Zimplex.AI privacy notice

Contact details

Zimplex.AI Ltd is the data controller for this website. We are registered in Scotland (company number SC819809), at 5 South Charlotte Street, Edinburgh, Scotland, EH2 4AN, and registered with the Information Commissioner's Office (ICO) as a data controller. You can contact us by email at info@zimplex.ai.

If you use the Guru app

This part applies to teachers with a Guru account at guru.zimplex.ai.

Your account

To give you an account we hold your name, email address, school, professional role and subject, and a record of when you accepted this notice. Our lawful basis is contract: we cannot provide the service without it. We keep it until you delete your account.

What you create in Guru

Your courses, calendars, teaching plans, notes, reflective journal entries and to-do items are yours. We store them so we can show them back to you. We do not sell them, and we do not use your journal or your to-do notes to improve our products — that exclusion is built into how the system works, not merely promised. Guru holds no pupil records and has no pupil-level features; please avoid typing pupil or colleague names into free-text boxes.

Your reflective journal

If you press “Review my notes”, Guru sends your journal notes to our AI provider to sort them into categories. We save only the category names and the dates of the notes in each one — not your words — and only you can see them. They are included when you download your data and deleted with your notes or your account. Your journal is never used to improve Guru or for research.

Your comments on a course

You can write comments on a learning outcome inside one of your courses — a note to yourself about how the teaching went. Only you can see them: Guru cannot yet share anything between teachers, and we will tell you before that changes. Please don't include pupils' names. They are never sent to our AI provider. Our lawful basis is contract, because they are part of planning your course. They are included when you download your data, and we keep them with your course until you delete them, the course, or your account — a comment is part of the plan it is written on, so it lasts as long as the plan does.

Asking Guru to do things

When you ask Guru to change a plan or answer a question, we record the request and what Guru did with it. We also record which parts of the app you use. We do this for one purpose — improving Guru: seeing where it misreads instructions and where people get stuck, so we can fix it.

These are two different records, and we keep them differently.

Which parts of the app you use is linked to your account — your account number, your name, your role and your school. That is deliberate: it is what lets us answer a question about your own account, and it is what lets us delete this when you delete your account.

What you ask Guru to do carries no account or school number — not yours, not your school's — so one of those records cannot be traced back to you. It does hold your own words, the ones you typed. So please do not type a pupil's or a colleague's name into Guru: there is no need to, Guru does not hold anything about them, and a name typed into a request is a name we would then be holding.

Our lawful basis is legitimate interests. It is on by default and can be switched off at any time in Settings, under “Help improve Guru” — that switch is how you exercise your right to object, and we have made it a single click. Turning it off costs you nothing: the app works exactly the same, and we stop both the recording and the usage analytics. We keep these records for 12 months.

To answer you, Guru sends your request, and the parts of your plans and the school statistics it needs, to our AI provider (see “Who handles your data for us”). The provider processes it only to produce Guru's answer, on our instructions, and does not use it to train its models.

Your history in Guru

Guru keeps a log of the changes made to each course, so you can undo them and see what changed and when. This is part of how the service works, so our lawful basis is contract. If “Keep a history” is on in Settings, Guru also keeps your own instructions and its replies so you can find them again in History; switching it off stops keeping them. We keep the course log, and your instructions and Guru's replies in History, while your account is active and for 2 years after it was last used, then delete them. Switching this off does not remove anything you have saved to your Journal yourself — a save is a deliberate act, and it stays until you delete it.

Things you save to your Journal

When you save a search result or a Guru answer to your Journal, we keep what you saved — the question, the answer as it was shown to you, where it came from, and the date you saved it — together with any note you add beside it. It is kept because you chose to keep it, and it stays until you delete it or your account is deleted. Saved figures are a snapshot of what was on screen that day; published figures can change afterwards, so a saved item is dated and is never updated behind you. Your Journal is private to you: it is not used to answer anyone else's searches, and Guru only reads it inside the Journal itself, when you ask it to.

Messages that trigger our security checks

If something you type to Guru matches one of our security checks, we keep a record of it — the check it matched, which part of the app you were in, and the date — so that we can look into possible misuse of the service. We keep this record for up to 90 days and then delete it, unless we are still looking into a specific case. It is seen only by Zimplex administrators. The message itself is part of that record whether or not you have “Keep a history” switched on, because we cannot look into misuse without seeing what was said. We do this on the basis of our legitimate interests in preventing misuse of the service.

Help with research

If “Help with research” is on, when you make a planning change Guru records the kind of change (for example, a pacing change) together with your school's type — such as its SIMD band, whether it is urban or rural, and its size — with your school's name and details removed. A type is always one that at least five schools in Scotland share. We do not record who you are, your school's name or code, or anything you typed. We use these records to understand how schools of a similar type plan, so Guru can offer general suggestions. We review everything by hand before it is used, and nothing is shown that points back to a school or a teacher. Our lawful basis is legitimate interests. Research use is opt-in: “Help with research” is off unless you turn it on. We ask once when you set your account up, it is never ticked for you, and you can turn it on or off at any time in Settings; leaving it off costs you nothing. Because these records do not identify you, we keep them.

