Effective date: [PLACEHOLDER]
1. Who we are
[PLACEHOLDER: legal entity name] ("Trellis"), company number [PLACEHOLDER: Registrar-General / ORC number], [PLACEHOLDER: registered address], is the data controller. Trellis is an independent company. We process personal data in line with Ghana's Data Protection Act, 2012 (Act 843). Data protection contact / DPO: [PLACEHOLDER: name and email]. Privacy contact: [PLACEHOLDER: DPO / privacy email]. Safeguarding contact: [PLACEHOLDER: name] at [PLACEHOLDER: safeguarding email/phone]. UK representative (UK GDPR Art. 27): [PLACEHOLDER: representative name and address] [RECOMMENDED - confirm]. EU representative: not applicable, as we don't target EU families. We register with the data protection regulators of the countries we serve where their law requires it [RECOMMENDED - confirm].
2. Who holds an account
- Parents/guardians (18+) hold the account and make all decisions about their children's data.
- Children under 13 never have their own login. Their information sits in the parent's record and they learn only in a session a parent opens.
- Students aged 13–17 may be given their own sign-in by their parent. The parent still owns the account and can see and remove that access.
- Tutors hold their own accounts.
3. How we check that you are the parent
Before any child's data is collected, the account holder confirms they are 18+ and the child's parent or legal guardian, and passes an ID check run by our verification provider, [PLACEHOLDER: ID verification provider and its location]. You upload a government ID and take a selfie; the provider checks the ID is genuine, that you are an adult, and that the selfie matches it.
- What we keep: only the result (passed/failed), the date, the ID type and country, and your year of birth. We do not keep copies of your ID or selfie. The provider deletes the images within 30 days of the check [RECOMMENDED - confirm] under our contract.
- Basis: consent and legal obligation (verifying parental consent for a child). The selfie match is biometric processing done only with your explicit consent.
- Retention of the result: while your account is open, plus 2 years [RECOMMENDED - confirm], as proof of parental consent.
- This ID check is a method of verifiable parental consent recognised under the US Children's Online Privacy Protection Act (COPPA) rule (16 CFR 312.5(b)(2): checking a government-issued ID against a database, with the ID deleted promptly after verification), and meets the "reasonable efforts" standard in Ghana, the UK, Nigeria and Kenya. Recording and AI Teacher use each need a separate, specific parental consent, which we record with the date and the version of the text you agreed to.
4. What we collect, and why
| Who | Data | Why | Lawful basis (Ghana s.20 / UK GDPR Art.6, Art.9 where relevant) |
|---|---|---|---|
| Parent | Name, email, phone, optional WhatsApp opt-in | Account, bookings, messages | Contract |
| Child | First name, year group, subjects, schedule | Matching and teaching | Contract with parent; parental consent for the child |
| Child (13–17 sign-in only) | Date of birth | To confirm age for own sign-in | Legal obligation / legitimate interests |
| Child | Learning progress, mastery scores, lesson chat | Teaching and reports to parent | Contract |
| Child | AI Teacher messages, pictures, and voice audio (if used) | Running the AI session and safety checks | Parental consent |
| Child | Lesson video recordings | Safeguarding and quality | Parental consent |
| Tutor | Name, contacts, national ID, selfie and face-match result, qualifications, referees, bank details, and a police clearance certificate only where Trellis has chosen to require one for that tutor or region | Vetting, safeguarding, paying tutors | Legal obligation / legitimate interests (child safety); explicit consent for biometric face matching; any police clearance under legitimate interests / substantial public interest (safeguarding children), held as criminal-offence data with restricted access [RECOMMENDED - confirm] |
| Parent | ID check result, date, ID type/country, year of birth (images held only briefly by the provider) | Verifying you are the parent and an adult | Consent / legal obligation; explicit consent for selfie matching |
| Everyone | Device/time zone, sign-in and security logs, error reports | Security and running the site | Legitimate interests |
| Payer | Transaction reference, amount, status (no full card data) | Payments, refunds, accounting | Contract / legal obligation |
We collect the minimum needed for each purpose. We do not ask for a child's surname, school, address or photo. We do not use children's data for advertising, profiling for marketing, or selling, and we do not sell or "share" (for cross-context advertising) anyone's personal data.
