Data protection impact assessment (DPIA): draft
Tool: Doodara Supplier: not stated (no company name published; site signs itself Doodara, contact hello@doodara.com)
School: [School to complete: school name] Prepared by: [School to complete: name and role] Date: [School to complete: date]
Draft generated by AI Prefect from the supplier’s published documents (checked 2026-11-09). A starting point only; not legal advice. Verify every fact before relying on it.
1. What the tool will be used for
| Type of tool | AI picture book and storybook generator (writes and illustrates personalised children's picture books from an idea, a story template or a photo; 16 art styles, 10 languages, flipbook sharing, PDF/EPUB export on paid plans) |
|---|---|
| Purpose in our school | [School to complete: what you will use it for, which year groups or staff, and why] |
| Who will use it | Supplier says pupil-facing: not stated (designed for parents and educators making books for children; terms say it is used by parents, teachers and children; no school or pupil accounts; first book can be made without signing up, accounts via Google Sign-In) [School to complete: number and roles of users] |
| Personal data involved | [School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible] |
2. How the supplier handles data
| Processor or controller | not stated (privacy policy written as the service deciding how data is used; no school processor terms) |
|---|---|
| Where data is stored | not stated (says 'secure cloud storage' without naming provider or region; prompts and any uploaded photo go to ByteDance Seedream 4.0 via AtlasCloud, Black Forest Labs FLUX.1, Agnes Image/Agnes 2.0 Flash and OpenAI GPT via OpenRouter, regions not stated; no transfer safeguards stated); Google Analytics |
| Trains AI on inputs | depends on plan - Doodara says it does not train its own models, but its privacy policy says free-tier AI providers (free plan and free tools) may retain submitted content, including uploaded photos, and use it to improve their models; it suggests a paid plan if you want photos processed only by its primary provider |
| How long inputs are kept | books, characters and generated images kept in your account until you delete them; account, books and image files erased within 30 days of an emailed deletion request; payment and tax records kept by the payment provider; free-tier AI providers may retain submitted content (period not stated) |
| Data processing agreement | Not stated by the supplier. [School to complete: DPA reference or date signed] Signs individual DPAs: Not stated by the supplier. [School to complete: ask the supplier] |
| Supplier DPO / UK representative | not stated (single contact hello@doodara.com; no DPO or UK representative named; policy lists UK/EU GDPR rights) |
| Minimum age | not stated (for parents and educators; does not knowingly collect personal information from under-13s without parental consent) |
| Other safety notes | the headline feature turns a photo of a child into the star of the book, and on the free plan prompts and photos go to providers that may keep them and use them to improve their models, so do not upload pupil photos or use pupil names; no named company behind the site; storage location not stated; public gallery option lets anyone, including search engines, read a book, so keep school books private; free books are personal use only, with commercial rights on paid plans in USD (Pro $9.99/month, Premium $24.99/month, or $3.99 per book unlock) |
| Lawful basis | [School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data] |
3. Risks and how we will reduce them
AI Prefect rating: staff Amber, pupils Amber.
| Risk | Suggested measure | Likelihood / severity | Residual risk |
|---|---|---|---|
| Unclear whether inputs are used for AI training | Ask the supplier in writing; check plan settings. | [School to complete: low / medium / high] | [School to complete: accepted?] |
| Data may be stored outside the UK/EU (Not stated) | Confirm the transfer safeguards (UK IDTA, standard contractual clauses or adequacy). | [School to complete: low / medium / high] | [School to complete: accepted?] |
| No data processing agreement published | Request a DPA before use, or limit use to non-personal data. | [School to complete: low / medium / high] | [School to complete: accepted?] |
| Minimum age: not stated (for parents and educators; does not knowingly collect personal information from under-13s without parental consent) | Check this against the age of any pupils who will use it. | [School to complete: low / medium / high] | [School to complete: accepted?] |
| AI output may be inaccurate or biased | Staff review all output before it is used; do not rely on it for decisions about individuals. | [School to complete: low / medium / high] | [School to complete: accepted?] |
| [School to complete: any other risks] | [School to complete: measure] |
4. Sign-off
| DPO advice | [School to complete: DPO comments and date] |
|---|---|
| Decision | [School to complete: approved / approved with conditions / not approved] |
| Approved by | [School to complete: name, role, date] |
| Review date | [School to complete: usually within 12 months, or when the supplier changes its terms] |
Sources
- https://www.doodara.com/
- https://www.doodara.com/privacy
- https://www.doodara.com/terms
- https://www.doodara.com/about
- https://www.doodara.com/pricing