How to use AI Prefect

A plain-English guide for teachers, office staff, heads and governors. No technical knowledge needed.

AI tools can save a lot of time, but some of them keep what you type, store it abroad, or use it to improve their AI. Before you put anything about pupils, parents or colleagues into a tool, it’s worth checking a few things. AI Prefect gathers what each supplier says so you don’t have to dig through their small print.

AI Prefect is not legal advice and doesn’t replace your school’s own checks. Use it to get informed and to have a better conversation with your DPO.

What each field means

Supplier: The company that makes and runs the tool.
Website: Where we found the main information about the tool.
Category: What sort of tool it is, for example a chatbot or a lesson-planning helper.
Pupil-facing: Whether pupils use it directly, or only staff. Pupil use needs extra care.
Privacy notice: The supplier’s privacy notice: their own explanation of what they do with personal data.
Data processing agreement (DPA): The data processing agreement: the contract that sets out how the supplier must look after your school’s data.
Processor or controller: A processor only uses data on your school’s instructions. A controller makes its own decisions about the data, which means your school has less say.
Where data is stored: Which country the data is stored in. UK or EU storage is usually simpler for schools.
Trains AI models on inputs: Whether what you type (or upload) may be used to improve the supplier’s AI. “No” is what you want for anything about pupils or staff.
How long inputs are kept: How long the supplier keeps what you type before deleting it.
UK GDPR representative / DPO: Whether the supplier names a data protection officer or UK representative you can contact about data questions.
Signs individual DPAs with schools: Whether the supplier will sign a data agreement with your school specifically, rather than just standard online terms.
Minimum age: The youngest age the supplier allows to use the tool. Check this before any pupil uses it.
Key safety note: Anything else worth knowing, such as admin controls or content filtering.
Research status: How complete our research on this tool is.
Last checked: When we last read the supplier’s documents. Terms change, so older dates deserve a fresh look.

What “not stated” means

“Not stated” means we couldn’t find the answer in the supplier’s published documents. It doesn’t mean the answer is bad, and it doesn’t mean it’s fine. It just means you don’t know yet.

What to do: ask the supplier directly (there are suggested questions below), or ask your DPO whether they already have the answer. If a supplier can’t or won’t answer a basic data question, treat that as a warning sign.

What the status labels mean

Sourced: we’ve read the supplier’s published documents and recorded what they say.
Partial: we found some answers, but some documents were missing, blocked or unclear.
Needs full read: we’ve listed the tool but haven’t been able to read its documents properly yet.

Whatever the status, always check the last checked date. Suppliers change their terms and add new AI features, so an older entry may be out of date.

Red flags to look out for

Trains on inputs: Yes. What you type may be used to improve their AI. Never put personal information about pupils or staff into a tool like this.
Controller rather than processor. The supplier makes its own decisions about the data, so your school has less control.
Data stored outside the UK or EU, especially with no mention of safeguards.
Minimum age above your pupils’ age. If the tool says 13+ or 18+, younger pupils shouldn’t use it.
Lots of “not stated”, especially for training, storage location and how long data is kept.
No data agreement for schools. If the supplier won’t sign a DPA, talk to your DPO before going further.

On the directory, green labels are generally reassuring, amber means “check this”, and red means “take care”. They’re a quick guide, not a verdict.

Practical next steps

Talk to your DPO (data protection officer) or whoever handles data protection in your school or trust. Share the tool’s AI Prefect page with them.
Check whether a DPIA is needed. A data protection impact assessment is a short risk check your school should do before using a new tool with personal data. Your DPO will know if one already exists.
Check the age limit before any pupil uses the tool, and whether parental consent is needed.
Ask the supplier about anything marked “not stated”. Useful questions:
- Do you use what we type or upload to train or improve your AI?
- Where is our data stored, and who else can access it?
- How long do you keep what we type, and can we delete it?
- Will you sign a data processing agreement with our school?
- Do you meet the DfE’s generative AI product safety standards?
- What is the minimum age, and what filtering and monitoring do you provide?
Start small. Until it’s approved, use the tool only with made-up or non-personal examples.
Re-check when it changes. If the supplier announces new features or new terms, look again.

Found something out of date? Let us know.

Glossary

UK GDPR: The UK’s main data protection law. It sets the rules for how organisations, including schools and their suppliers, use personal information.
DPO (data protection officer): The person responsible for data protection in your school or trust. Every state school must have one, and they’re your first port of call.
DPIA (data protection impact assessment): A structured risk check done before starting something new that uses personal data in a way that could be risky. It records the risks and how you’ll reduce them.
DPA (data processing agreement): A contract between your school and a supplier setting out how the supplier must handle your data. Not to be confused with the Data Protection Act.
Data controller: The organisation that decides why and how personal data is used. For pupil data, that’s normally your school.
Data processor: An organisation that handles data only on the controller’s instructions. Ideally, an AI supplier acts as your processor.
Training on inputs: When a supplier uses what people type or upload to improve its AI models.

Go to the tool directory