Privacy Policy
Last updated: July 2026
1. Data Controller & Processor
Extended Essay Dashboard ("we", "us", "our") operates as a data processor on behalf of schools (the data controllers) that subscribe to the platform. Schools determine the purposes and means of processing personal data for their students and staff. We process data only on the documented instructions of the subscribing school.
2. Data We Collect
We collect: account information (name, email, role), school affiliation, Extended Essay project data (research questions, milestones, reflections, sources, drafts), supervisor feedback and meeting records, and—where a school uses the optional meeting-recording feature—meeting audio, transcript text, AI-generated draft summaries and action points. Either the student or supervisor may initiate the shared meeting record, but recording starts only after the on-screen notice is confirmed. After supervisor review, the student can access the approved meeting note and protected audio recording; the raw transcript, AI draft and staff-only notes remain restricted to authorised school staff. We also collect usage data (login times, feature usage) and contact form submissions.
3. Data We Do NOT Collect
We do not collect: payment card details (handled entirely by our PCI-DSS compliant payment provider), government identification numbers, biometric data, health data, precise geolocation, browser fingerprinting data, or data for advertising profiles. We never sell personal data, and we do not use student or minor data for advertising, profiling, or training public AI models.
4. Lawful Basis for Processing
The subscribing school, as data controller, determines the appropriate lawful basis for processing its students’ and staff data. We process school data as a processor under the school’s documented instructions and our service contract. For data we process for our own limited purposes, such as service security and direct business administration, the applicable lawful basis depends on the processing context. Users should avoid placing unnecessary special-category personal data in project or reflection content.
5. How We Use Data
Data is used to: provide the Extended Essay Dashboard service, enable student-supervisor collaboration, allow coordinators to monitor progress, generate analytics for school administrators, maintain security and audit trails, and communicate with users about the service. Data is never used for advertising or sold to third parties.
6. Data Isolation & Role-Based Access
All school data is strictly isolated. Each school's data is tagged with a unique school identifier, and all database queries are filtered by this identifier. No school can access, view, search or export data belonging to another school. Within a school, role-based access control (RBAC) ensures students, supervisors, coordinators, and administrators see only the data appropriate to their role.
7. Data Retention
Active school data is retained while needed to provide the service. Archived student data is retained in accordance with the school’s controller instructions, applicable legal or contractual requirements, and any retention configuration actually agreed for that school. Audit records may be retained in de-identified form for security and compliance. Account deletion removes appropriate live application records; residual encrypted backup copies follow the infrastructure provider’s backup lifecycle. Schools can request data export or deletion subject to their controller responsibilities and applicable law. See our Data Retention Policy for full details.
8. Your Rights
Subject to the conditions in applicable data-protection law, data subjects may have rights including access, rectification, erasure, portability, restriction and objection. Because the school is normally the controller for school/student data, requests may need to be coordinated with the school. The Settings page also provides an account-deletion route; deletion removes appropriate live application records while school-continuity, de-identified security records and infrastructure backups are handled as described in this policy. Contact hello@extended-essay.com with the subject line "Subject Access Request" for assistance.
9. Security Measures
We protect personal data with: TLS 1.2+ encryption for all data in transit; AES-256 encryption at rest; managed authentication; role-based access control enforced at the data layer; application audit logging for security-sensitive administrative actions; regular security reviews; and hosting on Base44 managed cloud infrastructure (SOC 2 Type II and ISO 27001 certified). See our Security Overview for full details.
10. Sub-Processors
We engage third-party sub-processors to operate the platform: Base44 (managed cloud hosting, infrastructure, authentication), Stripe (payment processing — only if a school subscribes to a paid plan), and Resend (transactional email delivery). Optional integrations (Google Calendar, Microsoft Outlook) are only activated if a user explicitly connects them. Full details are available on our Sub-processors page.
11. Personal Data Breach Notification
If we become aware of a personal-data breach affecting data we process for a school, we will notify the affected school as controller without undue delay and provide information reasonably required for the school's assessment and regulatory obligations. The school, as controller, is responsible for supervisory-authority and data-subject notifications where required by applicable law.
12. International Data Transfers
Data is hosted on Base44 managed cloud infrastructure. Our Base44 applications have been migrated to the UK data region; Base44 Support confirmed completion of that migration for all our apps. Where personal data is transferred internationally by us or our sub-processors, appropriate contractual and legal safeguards are used as required by applicable data protection law.
13. Cookies
We use essential cookies for authentication and session management. We do not use tracking cookies for advertising. Analytics cookies, if used, are anonymised and can be declined via the cookie banner shown on first visit.
14. Contact & Complaints
For data protection enquiries, Subject Access Requests, or complaints, contact us at hello@extended-essay.com. Schools can also contact their designated Data Protection Officer for school-specific data queries. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.