Data protection impact assessment (DPIA): draft

Tool: English Shadowing App Supplier: not stated (no company name published; site signs itself Shadowing English, contact hi@shadowingenglish.app)
School: [School to complete: school name] Prepared by: [School to complete: name and role] Date: [School to complete: date]

Draft generated by AI Prefect from the supplier’s published documents (checked 2026-11-09). A starting point only; not legal advice. Verify every fact before relying on it.

1. What the tool will be used for

Type of tool	English speaking and pronunciation practice by shadowing (turns a YouTube link, audio/video file or text into sentence-by-sentence shadowing lessons with AI pronunciation scoring, AI speaking partner, text-to-speech and spaced-repetition review)
Purpose in our school	[School to complete: what you will use it for, which year groups or staff, and why]
Who will use it	Supplier says pupil-facing: yes - learner accounts (home page offers paths for child, teen and high school learners), but terms require the legal age to enter a binding contract [School to complete: number and roles of users]
Personal data involved	[School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible]

2. How the supplier handles data

Processor or controller	not stated (privacy policy written as the service deciding how data is used; no school processor terms)
Where data is stored	not stated (hosting, storage and AI, speech and media-processing providers not named; no transfer safeguards stated); Google Analytics and Microsoft Clarity, which may be linked to your account after sign-in
Trains AI on inputs	unclear - privacy policy and terms do not say whether your recordings, text or uploads train AI models; terms grant it and its providers a licence to process your content to 'provide, secure, maintain, and improve the Service'
How long inputs are kept	learning content, voice recordings and progress kept while needed or until you remove them where deletion controls exist; personal data deleted or anonymised within 30 days of account deletion; billing, support, security and analytics records kept for legal or operational needs (periods not stated)
Data processing agreement	Not stated by the supplier. [School to complete: DPA reference or date signed] Signs individual DPAs: Not stated by the supplier. [School to complete: ask the supplier]
Supplier DPO / UK representative	not stated (single contact hi@shadowingenglish.app; no DPO or UK representative named)
Minimum age	18+ in the UK (legal age to enter a binding agreement; not intended for users without that capacity)
Other safety notes	records your voice for pronunciation scoring and sends recordings, text and uploads to unnamed AI, speech and media-processing providers; no named company behind the site; storage location not stated; not intended for under-18s even though the home page offers child, teen and high school practice paths; Google Analytics and Microsoft Clarity session recording on the site; credit-based paid plans in USD (Standard $8.99, Pro $17.99, Advanced $44.99 a month); submitted to AI Prefect from the same email address as English Dictation, whose policies are worded the same way
Lawful basis	[School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data]

3. Risks and how we will reduce them

AI Prefect rating: staff Amber, pupils Red.

Risk	Suggested measure	Likelihood / severity	Residual risk
Unclear whether inputs are used for AI training	Ask the supplier in writing; check plan settings.	[School to complete: low / medium / high]	[School to complete: accepted?]
Data may be stored outside the UK/EU (Not stated)	Confirm the transfer safeguards (UK IDTA, standard contractual clauses or adequacy).	[School to complete: low / medium / high]	[School to complete: accepted?]
No data processing agreement published	Request a DPA before use, or limit use to non-personal data.	[School to complete: low / medium / high]	[School to complete: accepted?]
Minimum age: 18+ in the UK (legal age to enter a binding agreement; not intended for users without that capacity)	Check this against the age of any pupils who will use it.	[School to complete: low / medium / high]	[School to complete: accepted?]
AI output may be inaccurate or biased	Staff review all output before it is used; do not rely on it for decisions about individuals.	[School to complete: low / medium / high]	[School to complete: accepted?]
[School to complete: any other risks]	[School to complete: measure]

4. Sign-off

DPO advice	[School to complete: DPO comments and date]
Decision	[School to complete: approved / approved with conditions / not approved]
Approved by	[School to complete: name, role, date]
Review date	[School to complete: usually within 12 months, or when the supplier changes its terms]

Sources

https://shadowingenglish.app/
https://shadowingenglish.app/privacy-policy
https://shadowingenglish.app/terms-of-service
https://shadowingenglish.app/pricing