Data protection and IT

No pupil data

LessonLearnt is designed to work entirely without pupil data. We process only teachers’ data: name, email address, login, and the planning and teaching content the teacher writes.

• No pupil names, pupil lists, personal identity numbers or dates of birth are stored.
• No assessments or results of individual pupils are stored.
• Follow-up is done at class or group level – as counts, never per pupil.
• School leaders see a compiled picture by subject and year group – never by individual teacher.

How the masking works

Before any text is sent to the AI support, it passes an automatic text guard. Personal identity numbers, email addresses, diagnosis words and probable names are replaced by markers such as «NAMN». The AI support is instructed never to fill in, guess or recreate what was removed.

The teacher’s own planning content – unit titles, materials and the curriculum – is not masked, so that for example an author’s name in a literature unit still works.

In free-text fields such as notes and reflections, probable pupil names are replaced before the text is saved. Our logs record only the type and number of matches – never the text itself.

The masking is automatic and catches common patterns, but it cannot guarantee that every name is found. Teachers are therefore asked not to write pupil names, and images cannot be masked – they should not contain pupil information.

Sub-processors

LessonLearnt runs on Lovable Cloud (built on Supabase). The AI support uses Anthropic, and text recognition in images uses Google Cloud Vision. Some sub-processors may process data outside the EU/EEA – such transfers are then based on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. Where each processes data, and on what basis, is shown in the list of sub-processors.

We inform the school organiser at least 30 days before a sub-processor is added or replaced.

Data processing agreement

The school organiser is the data controller and LessonLearnt AB the data processor for teachers’ data. The data processing agreement and the terms of use are sent with the quote, and you can also use your own agreement. Request a quote.

How LessonLearnt AB itself processes personal data, for example for agreements, invoicing and support, is described in our privacy policy.

Login and access

• Teachers log in with the school’s Google or Microsoft account, or via an email link.
• What each user can see and do is controlled by their role, and access is checked on the server for every read and write.
• Each school only reaches its own data.

Questions

Email hej@lessonlearnt.se about agreements and data protection, or support@lessonlearnt.se about technical questions. We reply within two working days.