Legal
Safeguarding & Data Protection Draft — pending legal review
Last updated 19 August 2026
Built to sit inside your school's safeguarding structure, not around it.
Your school stays in control
When Infiniumlab is deployed through your school, your school remains the data controller for your students' information under the EU General Data Protection Regulation (GDPR). Infiniumlab acts as your data processor — working only on your instructions, under a signed data processing agreement. We never use student data for advertising, and we never sell it.
We collect only what the tutoring loop needs
A student account, their answers, and the misconceptions our system flags as they learn — nothing more. No behavioural advertising trackers on the learning pages.
Every AI conversation says so
Wherever our Socratic tutor is talking with a student, the interface makes clear they're speaking with an AI system, not a person, in line with the EU AI Act's transparency rules. Teachers can review flagged exchanges from the dashboard at any time.
Raising a safeguarding concern
If you need to raise a safeguarding concern about a student, please say so clearly in your message and mark it "Safeguarding" when you contact us. We treat these separately from general enquiries and respond as a priority.
Rights that travel with the student
Parents and schools can ask to see, correct, or delete a student's data, under GDPR Articles 15–20, through enquiries@infiniumlab.com. We aim to act on verified requests within 14 days.
How long we keep records
| Data | Retention |
|---|---|
| Learning activity data | 2.5 years, then anonymised |
| Safeguarding-related records | 2.5–3 years |
Supervisory authority
Infinium Lab Ltd is registered in Cyprus. Our lead supervisory authority under GDPR is the Cyprus Commissioner for Personal Data Protection.
For our fuller data-handling practices, see our Privacy Policy.