Privacy Policy

MyOracy Ltd (“MyOracy”, “we”, “us”, “our”) is a company incorporated in England and Wales, company number [COMPANY NUMBER — TBC], registered office [REGISTERED OFFICE — TBC]. We provide an oracy and debate platform used by schools, sixth forms, colleges and comparable institutions. The platform has two halves: a debate section, in which pupils argue motions and receive an adjudication, and an oracy section, in which pupils practise structured speaking and receive feedback on it.

One distinction governs the whole of this Policy. For personal data relating to pupils and staff, and for everything generated by their use of the platform, the institution is the data controller and MyOracy is the data processor. The institution decides which pupils use the platform and for what educational purpose; we act only on its documented instructions, recorded in a Data Processing Agreement. The institution's own privacy notice governs the purposes of processing, and this Policy describes how we give effect to them.

MyOracy is a controller in its own right only for a narrow and separable set of records: correspondence with institutional contacts, support requests, contract and billing administration, and the security and diagnostic logging of the service itself. Those records are not pupil records and are not held on any institution's behalf.

Identity is supplied by the institution, not created by us. Where an institution uses single sign-on, its identity provider, typically Microsoft Entra ID or Google Workspace, supplies the person's name and school email address at the point of login. We store those, the institution the person belongs to, and whether the person is a pupil or a member of staff. Pupils are not asked to create accounts or to set passwords.

Beyond identity, the platform holds only what use of it generates.

Special category data. We do not ask for special category data and no field in the platform requests it. A transcript is nonetheless a record of unscripted speech. A pupil arguing a motion on assisted dying, on immigration, or on faith schools may volunteer a belief, a health circumstance, or a personal anecdote that falls within Article 9 of the UK and EU GDPR. We therefore treat transcripts as capable of containing special category data volunteered by the speaker, rather than asserting that they cannot, and apply the retention limits at Section 07 and the access controls at Section 14 on that basis.

Audio is not biometric data. Speech audio is processed for one purpose only, to produce a text transcript of what was said. It is not used for voice identification, speaker verification, or any other biometric purpose, and no biometric template is created or stored at any point.

Personal data is processed only for the purposes set out below, each of which sits within the institution's instructions to us. We do not sell personal data, we do not use it for advertising, and we do not use it for behavioural profiling of any kind.

Model training. MyOracy does not use any personal data processed through the platform to train, fine-tune, or otherwise develop any AI model. Model inference is performed through Amazon Bedrock, and the position on the use of inputs by the model provider is governed by the Amazon Web Services service terms incorporated in our agreement with Amazon. Institutions who wish to see that position in its authoritative form should be referred to those terms rather than to a paraphrase of them here.

Because the institution is the controller for pupil and staff data, the lawful basis under Article 6 is the institution's to identify and to record in its own privacy notice. Maintained schools commonly rely on public task under Article 6(1)(e); independent and international schools more commonly rely on legitimate interests under Article 6(1)(f) or on contract. MyOracy does not select a basis on an institution's behalf and does not process pupil data for any purpose the institution has not instructed.

Where a transcript is found to contain special category data volunteered by a speaker, the Article 9 condition is likewise the institution's to identify. In a school setting this is most often the substantial public interest condition read with the relevant safeguarding provisions of the Data Protection Act 2018. Our role is to hold the data securely, to delete it on the agreed schedule, and to surface it to the institution when the institution asks.

For the narrow set of records where MyOracy is itself the controller, the bases are these.

MyOracy engages three sub-processors. Each is disclosed to institutions in advance of deployment, and each is engaged under written terms. Institutions are notified of any proposed change and may object, in accordance with the Data Processing Agreement.

Anthropic is not a sub-processor. Anthropic's Claude models perform the assessment, but they are supplied to us by Amazon through Amazon Bedrock. Anthropic as a company does not receive platform data, and an institution's contractual chain runs to Amazon rather than to Anthropic.

Microsoft and Google are not our sub-processors when used for single sign-on. The pupil authenticates against the institution's own tenant, which the institution controls and contracts for directly. Data flows from the institution to us, not from us to them.

Each sub-processor is engaged under a written data processing agreement, and each is prohibited from using platform data for any purpose other than delivering the service to us.

Everything MyOracy operates itself runs on Amazon Web Services in the Frankfurt region, eu-central-1. The database, the application, and the debate engine all sit inside that single region. Model inference is performed through Amazon Bedrock using European inference profiles, so the transcript is assessed on hardware inside Europe and does not leave the European Economic Area for that step.

There is one transfer outside the European Economic Area: speech audio sent to Groq in the United States for transcription. Because MyOracy is a processor acting for institutional controllers, an onward transfer to a sub-processor is a processor to processor transfer, and the applicable module of the 2021 EU Standard Contractual Clauses is Module Three rather than Module Two.

Personal data is retained for the minimum period necessary for the purpose it was collected for, and for any period required by law. Institutions may agree shorter periods in their Data Processing Agreement, and the shorter period then governs.

On termination, an institution may request a full export of its data or its deletion. Institution-wide deletion requests are completed within 30 days, subject to any lawful retention requirement.

