Privacy
Who we are
ETTOL is published by GenEd Labs Ltd (Company No. 16163397, ICO registration ZB967066), the data controller for this site. Contact: victoria@genedlabs.ai.
The short version
The board itself needs nothing from you. You can read every rating, guide and piece of evidence without an account. We collect personal data when you choose to give it — an account, a follow, a provider claim, a message or enquiry you send us, a problem report, or accepted analytics — and we keep a record of significant actions taken on the site, such as signing in or a claim being approved, so they can be accounted for later. We do not record what you read.
What the ratings contain
Our assessments are about products and companies, not people. The evidence base holds public documentation about tools, not personal data about pupils, teachers or families. Nothing you do on this site changes any rating.
If you just visit
The board's data (scores, guides, the change record) is served from our own database, hosted for us by Supabase; their servers see your IP address as part of serving the site, as any website's host does. Analytics runs only if you accept it on the cookie banner: Google Analytics 4, anonymised, no advertising features, no data sold. Google's privacy policy. Until you accept, no analytics cookie is set. You can change your mind at any time using Cookie choice in the footer. Your cookie decision is stored in your browser, not on our servers.
If you create an account
We store your email address, a password (hashed by our database provider, never visible to us), the role you choose at onboarding, the tools you follow, any notes you keep on tools, and the time you last viewed your change feed. If you register as a teacher or a school or trust leader we also store your organisation type and phase and, only if you choose to give it, your organisation's name; you can change these at any time on your account page. Notes are private to your account and are never published. We use these to provide the account: your guides, your watchlist, your change feed. Lawful basis: performing our contract with you. If you ask us to delete your account, this data is deleted with it. We also store your email preferences: whether you want messages when a tool you follow changes, and whether you want occasional ETTOL news. Both are off unless you turn them on, and you can change them any time on your account page.
If you represent a tool on the board
Claim invitations and requests: your name, work email address, role and any message you send us, kept so we can verify who speaks for a tool. Lawful basis: our legitimate interest in keeping the claiming process honest, and steps taken prior to a contract. Provider content you submit (statements, links, resources, case studies, replies) is business content you intend us to publish; it appears only after our review and is labelled as provider-supplied. We record which address an invitation was sent to and which address accepted it, so the claim trail is auditable.
If you write to us
The contact form and the schools and trusts enquiry form send us your name, your email address, the topics you choose and what you write. We store your message so we can see that it has been answered, we use it to reply, and we use it for nothing else. You do not need an account, and if you are signed in when you send an enquiry your account's email address is used. Lawful basis: our legitimate interest in answering the people who write to us.
Launch alerts. If you ask to be told when a tool is published, we keep your email address, the tool names you typed and the date. We use them only to email you about those tools. We delete your details when you unsubscribe, or 12 months after you signed up, whichever comes first. To unsubscribe, reply to any email from us or contact us.
If you report a problem
The Report an issue button sends us what you write, together with technical details about your browser and the page you were on. Every one of those details is shown to you before you send, and you can switch any of them off; anything you switch off is never sent. The details we offer to attach are the page you were on and the page you came from, your browser and operating system, your language, timezone and window size, the time, and any error messages the site produced while you were using it. Error messages occasionally contain text you had typed into the page, which is why they are shown to you and why you can leave them out. We do not attach your IP address.
If you are signed in, your email address and account type are attached, so we can reply and can see the site as you saw it. If you are not signed in you may leave an email address; it is optional, and without one we cannot reply to you and your report reaches us anonymously. We use reports to find and fix faults, and for nothing else. Lawful basis: our legitimate interest in the site working correctly.
Keeping a record of what happens
We keep a record of significant actions on this site: signing in and out, someone from our team standing in as another role to check what that role sees, a claim being requested, approved or withdrawn, an invitation being sent or opened, provider content being saved or published, and requests made through our interface for AI assistants. Each entry records what happened, when, and which account did it.
We do not record what you read. Opening a tool, running a search or filtering the board leaves no entry.
We keep this because some things have to be answerable later: who approved a claim, who saw an assessment before it was published, who changed a provider's page. Lawful basis: our legitimate interest in keeping the site secure and its decisions accountable. The record is visible only to us, and we keep entries for 24 months.
Where a request is not signed in, the entry records only that it happened and which application made it. It holds nothing that identifies a person: no name, no email address, no IP address.
How we learn from use
We look at account data in aggregate to understand how the board is used: how many accounts exist by role, and which tools are most followed. We do not examine individual accounts for this, and nothing about your account is published or shared.
Who processes data for us
Supabase provides our database, sign-in and file storage; this data is processed in the United States and the transfer is safeguarded by standard contractual clauses. Google Analytics 4 (only after consent) provides anonymised usage statistics and may process this in the United States under recognised transfer safeguards. Lovable hosts the website. Mailgun sends our email, such as sign-in links and the replies you ask us for, and processes it in the European Union. We do not sell data, we use no advertising networks, and we do not profile visitors.
How long we keep things
If you ask us to delete your account, it is deleted within 30 days along with your follows and settings. Our record of significant actions is kept for 24 months, or until you delete your account, whichever comes first. Provider claim invitations and requests are kept for 12 months so the claim trail stays auditable. Messages sent through the contact and enquiry forms, and problem reports, are kept for up to twelve months and may be deleted sooner. Published provider content remains until unpublished. Analytics data is retained by Google Analytics for up to 14 months.
Children
This site is written for adults: teachers, parents, school leaders and providers. We do not knowingly collect personal data from children under 13. Pupils never use ETTOL itself; the board exists to scrutinise the tools pupils are given.
Your rights
You have the right to access, rectify, erase, restrict, and port your data, to object to processing, and to withdraw consent at any time. Write to victoria@genedlabs.ai and we will respond within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office: https://ico.org.uk, telephone 0303 123 1113.
Changes
We update this notice when the site's processing changes. This version: 01-09-2026.