AI tool summary for DPOs and governors
Grok Bot
Anysphere (Cursor) with xAI · Facts last checked 2026-10-22 · Printed 23 October 2026
AI Prefect
Staff: Amber · Use with caution
- Training depends on plan or settings
- Doesn’t say if it is a processor or controller
- Doesn’t say where data is stored
Pupils: Amber · Use with caution
- Training depends on plan or settings
- Doesn’t say if it is a processor or controller
- Doesn’t say where data is stored
| Supplier | Anysphere (Cursor) with xAI |
|---|---|
| Category | AI agent / assistant |
| Pupil-facing | not stated |
| Processor or controller | not stated |
| Where data is stored | not stated |
| Trains AI models on inputs | depends - follows Cursor account privacy settings |
| How long inputs are kept | persistent cloud environment; files, sessions, credentials may be retained until you delete them |
| Data processing agreement (DPA) | not stated |
| Signs individual DPAs with schools | not stated |
| UK GDPR representative / DPO | not stated |
| Minimum age | not stated |
| Key safety note | acts in your apps and websites on your behalf; bots share one environment and are not separate security boundaries |
| Main use | General AI assistant / chatbot |
Better-rated alternatives for the same use: ChatGPT Edu (Green), Gemini app (Workspace for Education) (Green), Microsoft 365 Copilot (Green)
Before using it: check the minimum age fits your pupils, confirm a data processing agreement is in place, switch off AI training where possible, and record the decision in your DPIA.
Sources: https://docs.x.ai/grok-bot/faq · https://cursor.com/terms/grok-bot
Full entry: aiprefect.co.uk/tools/grok-bot. Rating is a rules-based summary of the supplier’s published terms. “Not stated” means we could not find it in their documents. This is not legal advice and does not replace your DPIA.