Data protection impact assessment (DPIA): draft

Tool: PureHumanize.ai Supplier: not stated (no company name published; site signs itself PureHumanize.ai, contact support@purehumanize.ai)
School: [School to complete: school name] Prepared by: [School to complete: name and role] Date: [School to complete: date]

Draft generated by AI Prefect from the supplier’s published documents (checked 2026-11-09). A starting point only; not legal advice. Verify every fact before relying on it.

1. What the tool will be used for

Type of tool	AI humanizer / rewriting (rewrites AI-generated text from ChatGPT, Claude, Gemini and others to read as human-written; General, Academic, Blog, Formal and other modes)
Purpose in our school	[School to complete: what you will use it for, which year groups or staff, and why]
Who will use it	Supplier says pupil-facing: not stated (individual accounts; FAQ says students may use it as an editing aid; no school or pupil accounts described) [School to complete: number and roles of users]
Personal data involved	[School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible]

2. How the supplier handles data

Processor or controller	not stated (privacy policy written as the service deciding how data is used; no school processor terms)
Where data is stored	not stated (data may be transferred outside your country; privacy policy says standard contractual clauses (SCCs) are applied for UK and EU users; storage location and AI providers not named); Firebase, Mixpanel and Google Analytics analytics
Trains AI on inputs	unclear - homepage and FAQ say drafts are 'not used to train public models', but the privacy policy lists improving AI performance as a purpose and does not say whether your text trains its own private rewriting models
How long inputs are kept	uploaded text deleted after processing unless you keep it in your account (history); backups and logs deleted within 90 days; account deletion on request
Data processing agreement	Not stated by the supplier. [School to complete: DPA reference or date signed] Signs individual DPAs: Not stated by the supplier. [School to complete: ask the supplier]
Supplier DPO / UK representative	not stated (privacy contact 'PureHumanize.ai – Privacy Office', support@purehumanize.ai; no DPO or UK representative named)
Minimum age	13+ (not intended for under-13s)
Other safety notes	built to make AI-written text pass as human: pricing says all plans include 'AI detection bypass technology' and claim to be undetectable by Turnitin, GPTZero, ZeroGPT and Originality.ai, and it offers an Academic mode and an 'AI Essay Humanizer', so pupil or student use for coursework is a real academic-integrity and malpractice risk (its own FAQ says not to use it to misrepresent authorship); no named company behind the site; storage location and AI providers not named; Firebase, Mixpanel and Google Analytics on the site; 250 words free, then paid plans in USD; same site template and policy family as Whisper AI Transcribe
Lawful basis	[School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data]

3. Risks and how we will reduce them

AI Prefect rating: staff Amber, pupils Amber.

Risk	Suggested measure	Likelihood / severity	Residual risk
Unclear whether inputs are used for AI training	Ask the supplier in writing; check plan settings.	[School to complete: low / medium / high]	[School to complete: accepted?]
Data may be stored outside the UK/EU (Not stated)	Confirm the transfer safeguards (UK IDTA, standard contractual clauses or adequacy).	[School to complete: low / medium / high]	[School to complete: accepted?]
No data processing agreement published	Request a DPA before use, or limit use to non-personal data.	[School to complete: low / medium / high]	[School to complete: accepted?]
Minimum age: 13+ (not intended for under-13s)	Check this against the age of any pupils who will use it.	[School to complete: low / medium / high]	[School to complete: accepted?]
AI output may be inaccurate or biased	Staff review all output before it is used; do not rely on it for decisions about individuals.	[School to complete: low / medium / high]	[School to complete: accepted?]
[School to complete: any other risks]	[School to complete: measure]

4. Sign-off

DPO advice	[School to complete: DPO comments and date]
Decision	[School to complete: approved / approved with conditions / not approved]
Approved by	[School to complete: name, role, date]
Review date	[School to complete: usually within 12 months, or when the supplier changes its terms]

Sources

https://purehumanize.ai/
https://purehumanize.ai/privacy
https://purehumanize.ai/terms
https://purehumanize.ai/pricing
https://purehumanize.ai/faq
https://purehumanize.ai/about-us