Data Controller: Project Earth

We are the “Data Controller” – this means we decide what data is collected and how it’s used.

Organisation Details:

• Name: Project Earth
  
• Status: UK Registered Charity
  
• Registration Number: GB-CHC-1214103
  
• Location: United Kingdom

Contact Information:

• Primary Contact: Becky Parker MBE (Founder and Director)
  
• Email: becky@projectearth.global
  
• Website: www.projectearth.global

Data Processor: Playlab Education Inc.

Playlab is the “Data Processor” – this means they process your data on our behalf, following our instructions.

Organisation Details:

• Name: Playlab Education Inc.
  
• Status: US 501(c)(3) Nonprofit organisation
  
• Location: United States
  
• Role: Provides the technology platform that Scout runs on

Sub-Processor: Anthropic Inc.

Anthropic provides the AI that powers Scout (Claude AI)

Organisation Details:

Name: Anthropic Inc.
Location: United States
Role: Provides the Large Language Model (LLM) that makes Scout conversational and intelligent

2.1 Account Registration Data

When you create and use your Scout account, we collect:

Data Type	What We Collect	Why We Need It
First Name	Your first name	To personalise your experience with Scout
Surname/Family name	Your surname/family name	So that we can help to provide support when we’re concerned about your safety.
Age	Your age	To provide age-appropriate guidance
Location	City and country	To connect you with relevant resources and examples
Email Address	Your email address	To create your account, send important updates, and verify your identity
Email Address	Your parent/guardian address	To let them know you’re using Scout

What we DON’T require during registration:

• ✗ Date of birth
• ✗ Full postal addres
  
• ✗ Phone number

2.2 Account Security Data

To keep your account secure:

Data Type	What We Collect	Why We Need It
Password	Your chosen password	To secure your account
Login History	When and from where you log in	To detect suspicious activity

2.3 Conversation Data

This is the heart of Scout – your conversations:

Data Type	What We Collect	Why We Need It
All Messages	Every message you send to Scout	To provide guidance and maintain conversation continuity
Scout’s Responses	Every response Scout gives you	To remember context and improve quality
Timestamps	When each message was sent	To maintain conversation flow and track activity
Project Details	Information about your climate project that you share	To provide relevant guidance and track your progress

What conversations include:

• Questions you ask Scout
• Ideas you share about your project
• Challenges you’re working through
• Feelings you express about your project (including climate anxiety)
• Research notes or thoughts you share
• Any links, examples, or references you mention

What conversations include:

• All conversations are monitored for safeguarding (see Section 5)

2.4 Project Data

As you work through the 5 project stages:

Data Type	What We Collect	Why We Need It
Climate Problem	The issue you’re addressing	To provide relevant guidance
Solution Ideas	Your proposed solutions	To help you develop and refine them
Research Notes	Notes from your user research	To track your progress
Prototype Information	Details about what you’re creating	To guide testing and iteration
Stage Progress	Which stage you’re on, what you’ve completed	To provide appropriate next steps
Files/Links	Any files or links you share in conversations	To reference them in future guidance

2.5 Technical Data

Automatically collected when you use Scout:

Data Type	What We Collect	Why We Need It
IP Address	Your internet address	Security, troubleshooting, country identification
Device Type	Computer, tablet, phone	To optimise Scout’s display
Browser	Chrome, Safari, Firefox, etc.	To ensure compatibility
Operating System	Windows, Mac, iOS, Android	To fix technical issues

2.6 Usage Data

How you use Scout:

Data Type	What We Collect	Why We Need It
Login Frequency	How often you use Scout	To understand engagement patterns
Session Duration	How long you’re active in Scout	To improve the experience
Features Used	Which parts of Scout you interact with	To identify what’s working well
Last Activity Date	When you last used Scout

2.7 Consent and Communication Data

Records of your permissions:

Data Type	What We Collect	Why We Need It
Consent Records	When you agreed to terms	Legal compliance

2.8 Safeguarding Data

Only if safeguarding concerns arise:

