Privacy Policy: Schools

Auris Tech Limited Privacy notice for education settings

Last updated 2026-09-10

Who this addendum is for

This addendum is for schools, academies, academy trusts, local authorities, colleges and other education settings that hold pupil accounts on the Fonetti School Platform, and for the school staff who administer them. It is also written to be read by parents who want to understand what happens when their child uses Fonetti at school.

It covers the Fonetti School Platform only. The National Read Aloud Challenge is a separate arrangement in which Auris Tech is the controller and not your processor, and the Challenge Schools addendum covers it. A school can do both.

Everything not specific to schools (who we are, how speech is processed, security, storage location, international transfers, individual rights, cookies, contact details) is in the Privacy Policy. That policy and this addendum together are our privacy notice for you.

Schools also get a second document. The processing terms required by Article 28 of the UK GDPR are in the Schools Data Processing Agreement, which we issue to every school we work with; ask us and we will send you the current version to review, whether or not you are already a customer.

This notice says what we do with pupil data and why. The agreement is what obliges us to, and it is the one to rely on if you ever need to hold us to something.

In this notice, “school” means the education setting or the body legally responsible for it, and “Auris Tech” means Auris Tech Limited.

1. Our role, and yours

Our role differs depending on which data is in question.

Personal data	Controller	Our role
Pupil data: everything listed in section 2	The school	Auris Tech is a processor, acting on the school’s instructions
School staff account data: names, work contact details, roles and access permissions	The school decides who its staff are and what access they have. Auris Tech is controller where it uses a staff member’s professional contact details for its own purposes: billing, administering the account, and contacting them about Fonetti under section 4	Processor for the accounts you set up, controller for our own use of their contact details
Billing and contract data: purchase orders, invoices, billing contacts, subscription records	Auris Tech	Controller
Platform security and abuse prevention: infrastructure logs, authentication records, fraud and misuse detection across our whole service	Auris Tech	Controller
Marketing and relationship data: enquiries, demo requests, and communications with school staff in their professional capacity	Auris Tech	Controller

Where a single log contains both kinds of record, we treat it as pupil data, because what a pupil did inside Fonetti is yours even where the same record shows how our infrastructure behaved.

Where we are the controller, the Privacy Policy gives the lawful basis, how long we keep it and who else receives it, and individuals can exercise their rights against us directly.

A staff account can see the reading records of any pupil at your school, not only the classes that member of staff teaches, so treat an account as access to the whole school’s reading data.

1.1 What we will never do with pupil data

Whatever the purpose, there are things we will never do with your pupils’ data. These are contractual commitments in the Schools Data Processing Agreement, not statements of intent. We will not:

• sell or license it, or anything derived from it, or give it to anyone else for their own purposes;
• use it for advertising or marketing;
• use it to make, or to inform, a decision about a child that is taken outside Fonetti, including any decision about their education, attainment, support needs or placement, and any decision with a legal or similarly significant effect on them;
• use it to train or develop any general-purpose artificial intelligence model, or to build anything other than a product for children’s reading or literacy; or
• try to identify an individual pupil from any dataset or statistics we have extracted.

We do publish figures about how much children are reading, such as the hours read across a region or across the whole UK in a week. A figure like that describes a group and never a child, and we will not name your school in one unless you agree.

2. Pupil data we process for you

Pupil details reach us from the school, not from the pupil or their parent. On the school’s behalf, we process:

• Pupil name, or an identifier of the school’s choosing
• Class, group or cohort membership
• Reading-progress data: what a pupil has read and how their reading is developing
• Usage data: how and when the app is used
• Technical data from the device: IP address, device type and model, operating system and app version
• The internal Fonetti identifier for the pupil’s account
• Diagnostic logs relating to pupil activity
• Support correspondence about a pupil, where a member of your staff raises a ticket with us

Please do not send us anything beyond this list. If something else reaches us anyway, we use it only to deal with that matter and we do not add it to the pupil record. It then sits under the retention period of wherever it arrived, a support ticket for example, and we will work with you to deal with it sooner if you ask.

2.1 How long we keep pupil data

While your subscription runs, this is your decision. Pupil accounts stay open until you remove them, nothing is deleted automatically at the end of a term or an academic year, and a pupil carries their reading history forward unless you decide otherwise. You can delete an individual pupil at any time in the Fonetti School Platform, without asking us.

If a subscription simply lapses, nothing is deleted straight away. Your access is suspended and pupil data is preserved for 90 days, so you can renew or ask for a copy, and we tell your named contact at expiry and again at least 14 days before anything is deleted.

If you tell us you are not renewing, or ask us in writing to delete it, we delete all pupil data within 30 days. You can ask for a copy of it first, or for a defined extension to move to another provider.

Support correspondence about a pupil is kept for 12 months from case closure, and backups are overwritten on the cycle in section 12 of the Privacy Policy.

The agreement puts all of this on a contractual footing.

3. Speech

Audio is not recorded or stored, and we hold no recordings of your pupils. Fonetti listens to a pupil reading in order to follow the text and measure progress. Section 5.1 of the Privacy Policy explains how speech is handled.

4. Marketing to school staff

We may contact school staff in their professional capacity about Fonetti; section 10.3 of the Privacy Policy gives the basis and the opt-out.

5. Information for parents

If your child uses Fonetti through their school, the school is the data controller for your child’s reading data. It decides that Fonetti will be used, what pupil information is entered, and how long it is kept. Your child’s details reach us from the school, not from you.

That means requests about your child’s data (to see it, correct it or delete it) should go to the school in the first instance. We act on the school’s instructions and are not able to change or delete pupil data without them.

If you come to us instead, we will pass your request to the school so that it can respond to you.

We also use reading data to develop and improve Fonetti, and our other products for children’s reading or literacy. We decide that work ourselves rather than doing it on the school’s instructions, so for that use we are the controller and your school is not. Section 6 of the Privacy Policy describes it, and section 1.1 above is what we will never do with it.

What we learn can help our other reading products. Your child’s data does not go into them. If the work shows us a better way to do something, we can build that into another product. Your child’s reading data stays in their school account.