BC Academy AI

1. Who We Are

BC Academy International School is a KHDA-regulated British curriculum school in Dubai, UAE. We are the data controller for all personal data processed through the BC Academy AI platform.

This platform is provided exclusively to registered users of BC Academy — teachers, students, parents, and administrators — and is not accessible to the general public.

2. What Data We Collect

From all users (via Google OAuth):

• Name and email address
• Google profile picture URL
• Google OAuth access token and refresh token. These are held server-side in our database and are never sent to your browser. They are protected by our database provider's encryption at rest and by access controls; the application itself does not apply a second layer of encryption to them.
• Role (teacher, student, parent, or admin)
• Last login timestamp

From students (stored in our database):

• Year group and class assignment
• Date of birth — used only to apply the under-13 BCA Assistant restriction required by UAE law
• Subject grades and term assessments
• Attendance records (present, absent, late counts)
• Personal task list (titles and due dates — you create these)

From parents:

• Email address (must be pre-registered by the school)
• Link to their child's school account

BCA Assistant conversations (students only):

• Every message you send to BCA Assistant and every reply it sends back are stored in our database as part of a session record (student email, year group, timestamps, transcript).
• An automated review system reads these transcripts to produce pedagogical and safeguarding signals visible to your teachers, parents, and the school's Designated Safeguarding Lead. See Section 4 below for details.
• Messages sent to the AI are processed by Anthropic (Claude) under their data processing terms. Anthropic does not use our student data to train its models.
• Conversations with BCA Assistant by teachers, parents, and administrators ARE stored in our database, as a conversation record with the messages you sent and the replies you received. They are retained so that you can return to an earlier conversation. They are not part of the automated review system described in Section 3a, which applies to pupil conversations only.

Via Google Workspace APIs (with your permission):

• Google Classroom: courses, assignments, submissions
• Google Drive: the platform requests full access to your Google Drive. In practice it (a) lists file names and links, (b) reads the content of documents you explicitly select — for example a scheme of work you choose as planning input — and (c) creates new documents in your own Drive, such as generated plans, slides and worksheets. It does not read your Drive in the background.
• Google Calendar: event titles, times, and locations

3. How We Use Your Data

• To provide personalised dashboards with grades, attendance, and schedules
• To power the BCA Assistant with relevant school context
• To allow parents to monitor their child's academic progress
• To enable teachers to manage courses, assignments, and student lists
• To maintain your personal task list
• To detect and comply with age restrictions (BCA Assistant blocked for students under 13)

We do not sell your data, use it for advertising, or share it with third parties except as described in this policy.

3a. Automated Review of Student BCA Assistant Conversations

BCA Assistant conversations by students are processed by an automated review system ("AI Insights") designed to support safeguarding and pedagogy. This section describes what that processing does and who can see the results.

What is extracted:

• Category — one of: safeguarding concern, wellbeing signal, academic honesty concern, learning struggle, engagement pattern, content policy attempt, or positive learning signal.
• Urgency — immediate, this week, or background.
• Signal, rationale, and suggested action — short text describing what was noticed and what an adult might do about it.
• Evidence excerpt — a short verbatim quote from the student's message that triggered the flag.

Who sees flags, by category:

• Safeguarding signals go ONLY to the Designated Safeguarding Lead. They are NEVER sent automatically to parents. If a disclosure appears to involve a family member, this separation protects the student.
• Wellbeing, academic honesty, content policy attempts — visible to the student's teachers.
• Engagement patterns — visible to the student's parents.
• Learning struggles and positive signals — visible to both teachers and parents.

Human review:

No decision affecting a student is made solely by the automated system. Flags are suggestions for a human (teacher, parent, or DSL) to consider. Every flag can be reviewed, annotated, or dismissed by an authorised adult.

Your rights:

You may delete your BCA Assistant chat history and associated review flags at any time from Settings → BCA Assistant → Delete my chat history. You may also request a copy of what has been stored about your conversations by contacting admin@bcacad.org.

4. Children's Data and Under-13 Protection

Separately from that restriction, all pupil access is currently suspended (see the notice at the top of this policy), so no pupil of any age can sign in at present. When pupil access resumes, pupils under 13 will be able to view their grades, attendance and personal tasks, but will not be able to use the BCA Assistant.

We should be equally clear about what we do not yet have. The school does not currently hold a recorded parental consent for each pupil whose data is in this platform. Establishing that record is part of the review now under way, and it is one of the reasons pupil access is suspended rather than running while the question is open.

Parents or guardians of students under 13 may contact the school to request a review of what data is stored about their child, or to request deletion.

5. Data Retention

• User accounts: Retained while the person is enrolled or employed at the school. Removal after leaving is carried out by the school as an administrative action; it is not automated, so it is not guaranteed to happen within a fixed number of days.
• Student BCA Assistant conversations and review flags: Retained for the duration of your enrolment unless you delete them from Settings. The school performs a school-wide retention review at the end of each academic year and may purge conversations older than the current school year.
• BCA Assistant conversations (teachers, parents, admins): Stored in our database and retained until deleted. There is currently no automatic purge of these conversations; you may ask the school to delete yours at any time.
• Grades, assessment results and attendance: Retained for the academic year in which they were recorded and, as KHDA expects of a school record, for up to two further academic years after a pupil leaves. Deletion before then is an administrative decision by the school, not an automated process.
• Google OAuth tokens: Refreshed on login and updated in the database. Cleared when you delete your account.
• Personal tasks: Retained until you delete them or request account deletion.

