Privacy
Who we are
ETTOL is published by GenEd Labs Ltd (Company No. 16163397, ICO registration ZB967066), the data controller for this site. Contact: ettol@genedlabs.ai.
The short version
The board itself needs nothing from you. You can read every rating, the evidence behind it, and the Teachers and Parents guides for published tools, without an account. A free account gives you the Schools, trusts & orgs guide and My board, where you can save the tools you use and see what has changed on them since your last visit. We collect personal data when you choose to give it — an account, a follow, a provider claim, a message or enquiry you send us, a problem report, or accepted analytics — and we keep a record of significant actions taken on the site, such as signing in or a claim being approved, so they can be accounted for later. Apart from two records for provider accounts, described below, we do not record what you read.
What the ratings contain
Our assessments are about products and companies, not people. The evidence base holds public documentation about tools, not personal data about pupils, teachers or families. Nothing you do on this site changes any rating.
If you just visit
The board's data (ratings, guides, the change record) is served from our own database, hosted for us by Supabase; their servers see your IP address as part of serving the site, as any website's host does. We count visits with Plausible Analytics, which uses no cookies and stores no personal data. It briefly processes your internet address to count daily visitors, and does not keep it. Plausible is based in the EU and holds its data in the EU. Separately, Google Analytics 4 runs only if you accept it on the cookie banner: anonymised, no advertising features, no data sold. Google's privacy policy. Until you accept, Google Analytics sets no cookie and receives nothing from your visit. Three cookies are set as soon as a page opens, whatever you choose. Lovable, which hosts the site, sets session-id for its built-in count of visits and page views. It lasts 30 minutes and renews while you browse. You cannot refuse it at present, and we are working to remove it. Lawful basis: our legitimate interest in knowing how the site is used. Lovable also sets __dpl, which as we understand it keeps your visit on one version of the site while an update goes out. It lasts 24 hours. Cloudflare, which runs the network Lovable uses, sets __cf_bm to tell visitors from automated bots and protect the site. It lasts 30 minutes. The full list is on Who handles this site's data. You can change your mind at any time using Cookie choice in the footer. Your cookie decision is stored in your browser, not on our servers.
If you create an account
We store your email address, a password (hashed by our database provider, never visible to us), the role you choose at onboarding, the tools you follow, any notes you keep on tools, and the time you last viewed your change feed. If you register as a teacher or a school or trust leader we also store your organisation type and phase and, only if you choose to give it, your organisation's name; you can change these at any time on your account page. Notes are private to your account and are never published. We use these to provide the account: your guides, your watchlist, your change feed. Lawful basis: performing our contract with you. If you ask us to delete your account, this data is deleted with it. We also store your email preferences: whether you want messages when a tool you follow changes, and whether you want occasional ETTOL news. You can change them any time on your account page.
If you have tool change emails on, we send at most one email a week, on a Monday, and only when a tool you follow has a published change since the last one we sent you. The email lists the tools and the change wording already shown on this site, and we store the date we last sent you one. Each email carries a single-use unsubscribe link; we store only a one-way hash of that link, never the link itself, so we can honour it without it being readable in our records. Using the link turns tool change emails off for your account. Lawful basis: performing our contract with you.
If you represent a tool on the board
Claim invitations and requests: your name, work email address, role and any message you send us, kept so we can verify who speaks for a tool. Lawful basis: our legitimate interest in keeping the claiming process honest, and steps taken prior to a contract. Provider content you submit (statements, links, resources, case studies, replies) is business content you intend us to publish; it appears only after our review and is labelled as provider-supplied. We record which address an invitation was sent to and which address accepted it, so the claim trail is auditable.
Evidence you send us. If you use the evidence form, we keep your name, your role, your work email address, your confirmation that you are sending it for the company, the tool it is about, and each line you add: the area, the type of resource, the link, the passage and the date. We use these to consider the evidence in your tool's next review, to reply to you by email, and to keep a record of what we were sent and by whom. Only we can read what you send, and nothing sent through the form is published. Lawful basis: our legitimate interest in assessing tools on what their providers publish, and in being able to account for what we were sent. We keep each submission for 24 months and then delete it.
When you accept our provider terms, we record your account, the tool, the version of the terms and when you accepted them. This record is deleted with your account. If you accept them when sending the evidence form, the record is kept with that submission. Lawful basis: our legitimate interest in being able to show which terms were accepted.
If you copy or download our badge, we record which account did so and when. This record is deleted with your account. If a company shows our live badge, we count the website it appears on and how many times a day it is shown. We do not record who sees it. Lawful basis: our legitimate interest in knowing where the ETTOL badge is used.