Data Type	What We Collect	Why We Need It
Flagged Content	Conversations that triggered safeguarding alerts	To review and respond appropriately
Staff Notes	Assessment notes from safeguarding review	To document our response
Action Taken	What support or intervention was provided	To track safeguarding effectiveness
Follow-up Records	Ongoing support or monitoring	To ensure your safety

We collect data in three main ways:

3.1 Directly From You

When you actively provide information:

• Registration: You create your account and provide basic information
• Conversations: You type messages to Scout
• Profile Updates: You change your account settings or information
• File Uploads: You share files or links in conversations (if applicable)
• Consent Forms: You agree to terms and policies

Feedback: You provide feedback about Scout through surveys or forms

3.2 Automatically

When you use Scout:

• Technical Data: Your device automatically sends information (IP address, browser type, etc.)
• Usage Data: Scout automatically tracks how you use it (login times, features used, etc.)
• Performance Data: Technical systems monitor how Scout is functioning
• Security Logs: Security systems automatically log access and activity

Under UK law (UK GDPR), we must have a “lawful basis” for processing your data. Here are our legal reasons:

4.1 Consent 

For most processing, we rely on your consent:

What this means:

• You explicitly agree to us processing your data
• Consent must be freely given, specific, informed, and unambiguous
• You can withdraw consent at any time
• We won’t use your data in ways you haven’t agreed to

What we process based on consent:

• All conversation data
• Project details you share
• Usage analytics for quality improvement
• Email communications

How consent works:

1. You read this policy and our Acceptable Use Policy
2. You actively agree 
3. You can withdraw consent anytime (account will be deleted)

4.2 Legitimate Interests 

For safeguarding monitoring, we rely on “legitimate interests”:

What this means:

• We have a legitimate interest in protecting children from harm
• This interest is more important than any intrusion on your privacy

What we process based on legitimate interests:

• Monitoring conversations for signs of harm or abuse
• Detecting distress that may require intervention
• Identifying safety concerns that need immediate action

4.3 Legal Obligation

For compliance with laws:

What this means:

• Some processing is required by law
• We must do it regardless of consent

What we process based on legal obligation:

• Reporting serious safeguarding concerns to authorities
• Retaining records as required by charity law
• Responding to valid legal requests (court orders, etc.)
• Complying with tax and accounting requirements

4.4 Vital Interests 

For emergency situations:

What this means:

• Where someone’s life or safety is at serious risk
• We cannot reasonably obtain consent in time
• We must act immediately

What we process based on vital interests:

• Sharing information with emergency services if you’re in immediate danger
• Contacting parents/guardians in crisis situations
• Providing information to safeguarding agencies in emergencies

4.5 Special Category Data

For sensitive data

Legal basis: Explicit consent (Article 9(2)(a) UK GDPR)

• You explicitly consent to us processing any sensitive information you choose to share
• This includes health data (mental health, climate anxiety), beliefs, or other sensitive topics

Exception – Safeguarding: Vital interests (Article 9(2)(c))

• If sensitive data reveals risk to your life or safety
• We can process it without consent to protect you

Here are all the ways we use your data, organised by purpose:

5.1 To Provide Scout Guidance 

What we do:

• Send your messages to Claude AI for processing
• Generate personalised responses based on your project and context
• Remember previous conversations to provide continuity
• Adapt guidance based on your age and stage
• Connect you with relevant resources and examples
• Track your progress through the 5-stage framework

Data used:

• Account data (name, age, location)
• All conversation data
• Project details
• Progress through stages

5.2 To Keep You Safe

What we do:

• Monitor conversations for concerning content:
• Self-harm or suicide ideation
• Mentions of abuse or dangerous situations
• Severe emotional distress
• Sharing of personal safety information
• Flag concerning content for human review
• Assess severity and appropriate response
• Contact you to offer support
• Notify parents/guardians if serious concern
• Contact appropriate support services or authorities if necessary
• Document safeguarding actions taken

Data used:

• Conversation data
• Account data (to contact you/parents)
• Technical data (timing, frequency of concerning content)
• Safeguarding assessment notes (if concern arises)

Important details:

• Human review always happens before action is taken
• We act on genuine concerns, not minor mentions
• We balance your privacy with your safety
• Clear escalation procedures are in place
• Parents/guardians are informed of serious concerns (unless it would put you at greater risk)

5.3 To Maintain Academic Integrity

What we do:

• Monitor for students asking Scout to complete their work
• Identify inappropriate use (asking for answers instead of guidance)
• Help Scout understand when to refuse inappropriate requests
• Ensure students are genuinely learning, not just copying AI

Data used:

• Conversation data
• Patterns of requests
• Type of questions being asked

5.4 To Operate and Maintain Scout

What we do:

• Manage your account and login
• Enable Scout’s technical functionality
• Monitor system performance and fix technical issues
• Prevent fraud, abuse, or misuse
• Update and improve Scout’s technical infrastructure
• Ensure Scout works on different devices and browsers

Data used:

• Account data
• Technical data
• Usage data

5.5 To Improve Scout’s Quality

What we do:

• analyse conversation patterns to improve responses
• Identify common questions to improve guidance
• Find areas where students get stuck
• Refine Scout’s personality and communication style
• Improve age-appropriateness of guidance

Data used:

• Aggregated, de-identified conversation data
• Usage patterns
• Feedback you provide
• Success metrics (project completion, satisfaction)

5.6 To Enable Your Data Rights

What we do:

• Respond to your requests to access your data
• Process requests to delete your data
• Correct inaccurate information
• Provide your data in portable format
• Restrict processing if you request it
• Handle objections to processing

Data used:

• All your personal data (to fulfil the request)
• Account data (to verify your identity)
• Consent records (to manage your permissions)

5.7 To Support Parents/Guardians

What we do:

• Notify parents/guardians when you request to use Scout
• Respond to parental/guardian requests for information
• Notify parents/guardians of safeguarding concerns
• Communicate with parents about Scout and your participation

5.8 For Analytics and Reporting

What we do:

• Understand how many students are using Scout
• Track engagement levels
• Measure programme impact (project completion rates, satisfaction)
• Report to funders and stakeholders (aggregated only)
• Identify demographics we’re reaching
• Assess whether Scout is meeting its goals

Data used:

• Aggregated, anonymized statistics
• General demographics (age ranges, countries – not individuals)
• Usage metrics
• Success indicators

5.9 For Research

What we do:

• Study effectiveness of AI in climate education
• Research climate anxiety and youth empowerment
• Analyse learning patterns and outcomes
• Publish research in academic journals
• Share findings with education community
• Contribute to knowledge about AI in education

Data used:

• De-identified and anonymized data only
• No names, emails, or identifying information
• Aggregated patterns and trends
• Example quotes (fully anonymized)

5.10 To Comply with Law

What we do:

• Respond to valid legal requests (court orders, subpoenas)
• Report serious crimes or safeguarding concerns as legally required
• Retain records as required by charity law
• Cooperate with law enforcement in legitimate investigations
• Respond to Information Commissioner’s Office (ICO) requests

Data used:

• Whatever data is legally required to be disclosed
• Minimal necessary information

Protections:

• We verify legitimacy of all legal requests
• We challenge disproportionate requests
• We notify you if legally permitted
• We limit disclosure to what’s legally required

Your data doesn’t stay with Project Earth alone – it’s processed by several organisations to make Scout work. Here’s who and why:

6.1 Project Earth (Data Controller)

Access:

• Limited access to individual conversations (safeguarding only)
• Access to aggregated analytics
• Full access for responding to your data rights requests

People with access:

• Becky Parker (Director) – Full access for accountability
• Technical Team – Full access for accountability

6.2 Playlab Education Inc. (Data Processor)

Role: Operates Scout platform on our behalf

What they do:

• Host Scout’s servers
• Manage technical infrastructure
• Implement security measures
• Provide platform functionality
• Store your data securely
• Process your conversations through Claude AI

Access:

• Technical staff: Limited access for platform operation and troubleshooting
• Security team: Access to logs and security monitoring
• Customer support: Access only when helping with your specific issue

Location: United States

Contractual protections:

• Data Processing Agreement (DPA) limits what Playlab can do
• Can only process data as Project Earth instructs
• Cannot use your data for own purposes
• Must delete data when we request
• Must maintain security standards
• Subject to audit by Project Earth
• Liability for data breaches

More info: See our full explanation in Section 7 about US data storage

6.3 Anthropic Inc. (Sub-Processor)

Role: Provides Claude AI that powers Scout

What they do:

• Process your messages through Claude AI
• Generate Scout’s responses
• Provide natural language understanding
• Enable Scout’s conversational ability

Access:

• Your conversation text is sent to Claude API
• Processed in real-time to generate responses
• Anthropic does NOT store your conversations long-term
• Anthropic does NOT train AI models on your data

Location: United States

More info: See Anthropic’s Commercial Terms at anthropic.com

Your data is stored on servers located in the United States.

Why the US?

1. Cost-Effective: Playlab’s US infrastructure allows us to provide Scout free to students
2. Reliable Platform: Established, secure infrastructure

But I thought my data was protected by UK law?

It is! Even though your data is physically stored in the US, it remains protected by UK data protection law (UK GDPR) because:

1. Project Earth is UK-based – We’re the Data Controller, so UK law applies
2. Legal Agreements in Place:
• Data Processing Agreement (DPA) with Playlab
• UK International Data Transfer Agreement (UK IDTA)

We share your data only when absolutely necessary. Here’s when and how:

8.1 With Playlab (Data Processor)

Shared: All your personal data
Purpose: To operate Scout platform
Legal Basis: Data Processing Agreement
Protection: Contractual restrictions, can only follow our instructions

See Section 6.2 for full details.

8.2 With Anthropic (Sub-Processor)

Shared: Conversation text only
Purpose: To process through Claude AI and generate responses
Legal Basis: Named sub-processor in DPA
Protection: No training on data, limited retention, enterprise terms

See Section 6.3 for full details.

8.3 With Your Parents/Guardians

Shared: All your personal data if requested
Purpose: Parental oversight and rights under UK GDPR
When: When parent requests access
Process:

1. Parent requests access via email
2. We verify parental identity
3. We notify you that parent is requesting access
4. We provide data within 30 days 

What parents can access:

• Your account information
• All your conversations with Scout
• Your project details
• Usage history

What parents CANNOT do:

• Access your account in real-time
• Make changes to your account (only you can do this)
• See other students’ data

8.4 With Safeguarding Services

Shared: Relevant information only
Purpose: To protect you from harm
When: If we identify serious safety concerns
Legal Basis: Vital interests, legal obligation

Who we might contact:

• Your parents/guardians (most common)
• Crisis helplines or support services
• Social services (serious cases only)
• Police (emergency situations only)

What we share:

• Only information relevant to the concern
• Minimum necessary to get you help
• Specific concerning content if needed

Process:

1. Automated system flags concerning content
2. Human safeguarding officer reviews
3. Assesses severity and appropriate response
4. Contacts you first (unless doing so would increase risk)
5. Contacts parents/guardians/teachers/appropriate services based on assessment
6. Documents all actions taken

8.5 For Legal Compliance

Shared: Only what’s legally required
Purpose: To comply with law
When:

• Court orders or subpoenas
• Legal obligation to report (serious crimes, child abuse)
• ICO investigations or requests
• Tax or charity law requirements

Process:

1. We verify the legal basis for the request
2. We assess whether it’s legitimate and proportionate
3. We share only the minimum required
4. We notify you if legally permitted

8.6 With Researchers

Shared: De-identified, anonymized data only
Purpose: Academic research on AI in climate education

What’s shared:

• Conversation patterns (themes, not full text)
• Project outcomes and completion rates
• Learning patterns and engagement
• Demographics (age range, country – not individual identity)
• Example quotes (fully anonymized)

What’s NEVER shared:

• Your name, email, or identifying information
• Anything that could identify you individually
• Special category data in identifiable form

We don’t keep your data forever. Here’s our retention schedule:

9.1 While You’re Actively Using Scout

What: All your personal data
How Long: As long as you’re actively using Scout
Why: To provide you with continuity and remember your project

“Active use” means:

• You’re logging in regularly
• You’re having conversations with Scout
• You’re working on your project
• Less than 12 months since your last activity

9.2 After You Stop Using Scout

What: All your personal data
How Long: 12 months from last activity
Why:

• Allows you to come back to your project if you take a break
• Helps us understand programme effectiveness
• Reasonable period for educational continuity

9.3 If You Request Early Deletion

You can request deletion anytime 

9.4 If You Delete Your Account

What: All personal data
How Long: Deleted within 30 days
Process:

1. You click “Delete Account” in settings OR email us
2. We confirm it’s really you
3. We ask if you want to download your data first
4. We deactivate account immediately
5. We delete all data within 30 days
6. We confirm deletion to you

 

9.5 Legal Hold 

We may need to keep data longer if:

• Required by law (legal obligation)
• Needed for legal proceedings
• Regulatory investigation ongoing

What happens:

1. We notify you (if legally permitted)
2. We keep only minimum necessary
3. We restrict processing (data stored but not actively used)
4. We delete as soon as legal requirement ends

9.6 Anonymized Data 

What: Aggregated, anonymized statistics
How Long: Indefinitely
Why: programme evaluation, research, impact reporting

Important: This data cannot identify you individually

• No names, emails, or personal identifiers
• Aggregated with other students

You cannot request deletion of anonymized data because it’s no longer personal data under UK GDPR.

Under UK GDPR, you have powerful rights over your data. Here’s what you can do and how:

10.1 Right to Be Informed

What it means: You have the right to know how your data is used
How we fulfil it: This very document, Plus:

• Clear privacy notice before you register
• Acceptable Use Policy
• Age-appropriate explanations
• Ongoing communication about changes

No action needed – we automatically provide this information

10.2 Right of Access 

What it means: You can ask for a copy of all your personal data

What you’ll get:

• All your account information
• All your conversations with Scout
• All your project details
• Your usage history
• Technical data about your account
• Information about how we’ve used your data
• Who we’ve shared it with
• How long we’ll keep it

How to request:

1. Email: becky@projectearth.global 
2. Subject: “Subject Access Request”
3. Include:
• Your name
• Email address used for Scout

If you’re under 18:

• You can request yourself OR
• Your parent can request on your behalf

Timeline:

• We respond within 30 days (UK GDPR maximum)

10.3 Right to Erasure (“Right to be Forgotten”)

What it means: You can ask us to delete your data

When you can request deletion:

• ✓ Anytime, for any reason (consent-based processing)
• ✓ If you withdraw consent
• ✓ If data no longer necessary for original purpose
• ✓ If you object to processing (see 11.7)

When we might need to refuse:

• ✗ If required by law to keep data (rare)
• ✗ If needed for legal proceedings (very rare)

How to request:

Option 1: Delete Account in Scout

1. Log in to Scout
2. Go to Settings → Account
3. Click “Delete Account”
4. Confirm deletion
5. Done!

Option 2: Email Request

1. Email: becky@projectearth.global
2. Subject: “Account Deletion Request”
3. Confirm your identity
4. We’ll process within 30 days

If you’re under 18:

• You can request deletion yourself OR
• Your parent/guardian can request on your behalf

Your data moves internationally. Here’s how we protect it:

11.1 Where Data Travels

From:

• Your device (anywhere in the world)
• To: Playlab servers (United States)

Via:

• Internet connection
• Encrypted channels
• Secure APIs

Why international transfer?

• Scout platform is US-based (Playlab)
• Claude AI is US-based (Anthropic)
• Cost and technical reasons

11.2 Legal Framework for Transfers

Challenge:

• UK GDPR restricts transferring data outside UK
• US does not have “adequacy decision” from UK
• Need alternative legal mechanism

Our solution: UK International Data Transfer Agreement (UK IDTA)

What is UK IDTA?

• Official template from UK Information Commissioner’s Office (ICO)
• Designed for UK-to-Third Country transfers
• Provides “Appropriate Safeguards” as required by UK GDPR
• Contractually binds Playlab to UK data protection standards

What it includes:

• All requirements of UK GDPR
• Security measures (see Section 10)
• Your data rights (see Section 11)
• Audit rights for Project Earth
• Termination rights if protections fail
• Extra protections for children’s data

Scout is designed for students aged 13-18. We take children’s privacy very seriously.

12.1 Age Requirements

Minimum age: 13 years old

We do NOT knowingly collect data from children under 13.

If we discover under-13 data:

1. Immediately suspend account
2. Delete all data
3. Notify anyone who provided consent
4. Prevent future access

12.2 Parental/Guardian Notification

We ask for your parent/guardian email address so that we can let them know you’ve requested to use Scout. 

What we do

• Email parent/guardian email (separate from yours)
• Provide Scout Acceptable Use and Data and Privacy Policies for them to review. 
• Ask a parent/guardian to email us if they do not wish for you to use Scout

12.3 Enhanced Protections for Children

Technical protections:

• Age-appropriate interface
• Content filtering (inappropriate material)
• Safeguarding monitoring (see Section 5.2)

12.4 Special Category Data

Children may disclose sensitive information:

• Mental health (climate anxiety, stress)
• Personal beliefs (environmental views)
• Family circumstances
• Difficult situations

How we handle it:

• Don’t prompt for sensitive information
• Accept students may share voluntarily
• Protect with enhanced security
• Monitor for safeguarding implications

12.5 Parental Rights and Involvement

Parents/guardians of under-18s have:

Right to information:

• Access to this policy
• Clear explanation of data use
• Regular updates on Scout

Right to access:

• Request copy of child’s data
• Review conversations

Right to control:

• Withdraw child’s use of Scout
• Request deletion of child’s data

How to exercise parental rights:

1. Email: becky@projectearth.global 
2. Subject: “Parental Access Request”
3. Provide:
• Your name and relationship to child
• Child’s name and Scout account email
• Specific request

We verify parental identity before granting access.

Quick reference for key terms used in this policy:

Term	Meaning
Personal Data	Information about you that can identify you
Processing	Any use of personal data (collecting, storing, using, deleting, etc.)
Data Controller	organisation that decides what to do with data (Project Earth)
Data Processor	organisation that processes data on controller’s behalf (Playlab)
Sub-Processor	Another processor used by the processor (Anthropic)
UK GDPR	UK General Data Protection Regulation – law protecting your data
Data Subject	The person data is about (you)
Consent	Your agreement to data processing
Legitimate Interests	Legal basis for processing when organisation has good reason
Special Category Data	Sensitive data (health, beliefs, etc.) with extra protections
Data Breach	Unauthorized access to or loss of personal data
Encryption	Scrambling data so only authorized people can read it
Anonymization	Removing all identifying information from data
De-identification	Removing identifying information (may be reversible)
ICO	Information Commissioner’s Office – UK data protection regulator
DPA	Data Processing Agreement – contract with Playlab
UK IDTA	UK International Data Transfer Agreement – for UK-to-US transfers
COPPA	Children’s Online Privacy Protection Act (US law)
FERPA	Family Educational Rights and Privacy Act (US law)
Subject Access Request	Request for copy of your personal data
Right to Erasure	Right to have your data deleted
Data Portability	Right to receive your data in portable format
automated Decision-Making	Decisions made by AI/computers without human involvement
Safeguarding	Protecting children from harm
AI	Artificial Intelligence
LLM	Large Language Model (type of AI)
Cookies	Small files stored on your device by websites