Data protection impact assessment (DPIA): draft

Tool: StudySim Supplier: XYZ AI LLC (Delaware, USA; the home page names XYZAI, Inc.)
School: [School to complete: school name] Prepared by: [School to complete: name and role] Date: [School to complete: date]

Draft generated by AI Prefect from the supplier’s published documents (checked 2026-11-04). A starting point only; not legal advice. Verify every fact before relying on it.

1. What the tool will be used for

Type of tool	study tools / AI flashcards, quizzes, study guides and writing tools
Purpose in our school	[School to complete: what you will use it for, which year groups or staff, and why]
Who will use it	Supplier says pupil-facing: no - terms say people under 18 may not use or register; aimed at individual students, with no school or classroom accounts mentioned [School to complete: number and roles of users]
Personal data involved	[School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible]

2. How the supplier handles data

Processor or controller	not stated - consumer terms only; no school or organisation data-processing terms
Where data is stored	US - terms say the site is hosted in the United States and using it means agreeing to transfer data there; PostHog analytics hosted in the US; the AI providers that receive submitted text are not named; no protections for transfers from Britain stated
Trains AI on inputs	not stated - submitted text goes to unnamed generation, writing, detection and web-similarity providers; privacy policy says personal information may be used for internal research and technological development
How long inputs are kept	signed-out tool inputs and results removed after 24 hours; saved work kept with the study space until it is deleted; personal information kept no longer than 3 months after the account ends (backups isolated until deletion)
Data processing agreement	Not stated by the supplier. [School to complete: DPA reference or date signed] Signs individual DPAs: Not stated by the supplier. [School to complete: ask the supplier]
Supplier DPO / UK representative	not stated (DPO contact by post only: XYZ AI LLC, 251 Little Falls Drive, Wilmington, Delaware, USA)
Minimum age	18+ - terms say under-18s may not use or register (the privacy policy separately allows a parent or guardian to consent for a minor)
Other safety notes	consumer study app for individual students, not built for schools; turns uploaded notes, PDFs, slides, recordings and YouTube links into flashcards, quizzes, study guides, podcasts and visual lessons; also offers a 'natural writing editor' that rewrites drafts to sound natural (no detector score guaranteed), a paraphraser, an AI writing detector and a plagiarism checker - the supplier says detector scores are signals, not proof; session replay (PostHog) after sign-in with typed values masked; Wyoming law and binding US arbitration; Pro is $1 for 3 days then $20 a month or $120 a year, all purchases non-refundable; output must be reviewed
Lawful basis	[School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data]

3. Risks and how we will reduce them

AI Prefect rating: staff Amber, pupils Red.

Risk	Suggested measure	Likelihood / severity	Residual risk
Unclear whether inputs are used for AI training	Ask the supplier in writing; check plan settings.	[School to complete: low / medium / high]	[School to complete: accepted?]
Data may be stored outside the UK/EU (US)	Confirm the transfer safeguards (UK IDTA, standard contractual clauses or adequacy).	[School to complete: low / medium / high]	[School to complete: accepted?]
No data processing agreement published	Request a DPA before use, or limit use to non-personal data.	[School to complete: low / medium / high]	[School to complete: accepted?]
Minimum age: 18+ - terms say under-18s may not use or register (the privacy policy separately allows a parent or guardian to consent for a minor)	Check this against the age of any pupils who will use it.	[School to complete: low / medium / high]	[School to complete: accepted?]
Supplier not confirmed as a processor acting on school instructions	Clarify roles in the contract.	[School to complete: low / medium / high]	[School to complete: accepted?]
AI output may be inaccurate or biased	Staff review all output before it is used; do not rely on it for decisions about individuals.	[School to complete: low / medium / high]	[School to complete: accepted?]
[School to complete: any other risks]	[School to complete: measure]

4. Sign-off

DPO advice	[School to complete: DPO comments and date]
Decision	[School to complete: approved / approved with conditions / not approved]
Approved by	[School to complete: name, role, date]
Review date	[School to complete: usually within 12 months, or when the supplier changes its terms]

Sources

https://www.studysim.ai/privacy
https://www.studysim.ai/terms
https://www.studysim.ai/
https://www.studysim.ai/tools