School procurement summary
School data processing
What Spellito processes for a school, why it is needed, who can see it, and the safeguards around each class.
Last reviewed: 16 July 2026
A clear summary, not the signed contract
This page helps a school review Spellito, but it is not by itself a binding Data Processing Agreement. Before a live school pilot processes pupil data, Wacky Works Digital and the school must put a written UK GDPR Article 28 agreement in place. That agreement will include the school’s documented instructions, security and breach support, subprocessor approval, data-subject rights, deletion or return, and audit terms.
Who is responsible
School-directed use
When a school asks its teachers to use Spellito for confirmed pupils, the school is the controller for that school-directed processing. Wacky Works Digital operates Spellito as its processor and follows the signed instructions.
Direct family use
A family can use Spellito independently of a school. Wacky Works Digital remains the controller for that direct service, as well as for essential security, legal compliance and service-operation records.
The final agreement records this role split explicitly. Spellito does not treat a school as the controller for a parent’s separate consumer account merely because the parent later confirms a class.
Proposed processing schedule
These are the operational facts the school-specific agreement will turn into documented instructions.
- Subject matter
- Private class setup, parent-authorised pupil confirmation, spelling-set delivery, practice recording and class progress reporting.
- Duration
- For the school pilot or subscription term, followed by the deletion or return process stated in the signed agreement.
- People
- Primary-school pupils, their parent or carer account holders, and authorised teachers.
- Personal data
- Child first name, last initial, broad year, official school reference, class link, assigned spelling sets, session totals, dates, active answer time, correctness, hints and word-level difficulty. Adult sign-in email stays in the authentication service.
- Not requested
- Child surname, birthday, child email, home address, phone number, photo, voice recording, geolocation, typed spelling answer or special-category data.
- Purpose
- Deliver spelling practice, let a teacher assign work, show the parent private progress and give the confirmed class teacher limited learning aggregates. No advertising, marketing profiles or sale of data.
Built-in controls
Exact-class isolation
Database row-level security and purpose-limited functions isolate each family and class. A teacher cannot browse another class or school.
Parent-authorised link
An invitation reveals no pupil. A parent selects their own matching child profile, and no practice is visible until that exact class confirms the request.
Minimum useful progress
Teachers receive post-confirmation totals, trends and up to ten tricky words. They do not receive raw attempts or the answer a child typed.
Rights and deletion
Parents can export family data and delete a child or account. The signed school agreement will add the verified admin route and timetable for school-directed return or deletion at contract end.
Current subprocessors
Spellito uses these providers to run the service. The signed agreement will include general written authorisation, change notice and objection terms before any new subprocessor handles school data.
Supabase
Adult authentication, UK-hosted Postgres database and audio storage.
Location: London, United Kingdom (eu-west-2).
Vercel
Website hosting, server execution, scheduled jobs and operational logs.
Location: London compute where configured; limited platform processing may occur elsewhere under Vercel's UK data-processing terms.
Google Cloud Vertex AI
Creates missing practice sentences and teacher-voice audio from teacher or parent word lists. No account profile or typed spelling answer is sent.
Location: us-central1, United States. Google's Cloud terms prohibit model training on this customer data without prior permission or instruction.
Evidence for a school review
Spellito maintains a living DPIA and code-derived data-flow map. A school can request the current review pack, security summary, processing schedule and subprocessor details before signing.