Nurture

Privacy Policy

This Privacy Policy explains how Nurture Technology Ltd (“Nurture”, “we”, “us”) handles personal data when you visit our website, contact us, or use the Nurture Services. It is written to meet the EU General Data Protection Regulation (GDPR) and the UK GDPR, and it applies wherever a regional version does not. If you are an Australian school or user, our Privacy Policy (Australia) applies to you.

1) Who we are and what this policy covers

Nurture Technology Ltd is a company registered in Ireland, with its office at Nexus Innovation Centre, Tierney Building, University of Limerick, Limerick, V94 NYD3.

This policy covers:

  • Our website, gonurture.com and its subdomains, including the forms you use to book a demo, download a guide or eBook, register for a webinar, subscribe to updates or apply for a job.
  • The Services: the Nurture web application, the Nurture Microsoft Teams application and the Nurture Canvas integration.

Nurture Signal, our platform for live class sessions, has its own privacy policy. Where a school uses Signal, our Data Processing Agreement (section 3) also covers it.

2) Our commitments

  • We never sell personal data.
  • We never show advertising in the Services.
  • We do not use school or student data to train or improve general-purpose AI models.
  • We are transparent about our practices, and we publish our security policies and suppliers.

3) Our role: controller or processor

For the Services, the school or education authority that sets up a workspace decides what personal data is used and why. It is the controller, and Nurture processes personal data on its behalf as a processor under our Data Processing Agreement (the “DPA”). If you are a teacher or student using Nurture through your school, your school’s own privacy notice tells you how it uses your information, and requests about your data may need to go through your school.

For our website and our own business, such as sales enquiries, demo bookings, webinars, newsletters, recruitment and billing, Nurture is the controller.

4) The personal data we collect

Through the Services, as configured by the school:

  • Account information: names, school email addresses, role and permissions, school or organisation details, account identifiers and, where the sign-in provider supplies one, a profile picture.
  • Student information: student name or identifier, class or course context, and the education content submitted through the Services.
  • Content users provide: student work, teacher instructions, curriculum documents, feedback, rubrics and marking criteria, attachments, and anything else a user enters, uploads or pastes.
  • Information from your learning platform: where the school connects Microsoft Teams or Canvas, the class list, course role or scores those platforms exchange with Nurture.
  • Support communications: what you send us when you contact support, including attachments.
  • Technical and usage data: security and operational logs, device and browser details, IP address, timestamps and the usage metrics needed to operate and secure the Services.

Through our website:

  • Details you give us in a form: typically your name, work email, school or organisation, role, country and message, and a CV if you apply for a job.
  • Cookies and analytics: described in our Cookie Policy, where you can also change your preferences.

For the Services, we use personal data to:

  • provide, operate, maintain and secure the Services;
  • create and manage workspaces, accounts, permissions and integrations;
  • process and display content within the workspace, including AI-assisted outputs a teacher requests;
  • provide support and respond to requests;
  • monitor reliability, prevent misuse and maintain performance; and
  • comply with legal obligations and manage disputes.

Our legal basis is the school’s documented instructions under the DPA, which rest on the contract between the school and Nurture.

For our website and our own business, we use personal data to respond to enquiries, give you the resource you asked for and share related materials, run webinars, send updates you have subscribed to, consider job applications, and understand how the website is used. Our legal bases are the steps needed to respond to your request, our legitimate interest in running and promoting Nurture to schools, your consent where we ask for it (for example, newsletter sign-up and non-essential cookies), and our legal obligations. You can withdraw consent or unsubscribe at any time.

6) AI features

Nurture includes AI-assisted features that help teachers draft questions, learning outcomes, rubrics, feedback, summaries and marking guidance.

  • What the AI processes: the content a user provides for the task (for example student work, teacher instructions, curriculum documents and marking criteria) and a first name, for personalisation. We do not intentionally send other account fields, such as surnames or email addresses, to AI prompts. If other personal data appears, it is because it was included in user-provided content.
  • Human review: teachers can review, edit and override AI outputs before they are shared or saved.
  • No training: we do not use customer data submitted through the Services to train or improve general-purpose AI models, and we configure our AI providers so that they do not either.

7) Where data is stored

The Services are hosted in the region of the school’s deployment: in the European Union for schools in Europe and the United Kingdom, and in Australia for Australian schools. Where a school chooses a customer-tenant deployment, student submissions and teacher content are stored in the school’s own Microsoft or Canvas environment.

Depending on the deployment and the suppliers involved in a given request (including AI providers), some personal data may be processed outside your region. Where the law requires safeguards for such transfers, we use appropriate transfer mechanisms, such as the EU Standard Contractual Clauses and the UK Addendum, with supplementary measures where appropriate. Our subprocessor list shows where each supplier processes data.

8) Who we share personal data with

We do not sell or rent personal data. We share it only with:

  • your school and the users it authorises within its workspace;
  • our subprocessors, the suppliers that help us deliver the Services (hosting, email delivery, support tooling, monitoring and AI providers), limited to what their role requires and bound by written terms. The list is published on our Security Centre;
  • platforms your school connects, such as Microsoft Teams or Canvas, which process the sign-in and the data they exchange with Nurture under their own terms; and
  • regulators, courts or law enforcement, where the law requires it.

9) How long we keep personal data

  • Active accounts and workspaces: for as long as the school’s workspace or your account remains active.
  • Inactive accounts: may be deleted or de-identified after a period of inactivity, unless we must keep them for legal, security or dispute-resolution reasons.
  • Deletion requests: a school (or its authorised administrator) can ask us to delete personal data by emailing support@gonurture.com. We delete or de-identify it from our active systems within 30 days of a verified request, except where retention is required or permitted for legal, security, audit or backup purposes. When a school’s agreement ends, we delete or return its data within 30 days, subject to the same limits.
  • Website enquiries and marketing: for as long as we are in contact with you or you remain subscribed, and for a reasonable period afterwards to keep a record of the relationship.

10) How we protect personal data

We encrypt data in transit and at rest, limit access on a least-privilege basis, separate customer environments, monitor our systems, and maintain incident response, patch management and disaster recovery plans. Our security policies are published in full on our Security Centre.

11) Data breaches

We maintain an incident response process for suspected or confirmed data breaches. If a personal data breach affects a school’s data, we notify the school without undue delay under the DPA, and we notify the supervisory authority and affected individuals where the law requires it.

12) Your rights

Under the GDPR and UK GDPR you can ask to access, correct, delete or restrict the use of your personal data, object to processing based on our legitimate interests, receive a copy in a portable format, and withdraw consent at any time. Email support@gonurture.com (Attn: Privacy). We may need to verify your identity, and where your school controls the workspace, we may direct your request through your school.

If you are unhappy with how we handle your personal data, you can complain to the Data Protection Commission in Ireland, our lead supervisory authority, or to the authority in the country where you live or work, such as the Information Commissioner’s Office in the United Kingdom.

If you are outside the EU and the UK, you have the rights your local law gives you. Contact us in the same way and we will respond under that law.

13) Children and students

Students use Nurture through their school, which decides what student information is used and how. We do not direct our website or marketing at children.

14) Cookies

Our website uses cookies and similar technologies. Our Cookie Policy explains which ones, why, and how to change your preferences.

Our website and the Services may link to third-party websites or services. We are not responsible for their privacy practices, and we encourage you to read their privacy policies before providing personal data.

16) Changes to this policy

We may update this policy to reflect changes in the law, our Services or our practices. The current version and its date are shown at the top of this page, and superseded versions stay available from all legal documents.

17) Contact us

  • Email: support@gonurture.com (Attn: Privacy)
  • Privacy contact: daniel@gonurture.com
  • Information Security Manager: Daniel Paul
  • Post: Nurture Technology Ltd, Nexus Innovation Centre, Tierney Building, University of Limerick, Limerick, V94 NYD3, Ireland