your complaint, investigate it and tell you the outcome; you may also complain to the Information Commissioner's Office (ICO) — https://ico.org.uk. Where we have appointed a representative in the United Kingdom under Article 27 UK GDPR, their name and address appear on our company details page. Please contact us first so we can try to resolve your concern.
This policy is written in English. Translations are provided for convenience; if a translation and the English version differ, the English version prevails.