When you or a colleague first open your tool's page from your provider area, we record which account did so and when, so that 'Review your tool page' shows as done for your whole team. We also record when you last looked at your tool's change tracker. Both are deleted with your account.
If you write to us
The contact form and the schools and trusts enquiry form send us your name, your email address, the topics you choose and what you write. We store your message so we can see that it has been answered, we use it to reply, and we use it for nothing else. You do not need an account, and if you are signed in when you send an enquiry your account's email address is used. Lawful basis: our legitimate interest in answering the people who write to us.
Launch alerts. If you ask to be told when a tool is published, we keep your email address, the tool names you typed and the date. We use them only to email you about those tools. We delete your details when you unsubscribe, or 12 months after you signed up, whichever comes first. To unsubscribe, reply to any email from us or contact us.
In depth access requests. If you ask for access to In depth, we keep your email address, your school or organisation, your role and the date. The request also reaches us by email. We use these only to reply to you about In depth access: to decide whether to open access for you, and to tell you how it works. Lawful basis: steps you ask us to take before entering into a contract with us. We delete your details, including the email, 12 months after you asked, or sooner if you ask us to. If you are given access, your account details are then kept as described under "If you create an account".
If you report a problem
The Report an issue button sends us what you write, together with technical details about your browser and the page you were on. Every one of those details is shown to you before you send, and you can switch any of them off; anything you switch off is never sent. The details we offer to attach are the page you were on and the page you came from, your browser and operating system, your language, timezone and window size, the time, and any error messages the site produced while you were using it. Error messages occasionally contain text you had typed into the page, which is why they are shown to you and why you can leave them out. We do not attach your IP address.
If you are signed in, your email address and account type are attached, so we can reply and can see the site as you saw it. If you are not signed in you may leave an email address; it is optional, and without one we cannot reply to you and your report reaches us anonymously. We use reports to find and fix faults, and for nothing else. Lawful basis: our legitimate interest in the site working correctly.
Keeping a record of what happens
We keep a record of significant actions on this site: signing in and out, someone from our team standing in as another role to check what that role sees, a claim being requested, approved or withdrawn, an invitation being sent or opened, provider content being saved or published, and requests made through our interface for AI assistants. Each entry records what happened, when, and which account did it.
Apart from the two provider records described above, we do not record what you read. Opening a tool, running a search or filtering the board leaves no entry.
We keep this because some things have to be answerable later: who approved a claim, who saw an assessment before it was published, who changed a provider's page. Lawful basis: our legitimate interest in keeping the site secure and its decisions accountable. The record is visible only to us, and we keep entries for 24 months.
Where a request is not signed in, the entry records only that it happened and which application made it. It holds nothing that identifies a person: no name, no email address, no IP address.
How we learn from use
We look at account data in aggregate to understand how the board is used: how many accounts exist by role, and which tools are most followed. We do not examine individual accounts for this, and nothing about your account is published or shared.
Who processes data for us
Supabase provides our database, sign-in and file storage; this data is processed in the United States and the transfer is safeguarded by standard contractual clauses. Google Analytics 4 (only after consent) provides anonymised usage statistics and may process this in the United States under recognised transfer safeguards. Lovable hosts the website. Cloudflare runs the network Lovable uses to deliver the site, including its protection against automated traffic. Mailgun sends our email, such as sign-in links and the replies you ask us for, and processes it in the European Union. We do not sell data, we use no advertising networks, and we do not profile visitors.
How long we keep things
If you ask us to delete your account, it is deleted within 30 days along with your follows and settings. Our record of significant actions is kept for 24 months, or until you delete your account, whichever comes first. Provider claim invitations and requests are kept for 12 months so the claim trail stays auditable. Messages sent through the contact and enquiry forms, and problem reports, are kept for up to twelve months and may be deleted sooner. Published provider content remains until unpublished. Analytics data is retained by Google Analytics for up to 14 months. Evidence sent through the evidence form is kept for 24 months.
Children
This site is written for adults: teachers, parents, school leaders and providers. We do not knowingly collect personal data from children under 13. Pupils never use ETTOL itself; the board exists to scrutinise the tools pupils are given.
Your rights
You have the right to access, rectify, erase, restrict, and port your data, to object to processing, and to withdraw consent at any time. Write to ettol@genedlabs.ai and we will respond within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office: https://ico.org.uk, telephone 0303 123 1113.
Changes
We update this notice when the site's processing changes. This version: 09-10-2026.