Privacy Policy

For learner records and school-directed educational content, the school, nursery or other setting using OASIS normally decides the purpose and lawful basis of processing. In European data-protection terms, that organisation is normally the controller and OASIS acts as its processor. Under India's Digital Personal Data Protection framework, the allocation of responsibility follows the parties' actual role and applicable law.

OASIS is responsible for data it uses for its own purposes, including account administration, service security, beta-access requests, service communications and legal compliance.

Questions may be sent to privacy@useoasis.app. Where a request concerns a learner record, we may refer it to the relevant school because the school controls that record.

• Account information:an educator's name, email address, authentication information, role and account status.
• School information: school or setting name, country, classes, staff access, invitations, academic years, terms and configured assessment frameworks.
• Learner information: learner identifiers, initials or names supplied by the school, class, birth information (presented as month and year in the app), support flags, observations, evidence, teacher judgements, baselines and next steps.
• Uploaded and generated content:framework documents, notes, reports and AI-supported analysis created at a user's request.
• Technical information: authentication session data, request logs, device/browser information, IP address, timestamps and security events needed to operate and protect the service.
• Communications: beta requests, support messages and invitation or service-delivery records.

OASIS is not designed to hold medical diagnoses, safeguarding case files, government identity numbers, financial information or other data that is not necessary for observation and assessment. Users should not enter such information into free-text observations.

• to create accounts, authenticate users and manage permissions;
• to provide journals, assessment views, planning prompts and reports;
• to analyse observations and surface evidence for teacher review;
• to invite colleagues and send essential service communications;
• to prevent misuse, investigate incidents and keep OASIS reliable;
• to answer support requests and improve service quality; and
• to meet legal obligations and establish or defend legal claims.

For European users, OASIS relies as appropriate on performance of a contract, legitimate interests in operating and securing the service, compliance with legal obligations, or consent where consent is required. The school is responsible for selecting and documenting the appropriate lawful basis for learner data, including any requirements arising from education law, employment law or public-task responsibilities.

For Indian users, personal data is processed for a lawful purpose on the basis selected by the responsible Data Fiduciary, including valid consent or another use permitted by applicable law. Required notices and rights must remain clear and accessible.

OASIS is provided to authorised adults working for schools and early-years settings. Children do not create OASIS accounts, accept these terms or interact with the service directly.

Each school must have authority to enter learner data, give families and staff any required notices, obtain verifiable parental or guardian consent where the law requires it, and honour applicable education-record rights. This is particularly important because India's framework treats a person under 18 as a child, while European rules give children specific protection.

OASIS applies data-minimising presentation: learner-facing screens use initials, birth information is presented as month and year, and known learner names are replaced with initials before supported observation analysis. Schools should still avoid unnecessary identifying detail in narrative text.

OASIS may send the minimum relevant observation text, learner initials, age context and framework material to an AI service to create a draft analysis. It does not send a learner's full birth date in the analysis request. OASIS configures supported requests not to create application response history and does not opt in to model training with school data. The AI provider may retain limited abuse-monitoring logs under its service terms unless a separately approved zero-retention arrangement applies.

AI output may be incomplete or wrong. It is a suggestion for a qualified educator to review, edit or reject—not a final assessment, diagnosis, safeguarding decision or solely automated decision with legal or similarly significant effects.

OASIS uses carefully selected providers to operate the service. Current provider categories include:

• Supabase for authentication and database services;
• Vercel for application hosting and delivery;
• OpenAI for requested AI-supported analysis; and
• Resend and connected email services for account, invitation and support communications.

These providers may process data only to deliver their contracted service to OASIS and under their applicable data-protection terms. OASIS may also disclose information when legally required, to protect users or the service, or as part of a genuine corporate transaction subject to appropriate confidentiality and notice.

OASIS does not sell learner or educator personal data.

OASIS and its providers may process information in countries other than the user's own. Where the GDPR applies to a transfer outside the EEA, OASIS uses an available lawful transfer mechanism, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with supplementary safeguards where required. Transfers from India are handled in accordance with any restrictions notified under applicable Indian law.

School content is kept while the school's account is active and for a limited period afterwards so that the service can be closed, exported or restored where appropriate. Account, invitation, security and support records are retained only for as long as needed for the purpose collected, contractual or legal requirements, dispute resolution and fraud prevention. Backups, where retained, follow the restoration and expiry schedules of the relevant service provider.

A school administrator may request deletion or export by contacting OASIS. OASIS may retain a narrowly limited record where law requires it or where needed to establish, exercise or defend legal claims.

OASIS uses measures appropriate to the nature of the information, including authenticated access, school/workspace separation, role-based permissions, encryption provided by its hosting and database services, data minimisation and restricted administrative access. No service can promise absolute security. Users must protect account credentials and promptly report suspected unauthorised access.

OASIS investigates personal-data incidents and will notify affected schools, authorities or individuals when and within the time required by applicable law.

OASIS currently uses only storage that is necessary to authenticate users, maintain secure sessions, remember essential service state and prevent abuse. OASIS does not currently use advertising cookies or cross-site behavioural tracking. If optional analytics or marketing technologies are introduced, this policy and any required consent controls will be updated before they are enabled.

Depending on location and context, an individual may have rights to access, correct, complete, erase, restrict or object to processing, receive a copy of data, withdraw consent, nominate another person, and obtain grievance redressal. Exercising a right does not affect processing already lawfully carried out. Some rights are subject to legal exceptions.

For learner data, contact the school first. For OASIS account or service data, email privacy@useoasis.app. OASIS may need to verify identity before fulfilling a request.

Individuals in the EEA may complain to the data-protection authority for their habitual residence, workplace or the alleged infringement. Individuals in India may use OASIS's grievance process and, where available under the phased law, the Data Protection Board of India process.

OASIS may update this policy when the product, providers or law changes. The current version and effective date will remain available here. Material changes will be communicated through the service or by email where required.