Privacy Policy
Last updated: September 2026
1. Data Controller & Processor
Extended Essay Dashboard ("we", "us", "our") operates as a data processor on behalf of schools (the data controllers) that subscribe to the platform. Schools determine the purposes and means of processing personal data for their students and staff. We process data only on the documented instructions of the subscribing school.
2. Data We Collect
We collect: account information (name, email, role), school affiliation, Extended Essay project data (research questions, milestones, reflections, sources, drafts), supervisor feedback and meeting records, and—where a school uses the optional meeting-recording feature—meeting audio, transcript text, AI-generated draft summaries and action points. Either the student or supervisor may initiate the shared meeting record, but recording starts only after the on-screen notice is confirmed. After supervisor review, the student can access the approved meeting note and protected audio recording; the raw transcript, AI draft and staff-only notes remain restricted to authorised school staff. We also collect usage data (login times, feature usage) and contact form submissions.
3. Data We Do NOT Collect
We do not collect: payment card details (handled entirely by our PCI-DSS compliant payment provider), government identification numbers, biometric data, health data, precise geolocation, browser fingerprinting data, or data for advertising profiles. We never sell personal data, and we do not use student or minor data for advertising or commercial profiling. We do not train our own AI models on student data. Where an optional AI-assisted feature is used, relevant user- or staff-initiated content may be processed through Base44 AI and its disclosed model-provider chain to provide that feature.
4. Lawful Basis for Processing
The subscribing school, as data controller, determines the appropriate lawful basis for processing its students’ and staff data. We process school data as a processor under the school’s documented instructions and our service contract. For data we process for our own limited purposes, such as service security and direct business administration, the applicable lawful basis depends on the processing context. Users should avoid placing unnecessary special-category personal data in project or reflection content.
5. How We Use Data
Data is used to: provide the Extended Essay Dashboard service, enable student-supervisor collaboration, allow coordinators to monitor progress, generate analytics for school administrators, maintain security and audit trails, and communicate with users about the service. Data is never used for advertising or sold to third parties.
6. Data Isolation & Role-Based Access
All school data is strictly isolated. Each school's data is tagged with a unique school identifier, and all database queries are filtered by this identifier. No school can access, view, search or export data belonging to another school. Within a school, role-based access control (RBAC) ensures students, supervisors, coordinators, and administrators see only the data appropriate to their role.
7. Data Retention
Active school data is retained while needed to provide the service. Archived student data is retained in accordance with the school’s controller instructions, applicable legal or contractual requirements, and any retention configuration actually agreed for that school. Audit records may be retained in de-identified form for security and compliance. In-app account deletion removes the authentication account, profile photo and appropriate personal access records, but does not automatically destroy school-controlled educational records. A tracked deletion request is created so the school, as controller, can decide whether remaining educational records should be erased, exported or retained. Residual backup copies follow the infrastructure provider’s backup lifecycle. See our Data Retention Policy for full details.
8. Your Rights
Subject to the conditions in applicable data-protection law, data subjects may have rights including access, rectification, erasure, portability, restriction and objection. Because the school is normally the controller for school/student data, requests may need to be coordinated with the school. The Settings page provides an in-app account-deletion route that immediately removes the sign-in account and service access while creating a tracked controller-review request for any remaining school-controlled educational records. Contact hello@extended-essay.com with the subject line "Subject Access Request" for assistance.
9. Security Measures
We protect personal data with managed authentication, role-based access control enforced at the data layer, application audit logging for security-sensitive administrative actions and regular security reviews. The service is hosted on Base44 managed infrastructure; Base44 states that its platform uses TLS 1.2+ in transit and AES-256 at rest and that Base44 is SOC 2 Type II and ISO 27001 certified. Those provider certifications are not certifications of Cross Sword Ltd or LearnStudio. See our Security Overview for full details.
10. Sub-Processors
We engage third-party service providers and sub-processors to operate the platform, including Base44 (managed cloud hosting, infrastructure and authentication), Stripe (payment processing — only if a school subscribes to a paid plan), the currently configured transactional-email provider where service email is enabled, and the Base44 AI/model-provider chain for optional AI-assisted features. Optional integrations are only activated where explicitly connected. Full details are available on our Sub-processors page and maintained provider register.
11. Personal Data Breach Notification
If we become aware of a personal-data breach affecting data we process for a school, we will notify the affected school as controller without undue delay and provide information reasonably required for the school's assessment and regulatory obligations. The school, as controller, is responsible for supervisory-authority and data-subject notifications where required by applicable law.
12. International Data Transfers
Data is hosted on Base44 managed cloud infrastructure. Storage and processing locations, international transfers and sub-processor arrangements depend on our Base44 service configuration and the provider’s current contractual terms. Where personal data is transferred internationally by us or our sub-processors, appropriate contractual and legal safeguards are used as required by applicable data protection law. Current provider information is available to schools as part of due diligence.
13. Cookies
We use essential cookies and local browser storage for authentication, session continuity, security and basic interface preferences. We do not currently deploy optional analytics, advertising or behavioural-tracking cookies. If that changes, this notice and the required choice mechanism will be updated before non-essential technologies are enabled.
14. Contact & Complaints
For data protection enquiries, Subject Access Requests, or complaints, contact us at hello@extended-essay.com. Schools can also contact their designated Data Protection Officer for school-specific data queries. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.