5. The AI Teacher
A child uses the AI Teacher directly during a session the parent opens, in text or voice; all reports and alerts go to the parent only. We send the AI provider only first name, year group, subject and the session content. Requests are routed through Vercel AI Gateway, which passes them to the underlying model provider (Anthropic, and others where we switch models). No-training settings are on for every provider, and zero-data-retention is used wherever the provider offers it. Every message is safety-filtered; signs of risk to a child alert the parent and our safeguarding lead. Typed transcripts are kept for 12 months [RECOMMENDED - confirm] and included in your data download. No decision with legal or similarly significant effect is made solely by the AI. Full details: AI Teacher Terms /ai-terms.
Spoken AI Teacher (voice pilot) — [DRAFT — pending Allen and Themis approval]. The spoken mode is off by default. A parent must opt in in Settings; the box is unticked until they do. Trellis does not store voice audio. Our providers process it live and keep it only as set out in their terms. Voice conversations are not kept as full transcripts — Trellis keeps a short session summary for 12 months and any safeguarding excerpt (max 500 characters) for the safeguarding retention period {{SAFEGUARDING_RETENTION}}. There are seven processors, all in the United States: Deepgram (speech-to-text), Anthropic (the tutor), Cartesia (text-to-speech), Daily (the live audio room), Pipecat Cloud (Daily, Inc.) (runs the voice bot), Vercel AI Gateway with its safety model openai/gpt-oss-safeguard-20b (live moderation of the child's turn and of the tutor's reply before it is spoken), and OpenAI (Whisper, speech-to-text for the typed session's push-to-talk, only after the same parent voice opt-in). Data is processed in the United States. Transfers use the safeguards in section 8. This paragraph is a draft and does not switch the pilot on.
6. Lesson recordings and chat
Online lessons with a child are recorded only with a parent's consent, are private to the parent and Trellis staff who need them, access is logged, and recordings are deleted after 180 days (or sooner at the parent's request). Lesson-room chat is saved with the lesson, readable by the tutor, student, parent and staff who need it, and deleted 90 days after it was written.
7. Who we share data with
Processors (each under a written data-processing agreement [PLACEHOLDER: confirm each DPA is signed]):
- Supabase — database, sign-in, file storage (EU)
- Vercel — hosting (USA)
- Vercel AI Gateway (Vercel Inc., USA) — routes typed AI Teacher requests to the underlying model providers
- Anthropic (USA), and other model providers such as OpenAI where used — AI inference, with no-training and, where offered, zero-retention settings
- Spoken AI Teacher processors (USA) — [DRAFT — pending Allen and Themis approval]: seven processors, all in the United States — Deepgram (speech-to-text); Cartesia (text-to-speech); Anthropic (the live tutor); Daily (the live audio room); Pipecat Cloud (Daily, Inc.) runs the voice bot; Vercel AI Gateway and its safety model openai/gpt-oss-safeguard-20b (safety checks on each voice turn, including the tutor's reply before text-to-speech); OpenAI (speech-to-text for the typed session's push-to-talk). Data is processed in the United States. Trellis does not store voice audio. Our providers process it live and keep it only as set out in their terms.
- [PLACEHOLDER: parent ID verification provider]
- Daily — live video lessons and recordings [RECOMMENDED - confirm]
- Resend — email
- Twilio — SMS and WhatsApp (Meta processes WhatsApp messages). If you turn WhatsApp off (or reply STOP), we keep your verified number so we don't message you again. For 90 days you can reply START to turn lesson updates back on; after that you'll need to confirm your number again in the app. We delete the number when you change it or delete your account.
- Sentry — error monitoring (USA)
- Face-match service for tutor identity checks [PLACEHOLDER: tutor face-match provider name and location]
- Paystack — payment processing. Paystack acts as an independent controller for the payment details you enter on its page and must keep transaction records under Bank of Ghana / CBN rules. Stripe and PayPal will be added later and this list updated before they go live.
We may also disclose data to police, social welfare or courts where the law requires or a child is at risk.
8. International transfers
Your data is stored outside Ghana (EU and USA). We rely on the European Commission's Standard Contractual Clauses with the UK Addendum (or the UK IDTA) in each provider's data-processing agreement, which we also use as the appropriate safeguards required for transfers under Ghana's Act 843, Nigeria's NDPA and Kenya's DPA [RECOMMENDED - confirm]. You can ask us for a copy of the safeguards. Spoken AI Teacher — [DRAFT — pending Allen and Themis approval]. Seven processors, all in the United States: Deepgram, Anthropic, Cartesia, Daily, Pipecat Cloud (Daily, Inc.), Vercel AI Gateway (safety model openai/gpt-oss-safeguard-20b) and OpenAI (push-to-talk speech-to-text). Data is processed in the United States. Those transfers use the same SCC + UK Addendum safeguards. The spoken feature stays off until Allen and Themis approve this wording.
9. How long we keep data
| Data | Kept for |
|---|---|
| Lesson recordings | 180 days |
| Lesson-room chat | 90 days |
| AI Teacher transcripts (typed) | 12 months [RECOMMENDED - confirm] |
| AI Teacher voice audio | Trellis does not store voice audio. Our providers process it live and keep it only as set out in their terms. [DRAFT — pending Allen and Themis approval] |
| Voice session summaries | 12 months [DRAFT — pending Allen and Themis approval] |
| Voice safeguarding excerpts (max 500 characters) | Safeguarding retention period {{SAFEGUARDING_RETENTION}} [DRAFT — pending Allen and Themis approval] |
| Parent ID check result | While the account is open + 2 years [RECOMMENDED - confirm] (images deleted by the provider within 30 days) |
| Child learning progress | While the account is open |
| Tutor ID images and selfie | Deleted 30 days after the vetting decision [RECOMMENDED - confirm] |
| Tutor police clearance certificate (where required) | While the tutor is active, then deleted; only the fact it was checked is kept [RECOMMENDED - confirm] |
| Tutor face-match and vetting result | While the tutor is active + 6 years [RECOMMENDED - confirm] |
| Unsuccessful tutor applications | 6 months after the decision [RECOMMENDED - confirm] |
| Payment and lesson records, safeguarding reports | Payment records 7 years; safeguarding reports 10 years, with names and contact details removed after account deletion where the purpose allows [RECOMMENDED - confirm] |
| Security and access logs | 12 months [RECOMMENDED - confirm] |
Account deletion: erased after a 30-day cooling-off period, except the records above.
10. Your rights
You (and you on your child's behalf) can: access your data and get a copy; correct it; delete it; object to or restrict processing; withdraw consent at any time; and port it. A 13–17 student may make requests about their own data. Contact [PLACEHOLDER: privacy email]. We reply within 1 month [RECOMMENDED - confirm]. We do not discriminate against anyone for using their rights. Complaints: Ghana Data Protection Commission; UK: ICO (ico.org.uk); Nigeria: NDPC; Kenya: ODPC; USA: FTC or your state Attorney General. Please contact us first so we can help. US residents: we do not sell or share personal information; we do not knowingly collect data from children under 13 without verifiable parental consent; a parent can review, delete and stop further collection of their child's data at any time.
11. Children's privacy by design
High-privacy settings by default; no geolocation; no nudges to share more; no advertising; child mode locks payments and settings; parents see what their child sees. We have carried out a Data Protection Impact Assessment covering children's data, the AI Teacher and identity checks, and review it every year [RECOMMENDED - confirm] (must be completed before launch).
12. Security and breaches
We use encryption in transit, access controls and logging. If a breach is likely to put you or your child at risk, we will tell you and the relevant regulator(s) without undue delay (UK: within 72 hours; Nigeria: 72 hours; Kenya: 72 hours; Ghana: as soon as reasonably practicable).
13. Cookies
See the Cookie Statement /cookies.
14. Changes
We will email you before material changes take effect.