6. Third-Party Services

We use the following trusted third-party services:

• Google (Alphabet Inc.) — OAuth authentication and Google Workspace APIs (Classroom, Drive, Calendar). Governed by Google's Privacy Policy.
• Anthropic PBC — AI responses in the BCA Assistant are processed by Claude. Students and staff are served by Claude Sonnet; the parent assistant uses Claude Haiku. Anthropic is also the processor used to read uploaded assessment reports (see below). Governed by Anthropic's Privacy Policy. Under Anthropic's commercial API terms, data submitted through the API is not used to train its models and is retained only briefly for abuse monitoring.
• OpenAI, L.L.C. — Teacher-facing image and diagram generation only (GPT-4o and DALL·E 3). A teacher types a short description of a picture or a graph they want for a lesson, and that description is sent to OpenAI. No pupil personal data is included in these requests — the feature is available to staff accounts only, it takes a free-text description rather than any pupil record, and the code that builds slide image prompts has no access to pupil information by design. Governed by OpenAI's Privacy Policy. Under OpenAI's API terms, submissions through the API are not used to train its models by default.
• Google — Gemini API (Google LLC). This is a separate service from Google Workspace above, under different terms, and we list it separately for that reason. It is used to generate illustrations for teaching slides. A short description of the required picture is sent to Google; no pupil personal data is included, for the same structural reason given for OpenAI.
  The school's Gemini key is on Google's paid service tier, on which Google's terms state that it does not use submitted prompts or responses to improve its products.
  A change we are recording rather than leaving unsaid. Until 29 August 2026 this key was on Google's free tier, where Google's terms did permit it to use submitted content to improve its models and to have that content read by human reviewers. We moved it to the paid tier on that date, which stops this going forward but does not recall anything sent before it. What was sent was lesson-slide picture descriptions written by staff — no pupil personal data has ever been sent to this service, and that is enforced by the design of the software rather than by care alone. Governed by the Gemini API Additional Terms of Service.
• Century Tech Ltd — Adaptive learning platform used by the school. When a teacher views class or student progress through BCA Academy AI, queries are made to Century Tech's Connect API using a school-level API key. Century Tech acts as a separate data controller for the learning data it holds. Governed by Century Tech's Privacy Policy.
• Supabase Pte. Ltd. (a Singapore company — this is the entity named in their Terms of Service and as data importer in their Data Processing Addendum) — Database hosting for user profiles, grades, assessment results, attendance, tasks and BCA Assistant conversations. Our database is hosted in Ireland (AWS eu-west-1).
• Render Services Inc. — Application hosting. Our services run in Frankfurt, Germany.

Where your data is processed — transfers outside the UAE

You should know that although the school is in Dubai, the platform's data is stored and processed outside the United Arab Emirates. Our database is in Ireland and our application servers are in Germany, as listed above. AI requests are processed by Anthropic, and — for teacher-facing image and diagram generation only — by OpenAI and by Google's Gemini API. Google Workspace data is processed by Google. All of these may process data outside the UAE.

UAE Federal Decree-Law No. 45 of 2021 (PDPL) permits personal data to be transferred outside the UAE where an adequate level of protection applies or where specific safeguards or consent are in place. We are currently reviewing this position with legal advice, and we are telling you plainly where your data sits rather than leaving it unstated. If you have questions about this, contact us using the details below.

Access by foreign authorities. Several of the companies we rely on are United States companies or run on United States-owned infrastructure — Google, Anthropic and OpenAI among them, and our database runs on Amazon Web Services. United States law, including the CLOUD Act, can in principle require a company subject to US jurisdiction to produce data it holds, regardless of which country that data is stored in. Separately, because the data physically sits in the European Union, EU judicial authorities can in principle direct a production order to a provider there.

We are not aware of any such request ever having been made in respect of this platform, and we would tell you if one were, so far as the law permitted us to. We mention it because choosing a European datacentre does not by itself put the data beyond the reach of US law, and you should be told that rather than left to assume otherwise.

7. Your Rights

Under UAE PDPL and applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Deletion — request deletion of your account and all associated data
• Restriction — request that we limit how we use your data
• Objection — object to processing of your personal data

You can exercise two types of deletion directly from the platform:

• Delete only your BCA Assistant chat history — keeps your account, grades, attendance, and tasks. Settings → BCA Assistant → Delete my chat history.
• Delete your entire account — this is not available as a self-service action. Because school records carry retention duties that an individual cannot waive on their own, account deletion is handled by the school: contact us using the details below and we will respond within 30 days.

For access requests, rectification, restriction, or objection, contact the school's Data Protection Officer (see contact details below). We will respond within 30 days.

Note on safeguarding records: if an automated review flag was created before you deleted your chat history, the flag and its evidence quote are deleted along with the chat. The school's separate safeguarding records (outside this platform) are governed by the school's safeguarding policy and UAE child-protection law, not this Privacy Policy.

8. Data Security

• All data is transmitted over HTTPS (TLS 1.2+)
• Session cookies are httpOnly and samesite=lax to prevent cross-site attacks
• OAuth tokens are stored server-side — never exposed to the browser
• The Supabase service key is backend-only and never sent to the client
• Role-based access control ensures users can only see their own data

9. Content Policy and AI Compliance

The BCA Assistant is configured with strict content filters appropriate for a school environment in the UAE. All AI interactions are governed by:

• UAE Ministry of Education AI Guidelines 2026
• KHDA school content regulations
• UAE federal law and Islamic cultural values

The AI will not produce content that conflicts with UAE law, public morals, or the school's safeguarding policy. Any serious welfare concerns raised in chat are directed to the school's Designated Safeguarding Lead (DSL).

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. For significant changes, we will notify registered users via email or through a notice in the platform.

Contact Us

For privacy-related enquiries, data access requests, or to exercise your rights under UAE PDPL: