Last updated: 9 October 2026
This notice explains how student information is used when a school runs AB Tutor on its own infrastructure — an “on-premise” installation. If your school uses the AB Tutor cloud service instead, a separate notice applies; your school can tell you which one they run. It has two parts: a short version written for students, and a detailed version for parents, guardians and schools.
Hello! Your school uses a program called AB Tutor to help keep you safe and focused when you use school computers. Here’s what you should know, in plain words:
Where your information is kept. Everything AB Tutor records about your school computer stays at your school, on your school’s own computers. The company that makes AB Tutor does not get a copy and cannot look at it.
What AB Tutor can see. If your school turns these features on, your teachers may be able to see your screen, which websites and apps you use, and messages you send through AB Tutor. It can also spot certain words that might mean you’re upset or unsafe — if you type one of those words, a short note of what you typed is saved so a trusted adult at school can check you’re okay. It does not record everything you type.
Who can see it. Only the staff at your school that your school chooses. We (the company) don’t watch you, don’t have your information, and never use it for adverts.
The one thing we do get automatically. The program tells us how often each of its buttons and features gets used at your school — just numbers, like “this feature was used 40 times”. There is nothing about you in that.
How long your data is kept. This is decided by your school, because the information is on the school’s own computers.
It’s your data. If you have questions, or think something is wrong, talk to a teacher, your parents, or another adult you trust at school. They are the people who hold your information.
Your child’s school is the data controller and also holds all of the data. On an on-premise installation, AB Tutor is software the school runs on infrastructure it controls. In normal operation, AB Tutor Limited — the company — does not host the system, does not receive student data from it, and has no means of accessing it, so we are not the school’s processor in normal operation, as that term is defined under UK data protection law.
There are two exceptions. If a school’s staff disclose material to us in connection with a support request, it may contain a student’s personal data (we ask that it is not sent), and we would be a processor in that situation — see “What AB Tutor Limited receives” below. Feature-usage telemetry is a further example of information we receive; because it does not identify any individual student, we are not a processor in respect of it either.
Where a school chooses to have another company host or remotely manage its installation, that company handles the data on the school’s behalf under the school’s own arrangements. Your school can tell you whether that applies.
This means that for practically every question a parent might have — what has been recorded, who has seen it, how long it is kept, please delete it — the school is the only party who can answer, and the only party who holds anything. Please contact the school.
Only the features the school enables collect anything. Depending on the school’s configuration this can include:
All of this is stored on the school’s own infrastructure and nowhere else. It is not uploaded to AB Tutor, to any cloud service, or to any third party.
The on-premise product does not connect to Google Workspace or Microsoft Entra ID. Class lists and logins are managed locally by the school, so no information about your child is exchanged with Google, Microsoft or anyone else.
We receive one type of information from use of the on-premise product, and it is not about your child: the software reports counts of which product features are being used, labelled with the school’s licence so we know which installation the counts came from. No names, no accounts, no devices, no content — nothing that identifies any person. We use it only to see which features schools actually use. We do not sell it, share it, or use it to build any individual profile. We refer to this as feature-usage telemetry. Schools can ask us to switch it off entirely.
Our helpdesk, business email and licence systems exist for correspondence with school staff. Your child’s information is not sent to the helpdesk in the ordinary course of using the on-premise product. The only exception is if school staff send us something in connection with a support request, or show us something when we are providing remote support, in order to get help. We ask them not to include student details, but if they do, we act as the school’s processor for that material only: it is used solely to resolve that request, is restricted to the staff working on it, and is deleted once the request is closed — or, in the case of a remote session, is not accessible or visible to us once the session has finished.
The school decides, and the school enforces it, because the data is on the school’s systems. Ask your school for its retention settings and its own privacy notice.
The school secures its own installation — servers, access control, patching and backups. Our part is to build and ship the software securely and to help schools configure it safely: AB Tutor Limited is certified to ISO/IEC 27001 and holds Cyber Essentials, and we provide deployment guidance to schools.
You can ask to see or correct your child’s information, in certain situations ask to delete it, or object to or restrict its use. Make those requests to the school — it holds the data and is the controller; we have no copy to search or erase. Students may exercise these rights themselves depending on their age and understanding.
Australian privacy law does not use the concepts of “controller” and “processor” found in some other countries’ laws. Instead, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) regulate any entity that collects, holds, uses or discloses personal information, regardless of whether it is doing so for itself or on behalf of someone else.
Applying that framework to an on-premise installation: your child’s school collects, holds, uses and discloses the student information described in this notice on its own systems, and is the entity responsible for complying with the Australian Privacy Principles in respect of that information. In normal operation, AB Tutor Limited does not collect, hold, use or disclose any of that information at all — the software runs on infrastructure the school controls, and we have no access to it. The only exceptions are the feature-usage telemetry described above (which does not identify any person) and any material a school’s staff chooses to send us for support, in which case we would collect and hold that limited material as an entity independently subject to the Australian Privacy Principles for as long as we hold it, before it is deleted once the support request is closed.
Australian families with questions about how AB Tutor Limited handles any information described above may also contact the Office of the Australian Information Commissioner at oaic.gov.au.
If your complaint is about AB Tutor Limited itself — the company, or the software — contact support@abtutor.com (you can mark it FAO: Jayne James, our Data Protection Officer). We will acknowledge it within 30 days and keep you informed. You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint; families in the EU may complain to their local supervisory authority, and families in Australia to the Office of the Australian Information Commissioner (oaic.gov.au). US families should see our Children’s Privacy Notice (COPPA) — On-Premise.
support@abtutor.com — questions about the software or the company. Your child’s school — anything about your child’s information.
