AI tool summary for DPOs and governors
Napkin
Second Layer, Inc. · Facts last checked 2026-10-22 · Printed 23 October 2026
AI Prefect
Staff: Amber · Use with caution
- Doesn’t say whether it trains on what you type
- Doesn’t say if it is a processor or controller
- Data may be stored outside the UK/EU; safeguards not stated
Pupils: Amber · Use with caution
- Doesn’t say whether it trains on what you type
- Doesn’t say if it is a processor or controller
- Data may be stored outside the UK/EU; safeguards not stated
| Supplier | Second Layer, Inc. |
|---|---|
| Category | visuals |
| Pupil-facing | not stated |
| Processor or controller | not stated |
| Where data is stored | Google Cloud; Gemini and other providers |
| Trains AI models on inputs | not stated |
| How long inputs are kept | as long as necessary; AI providers may retain (see subprocessor page) |
| Data processing agreement (DPA) | not stated |
| Signs individual DPAs with schools | not stated |
| UK GDPR representative / DPO | DPO: Erwan Martin |
| Minimum age | 13+ |
| Key safety note | not stated |
| Main use | Graphic design |
Better-rated alternatives for the same use: Canva (Education / Magic Studio) (Green), Adobe Express for Education (Amber)
Before using it: check the minimum age fits your pupils, confirm a data processing agreement is in place, switch off AI training where possible, and record the decision in your DPIA.
Sources: https://www.napkin.ai/privacy
Full entry: aiprefect.co.uk/tools/napkin. Rating is a rules-based summary of the supplier’s published terms. “Not stated” means we could not find it in their documents. This is not legal advice and does not replace your DPIA.