Is Humata safe for UK schools?

AI Prefect rates Humata Amber for staff use (Doesn’t say if it is a processor or controller; Doesn’t say where data is stored; No school DPA found; 4 of 6 key fields not stated) and Amber for pupil use (Doesn’t say if it is a processor or controller; Doesn’t say where data is stored; No school DPA found; 4 of 6 key fields not stated; Minimum age not stated). This is based on the supplier's published documents, last checked 2026-10-23. It is not legal advice; complete your own DPIA.

Does Humata train on our data?

According to the supplier's published documents: no - documents not used to train.

Where is Humata data stored?

Not stated in the supplier's published documents.

What age is Humata for?

Not stated. The supplier does not publish a minimum age we could find.

Is there a safer alternative to Humata?

Better-rated tools with the same main use and sector: NotebookLM (Workspace for Education) (green).

Humata

Humata AI · chat with documents · Last checked 2026-10-23

One-page summary (print or PDF)DPIA starter Compare with other tools Add to our tools list Get rating-change alerts

Rating: a rules-based summary of the supplier’s published terms. Not legal advice and not a substitute for a DPIA. How it’s worked out

Staff and pupils: AMBER Use with caution

Why amber:

Doesn’t say if it is a processor or controller
Doesn’t say where data is stored
No school DPA found
4 of 6 key fields not stated

How is this rated?

Key facts

Trains on what you type: No
Where data is stored: Not stated
Minimum age: Not stated
Use case: Chat with documents
Sector: Schools
Research status: Sourced

Safer alternatives

Same main use (Chat with documents) and sector, rated better for the same audience. Alternatives are suggested from our published ratings; check they meet your needs. How alternatives are chosen

For staff use

NotebookLM (Workspace for Education) · Green
Processor, no training on inputs, UK/EU storage or stated transfer safeguards, school DPA available

For pupil use

No better-rated alternative found yet: here’s what to look for.

It acts as a processor for your school (not a controller)
It doesn’t train its AI on what you type
Data stays in the UK/EU, or transfer safeguards (standard contractual clauses, the UK IDTA or adequacy) are stated
There is a data processing agreement (DPA) for schools
The minimum age fits your pupils, or pupils use it through a school account

We’ve logged this gap and will research tools for it in our weekly update.

New here? Each field has a short explanation underneath. Our getting started guide explains what to look for and what to do next.

About the tool

SupplierThe company that makes and runs the tool.: Humata AI
WebsiteWhere we found the main information about the tool.: https://www.humata.ai/
CategoryWhat sort of tool it is, for example a chatbot or a lesson-planning helper.: chat with documents
Pupil-facingWhether pupils use it directly, or only staff. Pupil use needs extra care.: yes - students and researchers

Your data

Processor or controllerA processor only uses data on your school’s instructions. A controller makes its own decisions about the data, which means your school has less say.: not stated
Where data is storedWhich country the data is stored in. UK or EU storage is usually simpler for schools.: not stated
Trains AI models on inputsWhether what you type (or upload) may be used to improve the supplier’s AI. “No” is what you want for anything about pupils or staff.: no - documents not used to train
How long inputs are keptHow long the supplier keeps what you type before deleting it.: model-side data not kept beyond 30 days; dashboard data until deleted

Agreements and contacts

Privacy noticeThe supplier’s privacy notice: their own explanation of what they do with personal data.: https://www.humata.ai/privacy-policy
Data processing agreement (DPA)The data processing agreement: the contract that sets out how the supplier must look after your school’s data.: not stated
Signs individual DPAs with schoolsWhether the supplier will sign a data agreement with your school specifically, rather than just standard online terms.: not stated
UK GDPR representative / DPOWhether the supplier names a data protection officer or UK representative you can contact about data questions.: not stated

Age and safety

Minimum ageThe youngest age the supplier allows to use the tool. Check this before any pupil uses it.: not stated
Key safety noteAnything else worth knowing, such as admin controls or content filtering.: not stated
Research statusHow complete our research on this tool is.: sourced

Sources

humata.aihttps://www.humata.ai/security
humata.aihttps://www.humata.ai/privacy-policy

Change history

No changes recorded since this entry was first published.

See all recent changes

Quick answers

Is Humata safe for UK schools?: AI Prefect rates Humata Amber for staff use (Doesn’t say if it is a processor or controller; Doesn’t say where data is stored; No school DPA found; 4 of 6 key fields not stated) and Amber for pupil use (Doesn’t say if it is a processor or controller; Doesn’t say where data is stored; No school DPA found; 4 of 6 key fields not stated; Minimum age not stated). This is based on the supplier's published documents, last checked 2026-10-23. It is not legal advice; complete your own DPIA.
Does Humata train on our data?: According to the supplier's published documents: no - documents not used to train.
Where is Humata data stored?: Not stated in the supplier's published documents.
What age is Humata for?: Not stated. The supplier does not publish a minimum age we could find.
Is there a safer alternative to Humata?: Better-rated tools with the same main use and sector: NotebookLM (Workspace for Education) (green).

Generated only from the facts above. “Not stated” means the supplier doesn’t publish it.

Tell me if this rating changes

Suppliers change their terms. Leave your email and we’ll let you know if the rating for Humata changes. Nothing else.

Spotted something out of date? Suppliers change their terms. Tell us and we will re-check it. This page is not legal advice; complete your own DPIA.