Legal
Complete transparency on where your data goes, how it is used, and what is stored.
Last updated: 24 March 2026
Our core commitment: FeedLab is designed so that student personal data never leaves your device. Excel files are parsed in your browser. Only aggregate, anonymised statistics are ever sent to the AI. No student names. No class codes. No teacher names are transmitted or stored beyond what is needed to run your account.
Student names never uploaded
Student names and individual scores are processed entirely in your browser. They are never transmitted to FeedLab servers. Closing the tab clears all student data immediately.
No surnames required
FeedLab requires first names only. If a Surname column is detected in an uploaded file, a GDPR warning is shown and processing is blocked until it is removed.
AI receives only aggregate data
When using the AI Feedback Assistant, only question names, class averages, and performance band counts (not student names or individual scores) are sent to the AI provider.
Account data only on servers
The only personal data stored on FeedLab servers is your account information: name, email, and school. This is used exclusively to provide the service.
EU-based infrastructure
Account data is stored in Supabase on EU-region servers, in compliance with UK GDPR data transfer requirements.
Encrypted in transit
All communication between your browser and FeedLab servers uses TLS encryption. Passwords are hashed and never stored in plaintext.
The table below covers every action in FeedLab and exactly where data flows. We want schools and MATs to be able to verify this independently.
| Action | Processed where? | Stored? | Sent to AI? | Notes |
|---|---|---|---|---|
| Upload Excel data sheet (Feedback Generator) | Your browser only | Never — cleared when tab closes | No | All parsing happens locally via browser JavaScript. No data leaves your device. |
| Upload Excel data sheet (AI Feedback Assistant) | Your browser only | Never — cleared when tab closes | No | The file is parsed in your browser. Only aggregate statistics are ever used by the AI. |
| Generate AI feedback statements | FeedLab server → OpenAI API | Not stored by FeedLab or OpenAI (API mode) | Yes — question names/topics, class average %, band counts only | No student names. No individual scores. The assessment name you enter is included — use a generic title (e.g. "Y10 Mock") to maximise anonymity. |
| AI chat refinements | FeedLab server → OpenAI API | Not stored | Yes — your messages + question context (names, averages, band counts) | No student names or individual scores are included in chat context. |
| Save to History | FeedLab servers (Supabase, EU) | Assessment name, number of students, per-question averages, band counts | No | Individual student names and scores are NOT saved. Only aggregate class-level data is stored. |
| Export PDF report | Your browser only | Never — PDF is generated locally and downloaded directly | No | PDF generation happens entirely in your browser. No student data is transmitted. |
| Account registration & login | FeedLab servers (Supabase, EU) | Your name, email, school name | No | Used only for authentication and to provide the service. |
When you generate or refine feedback statements using the AI Feedback Assistant, the following data is sent to OpenAI via FeedLab's API (in API mode, OpenAI does not use this data to train its models):
Not sent: student names, individual student scores, teacher names, class codes, or any personally identifiable information.
First names only in Excel files
Remove any Surname or Last Name columns from your data sheets before uploading. FeedLab will warn you if a surname column is detected and block processing until it is removed.
Generic assessment names
Use titles like "Y10 Mock 1" rather than names that include student group identifiers, teacher initials, or school codes when using the AI Feedback Assistant.
No class codes required
Class codes and teacher names are not required by FeedLab and should not be included in any data you upload.
Local processing for mark data
For maximum data security, all student mark data is processed locally in your browser and never leaves your device. There is nothing to audit or delete on our servers.
This Data Processing Agreement ("DPA") is between Averon Labs Ltd ("Processor") and the individual or institution that has created a FeedLab account ("Controller"). It sets out the terms under which Averon Labs Ltd processes personal data on behalf of the Controller.
Averon Labs Ltd processes the following categories of data on behalf of the Controller:
Student personal data (names, individual scores) is processed locally in the Controller's browser and is not received, stored, or processed by Averon Labs Ltd.
Processing is carried out solely to provide the FeedLab service as described in the Terms of Use and Privacy Policy. The legal basis for processing is the performance of the contract between Averon Labs Ltd and the Controller.
Averon Labs Ltd uses the following sub-processors:
| Sub-processor | Purpose | Location | Data received |
|---|---|---|---|
| Supabase | Database and authentication | EU | Account data and assessment aggregates only |
| Vercel | Application hosting | EU/UK | Web traffic only (no persistent data) |
| OpenAI | AI feedback generation (API mode) | USA | Assessment name, question topics, aggregate statistics only — no student names or scores. OpenAI API does not use this data for model training. |
| Resend | Transactional email | EU | Teacher email address only |
Averon Labs Ltd will assist Controllers in fulfilling their obligations to respond to requests from data subjects exercising their rights under UK GDPR. Requests should be submitted to hello@feedlab.app.
For data protection enquiries, contact Averon Labs Ltd at hello@feedlab.app.