Because the institution is the controller for pupil and staff data, a pupil, a parent, or a member of staff should address a request to the institution's data protection lead in the first instance. MyOracy assists the institution in meeting the request within the timescales set out in the Data Processing Agreement, and does not respond directly to a data subject over the head of the controller. Where MyOracy is itself the controller, as set out at Section 01, requests come to us directly and we respond within one month.

Adjudica AI is the assessment engine. It receives the text transcript of what a pupil said and returns a score and written feedback against a published rubric. It does not receive the audio. This is an architectural fact rather than a policy commitment: the audio is consumed by transcription and discarded before assessment begins, so there is no point in the pipeline at which the assessing model could analyse a voice even if it were instructed to.

The consequence matters for schools operating in the European Union. Because assessment operates on text alone, the system does not and cannot infer emotion, mood, or state of mind from vocal characteristics, and performs no speaker recognition. What it evaluates is argument: substance, use of evidence, engagement with the opposing case, and the persuasive construction of the speech as recorded in words.

Online debates run over Daily, a real-time communications provider that supplies the room and carries the live audio and video between participants. Daily's recording feature is not used. It is switched off, and the platform is built so that it cannot be enabled inadvertently, which means no video or audio of a debate is retained by Daily.

The Adjudica engine joins the session as a participant. It performs two functions at once. It manages the room, which is to say it holds the timings, calls speakers in order, and enforces the format. It also listens, receiving the audio stream in the same way any other participant in the room would, and holding that audio in memory. From that point the path is the same as everywhere else on the platform: the audio goes for transcription, the text comes back, and the audio is discarded.

An institution should be able to tell pupils and staff, before a session begins, that an automated participant is present in the room. It is not a hidden observer and it does nothing the pupils are unaware of, but it is present.

In-person debates and solo oracy practice work differently. There is no video call at all. The pupil's browser captures the audio and sends it to our servers within the request itself, and our servers pass it for transcription and discard it when the text returns. An institution that runs only in-person sessions transmits no pupil data to Daily at any point.

Authentication is by single sign-on against the institution's own identity provider, typically Microsoft Entra ID or Google Workspace. When a person signs in, we receive their name, their school email address, and an account identifier. We do not receive passwords, and we do not receive directory information beyond what is necessary to identify the account. Revoking a person's account in the institution's tenant prevents them from signing in to MyOracy immediately, and multi-factor authentication is enforced at the tenant level and applies to MyOracy logins accordingly.

Should MyOracy introduce any analytics or other non-essential technology, this Policy will be updated in advance and consent obtained where the law requires it. A separate Cookie Policy records the full inventory.

Most of the people whose data passes through this platform are children. That is not incidental to the design and it is not treated as incidental here. Accounts are created by the institution, the institution decides who uses the platform, and no pupil is ever the commercial counterparty.

The following commitments apply in addition to everything set out above, and are repeated in the Data Processing Agreement so that they are contractual rather than merely stated.

MyOracy applies technical and organisational measures appropriate to the risk, and to the fact that most data subjects are children. The measures below are those presently implemented. Detailed security documentation is available to institutional partners on request, and the measures required by Article 32 are set out in full in the Data Processing Agreement.

MyOracy maintains a documented incident response procedure. The processor's primary statutory duty under Article 33(2) is to notify the controller without undue delay, and the sequence below is built around that duty. The institution, as controller, decides whether the threshold for notifying a supervisory authority or affected individuals is met, and MyOracy provides the information it needs to make that decision. Institutions should report any suspected incident involving MyOracy data to us immediately.

If MyOracy Ltd is involved in a merger, an acquisition, a financing, a reorganisation, or a sale of assets, personal data held by MyOracy may transfer to a successor entity as part of that transaction. Any successor would be required, as a condition of the transfer, to honour the commitments in this Policy and in the Data Processing Agreements under which pupil data is held.

Where such a transaction would materially change how personal data is processed, MyOracy will notify affected institutions at least 30 days before the change takes effect, and institutions retain the right to request deletion of their data first. Pupil data will not be transferred to an entity that would use it for commercial purposes inconsistent with the commitments at Section 13.

This Policy is reviewed twice a year, in January and July, and is updated whenever the platform, the sub-processor arrangements, the applicable law, or regulatory guidance changes in a way that affects it. The version number and date on the cover identify the current version.

Material changes, meaning those that substantively alter how personal data is processed or that affect the rights of data subjects, are communicated to institutional partners at least 30 days before they take effect. Non-material clarifications, such as improved wording or corrected links, take effect on publication. An institution that objects to a material change should contact us before it takes effect.

For any question or request relating to this Policy, please contact MyOracy at contact@myoracy.co. We aim to acknowledge privacy correspondence within five working days. Pupils, parents, and staff should contact their institution's data protection lead in the first instance, as set out at Section 08, because the institution is the controller and will liaise with us on their behalf.

If you are not satisfied with the response, or you believe personal data is being processed unlawfully, you have the right to complain to a supervisory authority.

This Policy was approved for publication in August 2026. Next scheduled review: January 2027.