Privacy Policy.

1. Overview

This privacy policy explains how Intellect Education Limited collects, uses, stores, and protects personal data in connection with SprintUp Education — the company's flagship product. It applies to all users of the platform: school administrators, teachers, students (whose data is managed by their school), and curriculum creators.

Intellect Education Limited is registered in Ireland and subject to the General Data Protection Regulation (GDPR) (EU) 2016/679. This regulation sets one of the world's most comprehensive frameworks for personal data protection. All users of SprintUp Education — regardless of where they are located — benefit from these protections as our baseline standard.

2. Who we are

Data controller: Intellect Education Limited, registered in Ireland, company number 792238. We are the controller for account, billing, website and support data. For student data we act as a processor on behalf of the school (see Section 5).

Product: SprintUp Education (trading name), a two-sided platform for schools and curriculum creators operated by Intellect Education Limited.

Data protection contact: contact@intellect.education

General contact: contact@intellect.education

3. Data we collect

We collect personal data in the following categories, depending on how you use the platform:

We do not ask for special category data under GDPR Article 9 (such as health, ethnicity, religion or biometric data). Schools should not enter such data about students unless their own legal basis allows it.

Cookies. Essential cookies keep you signed in and remember your cookie choice; these need no consent. Google Analytics runs on the website, the school admin app and the Curriculum Studio only if you accept it in the cookie banner, and you can withdraw at any time through Cookie settings at the foot of every page. The teacher and student apps use no analytics. Our cookie policy lists every cookie, its purpose and how long it lasts.

4. How we use data

We use the data we collect only for the following purposes:

Delivering the platform. Account creation, authentication, course delivery, marketplace transactions, AI tool operation, and all core platform functions.

Platform improvement. With your consent, Google Analytics shows us which pages are used and how people find us, so we can improve the website and the platform. We look at totals and trends, not at individual people, and we do not send your name, email address or account id to Google.

Communications. Service notifications (account activity, billing, security), product updates you have opted into, and responses to your support requests.

Legal compliance. Meeting our obligations under Irish and EU law, including financial record-keeping, responding to lawful data requests, and enforcing our terms of service.

We do not use personal data for advertising, profiling for third-party marketing, or any purpose not listed above.

5. Schools as data controllers

For student data, the school is the data controller and SprintUp Education is the data processor. The school decides which student data to enter, why, and for how long. We process it only on the school's instructions, as set out in our Data Processing Agreement (DPA) under GDPR Article 28.

What the DPA covers. The purpose and duration of processing, the categories of data and data subjects, our security measures, the sub-processors we use (Section 8), how we help the school answer data subject requests, breach notification to the school without undue delay, and deletion or return of student data when the contract ends.

Sub-processor changes. We will tell schools by email at least 30 days before adding or replacing a sub-processor that handles student data. A school may object on reasonable data protection grounds and, if we cannot resolve the objection, end the agreement for that reason.

Schools in the EU or EEA should have the signed DPA in place before enrolling students. Request it from contact@intellect.education. Schools remain responsible for their own legal basis and any consents required under their local law.

6. Children and minors

SprintUp Education is used by schools that teach learners of all ages, from primary children to adults. Student data is always entered and managed by the school, never collected from a child directly by us.

Direct accounts. Only people aged 18 or over can create a direct account (school administrator, teacher or creator). Students of any age access the platform through accounts the school creates for them.

School responsibility for minors. When a school enrols students under 18, the school must have a lawful basis to share their data with us and, where its law requires, parental or guardian consent. In Ireland the digital age of consent is 16; other EU countries set it between 13 and 16. Schools outside the EU, including in the United States, are responsible for their local student privacy laws.

What we do with student data. We use it only to run the school's campus: enrolment, classes, progress and the student portal. Never for advertising, profiling for marketing, or training AI models.

7. AI tools and data

The AI curriculum tools send your prompt and the material you ask them to work on to a third-party AI provider, which returns the generated content. The tools are available to teachers, creators and administrators for planning and content work, not for processing student records.

Which providers. Standard generation uses DeepSeek. Premium models, where a plan includes them, are provided by Google, OpenAI or Anthropic depending on the model chosen. A school can instead connect its own provider account and key from the Designer Studio settings, in which case its own provider agreement applies.

What providers receive. The text of your prompt and any material you include in it. We do not attach your name, your school's name or student records to prompts. Do not paste students' personal data into prompts.

No automated decisions. AI output is a draft for a teacher or creator to review. We make no decisions about a student, such as grades or placements, by automated means.

8. Third-party processors

We use the following providers to run the platform. Each one processes data only for the purpose stated and under a data processing agreement with us. This list is also the sub-processor list for schools under the DPA.

We do not share personal data with anyone else, except where the law requires it or to protect the platform and its users.

9. Data retention

Account data is retained for as long as your account is active. If you close your account, personal data is deleted within 90 days unless retention is required by law (e.g. financial records).

Student data is retained for as long as the school's account is active. When a school closes its account, student data is deleted within 90 days. Schools may request earlier deletion at any time via contact@intellect.education.

Financial records (transaction history, invoice data) are retained for 7 years as required under Irish tax law.

Usage analytics are retained in aggregated, anonymised form indefinitely. Identifiable usage logs are retained for 12 months then anonymised. Google Analytics keeps event data for the retention period set on our account, at most 14 months; its cookies expire after 13 months, and withdrawing consent deletes them from your browser.

Content created (curriculum, lesson plans, course materials) remains associated with the creating account until deletion is requested. Creators retain intellectual property rights to their content as per the Terms of Service.

10. Your rights

Under GDPR you have the following rights. To use any of them, email contact@intellect.education from your account email address. We respond within one month, free of charge. If a request is complex we may take up to two further months and will tell you why.

For student rights requests: Because schools are the data controller for student data, requests from students or their parents/guardians regarding student data should be directed to the school in the first instance. The school will coordinate with us where necessary.

11. Security

We implement technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission (TLS), hashed password storage, access controls, and regular security assessments.

If a personal data breach happens, we notify affected schools without undue delay so they can meet their own obligations as controllers. Where we are the controller and the breach is likely to put people at risk, we notify the Irish Data Protection Commission without undue delay and, where feasible, within 72 hours of becoming aware, and we tell affected users directly if the risk is high (GDPR Articles 33 and 34).

12. International transfers

Platform data, including student records, is stored in the EU. Some providers in Section 8 process data outside the European Economic Area.

United States. Transfers to Stripe, Google, OpenAI, Anthropic and Google Analytics rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.

China. DeepSeek, our standard AI provider, is based in China, which has no EU adequacy decision. For that reason we send DeepSeek prompt text only, never account details or student data, and we ask users not to include personal data in prompts. Schools that do not want any prompts processed in China can select a premium model or connect their own provider (Section 7).

You can ask contact@intellect.education for a copy of the safeguards that apply to a specific provider.

13. Policy updates

We may update this policy as the platform evolves, as our third-party processors change, or as legal requirements develop. When we make material changes — particularly to how we handle student data, AI data processing, or data subject rights — we will notify registered users by email and display a notice on the platform.

The "last updated" date at the top of this document reflects the most recent revision. Previous versions are available on request by emailing contact@intellect.education.

Continued use of the platform after a material update constitutes acceptance of the revised policy. If you disagree with any material change, you may close your account and request deletion of your data.

14. Contact and complaints

For any questions about this policy, to exercise your rights, or to raise a data protection concern, contact us at:

If you believe your data protection rights have been infringed and we have not resolved your complaint satisfactorily, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC) at dataprotection.ie, or with the supervisory authority in your EU member state of residence.