Nousara Privacy Notice

The short version

• Nousara helps tutors record a tutoring session, turn it into a written transcript, and use AI to produce a progress report for the student, their parent and (where an agency is involved) the agency.
• The session audio is not kept. It is turned into text and then discarded.
• Transcripts and screenshots are stored securely in the UK/EU and deleted automatically after 12 months. Reports are kept so you can follow progress over time.
• A child's sessions are only recorded after a parent or guardian has given consent, and that consent can be withdrawn at any time.
• We never sell your data or use it for advertising, and your data is not used to train AI models.
• You can ask to see, correct or delete the data we hold. Contact privacy@nousara.co.uk.

The rest of this notice gives the full detail.

1. Who we are, and who controls your data

Nousara is operated by Favour St John, trading as Nousara, based in the United Kingdom.

Who is the "controller" depends on the data:

• Your tutoring session data (students and parents). When you use Nousara through a tutor or a tutoring agency, that tutor or agency is the controllerof the student's and parent's session data, and they decide that sessions are recorded and analysed. Nousara acts as their processor, handling the data on their instructions. You should also be able to see your tutor's or agency's own privacy information; ask them if you have not.
• Tutor and agency account data. For the accounts that tutors and agencies hold with us (sign-up details, settings, billing, security logs), Nousara is the controller.
• Running and improving the service. For keeping Nousara secure and working, Nousara is the controller, acting in our legitimate interests as described below.

For any question about your data, or to exercise a right, contact us at privacy@nousara.co.uk.

2. The information we process

Depending on who you are, this may include:

• Tutor / agency account data: name, email address, hashed password, profile and subject details, and billing information (once payments are live).
• Student data: name, year group or level, subjects, session history, and the AI-generated progress and performance information derived from sessions.
• Parent / guardian data: name, email address, and parent-portal login details.
• Consent records:the fact and date of a parent's consent, the version of the consent statement agreed, and a one-way hashed token used to confirm the consent link (we do not store the raw link token).
• Session content: audio (processed in real time, not stored), transcripts, periodic screenshots of the shared on-screen work, and the reports produced from them.

We do not deliberately collect special category data (such as health, religion or special educational needs). However, a transcript may incidentally capture such a reference if it comes up in conversation. We minimise this, do not use it to make decisions, and treat it with the same protection as the rest of the session data.

Where student and parent data comes from. We usually receive student and parent details from the tutor or agency rather than from the student or parent directly. The categories are those listed above.

3. How we use your information, and our legal basis

We do not use any incidentally-captured special category data as the basis for a decision about anyone, and we do not use personal data to train AI models.

4. The AI analysis, explained

Nousara uses an AI model (provided by Anthropic) to read a session transcript and screenshots and produce a written report: topics covered, strengths, areas to work on, and progress indicators. This is a form of profilingof a student's learning.

It is not a decision made solely by a computer with legal or similarly significant effects. The report is a support tool: a human tutor reviews it and remains responsible for decisions about a student's learning. Reports are labelled as AI-generated and may contain errors, and they should not be the sole basis for any decision about a child. If you would like a person to review how a report about you or your child was produced, contact privacy@nousara.co.uk.

5. Who we share your information with

We use a small number of carefully chosen service providers (sub-processors) who act on our instructions under data processing agreements. We do not sell your data, and we do not share it for advertising.

We may also share data where we are legally required to, or to protect the safety of a child or another person.

6. Sending data outside the UK

Most of your data stays in the UK and EU. Where a provider processes data in the United States (Anthropic and Resend), the transfer is protected by UK-approved safeguards: the EU Standard Contractual Clauses with the UK Addendum (and, for Resend, the EU–US Data Privacy Framework with UK Extension), together with a transfer risk assessment. This means your data receives a comparable level of protection wherever it is processed.

7. How long we keep your information

We delete data sooner if you make a valid erasure request.

8. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to deleteyour data (the "right to erasure");
• ask us to restrict or object to our processing;
• request a copy of certain data in a portable format; and
• withdraw consent at any time, where we rely on consent; this stops future recording but does not affect anything done beforehand.

To exercise any of these, email privacy@nousara.co.uk. We will acknowledge your request and respond within one month. Because we sometimes act as processor for a tutor or agency, we may need to pass your request to them as the controller, and we will tell you if we do.

If we receive your request, we verify who you are before we disclose or delete anything, to protect against fraudulent requests.

9. Children and parents

Most students using Nousara are aged 13–18. We take this seriously and follow the ICO's Age Appropriate Design Code (the Children's Code).

• A child's sessions are recorded only after a parent or guardian has given consent through a confirmation link we send them. Loading the link does nothing on its own; consent is recorded only when the parent actively confirms.
• A parent or guardian can withdraw consent at any time, which stops future recording, and can exercise the rights in section 8 on their child's behalf.
• We use clear, plain language (like "the short version" at the top of this notice) so that young people can understand what happens to their data.

10. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at privacy@nousara.co.uk. We have a formal complaints process and will acknowledge your complaint within 30 days.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. We would, though, appreciate the chance to put things right first.

11. Changes to this notice

We may update this notice as Nousara develops. When we make a material change, we will update the version and date above and, where appropriate, tell you directly. If a change affects what a child's data is used for, we will seek fresh parental consent where required.

12. Contact

Privacy enquiries and rights requests: privacy@nousara.co.uk

General contact: hello@nousara.co.uk