Before a child pilot, iSteip will complete a DPIA, processor contracts, transfer assessment, retention approval and external legal review.
Who is responsible
iSteip is the controller for direct accounts, product security, support and direct subscriptions. For some school programmes, the school is controller and iSteip acts as its processor. Contact eolas@isteip.com to identify the arrangement that applies to you.
What we collect
We collect only what is needed to provide the feature you use.
- Adult account identity, contact details and sign-in records
- Optional phone number and social media profiles, only if you add them
- Learner display name, age band, language and linked guardian or school
- Course enrolment, practice activity, assignments and teacher feedback
- Private practice media only when a user chooses to submit it
- Consent, permission, safety and audit records
- Device, security and diagnostic data needed to protect the service
Why we use it
We use data to provide the service and fulfil our agreements, keep accounts and children safe, meet legal duties, respond to requests and improve reliability. Optional features such as marketing, nonessential analytics or AI motion feedback require their own clearly stated basis and control. We do not use child data for advertising, behavioural profiling or model training. If you add a phone number or social profiles, we use them only to contact you about your account and iSteip activities. We never post on your behalf.
Children and managed learners
Child learner profiles are guardian-managed by default and do not need independent credentials. Teachers receive only class-scoped access. Consent is recorded by purpose, can be withdrawn, and does not replace another lawful basis where consent is not appropriate. Read the child-friendly notice with the learner.
Sharing and international transfers
Your account and learning records are stored with Wix.com, which hosts iSteip's member accounts, course content and forms as our processor; the website is delivered through Vercel. We do not sell data or share it with advertisers. When class tools launch, data will be shared only with the school and educators you are connected to. Our full subprocessor list and international transfer safeguards will be published before any school or child pilot.
Teaching on iSteip
If you set up a studio, your instructor profile (name, headline, about, styles, location and any links you add) can be seen by anyone using iSteip. The videos, audio and photos you record or upload for a class are stored with Vercel (Blob storage, Dublin region) as our processor. Learners see a class once you publish it and staff have approved you. Takes you replace are removed when you publish, and deleting your account removes your classes, drafts and media. Anyone can report a class or teacher from its page.
Retention and deletion
We keep data only for a documented period. Provisional defaults include 14 days for unanswered guardian invitations, 30 days for raw AI-practice video unless saved, 12 months for pseudonymised security logs, and deletion from active systems within 30 days of an approved request. Encrypted backups expire on their normal cycle, targeted within 90 days. Legal or safeguarding holds are isolated and documented.
Your choices and rights
Depending on where you live, you may ask for access, correction, export, restriction, objection or deletion. You can change language, notification and consent choices inside your account. Requests ordinarily receive a response within one month under EU and UK law.
- Email: eolas@isteip.com
- In the app: Account → Your data
- For child requests, we consider the child's best interests, capacity and wishes—not only the requester's relationship