Emails we send you

We send emails needed to run your account — verifying your address and telling you about access requests — through Resend, in the EU. Our lawful basis is contract.

If you subscribe to Pro

Payments are handled by Stripe. We do not see or store your card details. We hold a record of your subscription and its status so we know what your account is entitled to. Our lawful basis is contract, and we keep billing records for as long as UK tax and accounting law requires.

Where your data is held

Guru and its database run on Amazon Web Services in London, UK. Some services we use process data in the European Union: PostHog (usage analytics, if “Help improve Guru” is on) and Resend (account emails). Our AI provider is Amazon Bedrock in the UK/EU (AWS), which runs Anthropic's Claude models — no transfer outside the UK/EU.

Who handles your data for us

When you delete your account

Your plans, notes and assessments are deleted straight away and cannot be recovered. At the same time we ask our analytics provider (PostHog) and our email provider (Resend) to delete you: PostHog deletes your person record and its events, and Resend deletes you as a contact. Resend keeps a log of the emails we have already sent you — confirmation, password-reset and welcome messages — for 30 days, after which it is deleted too; there is no way to remove a single recipient from that log sooner. If you were paying for Pro, your customer record with our payment provider (Stripe) — including your card details and contact details — is deleted when the period you have paid for ends, and your invoices are kept for six years because tax law requires it. The records of what you asked Guru to do are the one thing that does not go with your account: they carry no account or school number, so there is nothing in them to find and delete. They are deleted by age, 12 months after they were made.

Your rights

You can download everything in your account, and delete your account permanently, from the Settings page at any time — you do not need to ask us. Your other rights, and how to complain, are set out below and apply equally to the app.

If you use this website

This part applies to zimplex.ai — our register-interest and contact forms. It does not apply to the Guru app, which is covered above.

What information we collect, use, and why

We collect or use the following information for service updates or marketing purposes:

• Names and contact details
• Records of consent, where appropriate
• School/organisation name and professional role

We collect or use the following information to comply with legal requirements:

• Name
• Contact information

We collect or use the following personal information for dealing with queries, complaints or claims:

• Names and contact details
• Correspondence

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.

Which lawful basis we rely on may affect your data protection rights, which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website:

• Your right of access — you have the right to ask us for copies of your personal information.
• Your right to rectification — you have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
• Your right to erasure — you have the right to ask us to delete your personal information.
• Your right to restriction of processing — you have the right to ask us to limit how we can use your personal information.
• Your right to object to processing — you have the right to object to the processing of your personal data.
• Your right to data portability — you have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
• Your right to withdraw consent — when we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the details at the top of this notice.

Our lawful bases for the collection and use of your data

Our lawful basis for collecting or using personal information for service updates or marketing purposes is consent — we have permission from you after we gave you all the relevant information. You have the right to withdraw your consent at any time.

Our lawful basis for collecting or using personal information to comply with legal requirements is a legal obligation — we have to collect or use your information so we can comply with the law.

Our lawful basis for collecting or using personal information for dealing with queries, complaints or claims is legitimate interests. We use the name, email address and message that a person voluntarily provides through our contact form so that we can respond to their query, complaint or request and give them the help or information they have asked for. This benefits the person, as it allows us to deal with their enquiry properly and promptly, and benefits us by helping us run and improve our service and maintain good relationships with people interested in our product. We only use this information to respond to and resolve the enquiry, and not for any unrelated purpose. Because the person has chosen to contact us and expects a reply, and because we limit our use to what is necessary to answer them, the impact on their privacy is minimal and does not override their interests, rights or freedoms.

Where we get personal information from

Directly from you.

How long we keep information

For more information on how long we store your personal information, or the criteria we use to determine this, please contact us using the details provided above.

Who we share information with

Data processors

Amazon Web Services (AWS) — cloud hosting and infrastructure provider (information technology sector), data hosted in the United Kingdom.

This data processor does the following activities for us: AWS hosts our website and stores the information submitted through our register-interest form in a secure cloud database on our behalf. The data is held in the United Kingdom. AWS only processes this information on our instructions and does not use it for its own purposes.

PostHog — privacy-friendly website analytics provider, processing in the European Union. PostHog measures aggregate site usage (such as pageviews) for us on a cookieless basis. It only processes this information on our instructions and does not use it for its own purposes.

Others we share personal information with

• Organisations we're legally obliged to share personal information with.

Cookies and analytics

This website does not use any cookies that require your consent. We use a privacy-friendly, cookieless analytics tool (PostHog, in the EU) to understand how many people visit the site and which pages they view, so we can improve it. It does not store cookies or other identifiers on your device, and we do not use it to build a profile of you or to track you across other websites. We do not use advertising cookies.

If this ever changes — for example, if we introduce analytics that rely on cookies — we will ask for your consent first and update this notice.

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us by email at info@zimplex.ai.

If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the ICO.

The ICO's address:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint