Last updated 25 August 2026.
Lighthouse Academy runs the Lighthouse Campus — the learning platform at campus.thelighthouseacademy.org and its companion mobile app. This page explains, in plain words, what information the campus holds, why, and the choices you have. Questions are always welcome at info@thelighthouseacademy.org.
The short version
- We sell learning services, never data. There is no advertising on the campus, no third-party analytics, and nothing is sold or shared for marketing.
- A pupil’s record belongs to their school and family. For school-provisioned pupils, the school remains in charge of its pupils’ data and we act on the school’s instructions under a written data processing agreement.
- Data is stored on a server we control in Germany (EEA), and every connection is encrypted.
What the campus holds
- Account information — name, email address, role (pupil, teacher, parent), school, year group and, where the school supplies it, date of birth. Pupil accounts are set up by their school, or by a parent on our website.
- Learning content people create — written work, practice answers, reflections, class posts and comments, messages within the campus, and optional photographs of schoolwork (location data is stripped from photographs when they are uploaded).
- Assessment and progress records — measures entered or uploaded by school staff, teacher judgements, goals, curriculum progress and each pupil’s talent development profile.
- Access records — an audit trail of who viewed or changed which record and when, kept as a safeguard on children’s data.
- Service records — anonymous page-timing figures (no IP address, no user identity) kept for 14 days, and standard web server logs kept for security for up to 90 days.
What it is used for
Providing the service itself: showing each pupil their own work and profile, and showing teachers and approved parents or guardians what they are each entitled to see; school oversight and reporting; safeguarding and access review; and running the service (sign-in, notifications, security). That is the complete list. We do not use this data for advertising, we do not sell it, and we do not use school pupils’ data to develop or train models — our agreement with schools defaults to “no such use”, and anything different would need the school’s explicit, separately signed agreement.
Where it lives, and how it is protected
All platform data is stored on a private server we control, hosted in Germany (EEA). Connections are encrypted (HTTPS, with strict transport security). Uploaded pupil work is stored outside the public web space and is only ever served after a permission check. Access to pupil records is scoped — pupils see their own work, teachers their classes, families their own child — and is recorded in the audit trail.
Who else touches the data
Only service providers we use to run the campus, each limited to its job:
- Microsoft 365 — sending the campus’s emails (sign-in, notifications, reports to authorised adults).
- Brevo — holds the opt-in mailing list for our newsletter (confirmed adult subscribers only); it holds no pupil records.
- Anthropic — powers optional AI study features, such as feedback on a practice answer. Only the content needed for the specific feature is sent, and under the commercial terms we use, inputs and outputs are not used to train their models. AI suggestions are advisory and labelled; a teacher decides anything that matters.
- Zoom — live online lessons, where a family or school has booked them.
- Tap Payments — payment processing on our website only. No card details ever touch our server.
- Meta (WhatsApp Business) — practical messaging with adults, such as booking confirmations. It does not carry pupil learning records.
- Google reCAPTCHA — spam prevention on our website’s registration forms.
We never sell data, never share it for advertising, and share nothing with data brokers.
Children’s data
The campus is used by children, and we treat that as the defining fact of the design. There is no advertising and no tracking of any kind. For school-provisioned pupils, the school decides what is collected and who may see it, under a data processing agreement that includes the audit trail, scoped access, and the school’s right to have its data returned or deleted. Our approach is informed by Qatar’s Personal Data Privacy Protection Law and by UK and EU data protection law.
How long we keep things
School records are kept for as long as the school instructs, under a retention schedule the school controls. Some examples of what happens automatically: a parent’s or teacher’s email address collected for a one-off enquiry is erased 180 days after the enquiry closes; anonymous page-timing figures are kept 14 days; security logs up to 90 days.
The mobile app
The Lighthouse Campus app is a way of signing in to an account that already exists — it collects the same information as the website, and nothing more. The app contains no advertising, no third-party analytics, and no purchasing.
Your choices
You can ask to see, correct or delete information we hold: pupils and school staff through their school, families directly with us. Newsletter emails carry an unsubscribe link, and parent reports are double opt-in with one-click unsubscribe. For anything else, write to info@thelighthouseacademy.org and a person will answer.
Changes
If this policy changes in a way that matters, we will say so on this page and date it above.