Compliance
Data Protection Impact Assessment
Last reviewed: 28 June 2026
1. Purpose and scope
Class Prayer processes personal data of children and school staff to plan classroom prayer, deliver safeguarding-aware AI-assisted drafting, and produce printable liturgical materials. Because the processing involves systematic monitoring of children's free-text input combined with novel AI generation, a DPIA is required under Article 35(3)(a)–(b) UK GDPR and the ICO's Children's Code.
2. Description of processing
| Stage | Personal data | Recipients |
|---|---|---|
| Account creation (staff) | Name, email, school, role | Class Prayer; Lovable Cloud (hosting) |
| Class setup (pupils) | First name, year group, per-class login code | The pupil's class teacher; school leader |
| Prayer planning | Free-text answers, generated drafts, chat refinements | The author; AI gateway (scrubbed prompts only) |
| Safeguarding triage | Concerning extract + 6 surrounding messages | School DSL only (column-encrypted) |
| Retention purge | Soft-deleted account references | Automated job (no human view) |
3. Necessity and proportionality
- Data minimisation: no pupil surname, DOB, address, phone, photo or biometric data is collected.
- Purpose limitation: data is used only for prayer planning, safeguarding, and the running of the Service; never for advertising or model training.
- Storage limitation: nightly automated purge enforces retention caps; users can self-serve deletion.
- Lawful basis: see Legitimate Interests Assessments for the LI-based activities; safeguarding rests on legal obligation.
4. Risk register
| Risk | Likelihood | Impact | Mitigation | Residual |
|---|---|---|---|---|
| Cross-school data leak via missing RLS policy | Low | High | RLS enabled on every public-schema table; supabase linter run before release; school_id scoped policies; integration tests. | Low |
| Pupil free-text discloses safeguarding concern, not seen | Medium | High | On-the-fly AI safeguarding classifier; flag visible to DSL within seconds; encrypted at column level. | Low |
| AI provider trains on pupil input | Low | High | Contractual no-training clause; pupil identifiers stripped before send; provider list reviewed quarterly. | Low |
| AI generates doctrinally or pastorally harmful content | Medium | Medium | System prompt bound by Magnifica Humanitas; staff review required; voice-highlighting shows verbatim vs generated text; never replaces priest/chaplain. | Low |
| Account takeover | Low | Medium | HIBP breach check on sign-up; per-class pupil codes rotated by teacher; short-lived JWTs; staff Google SSO option. | Low |
| Excessive retention | Low | Medium | Nightly pg_cron purge; 30-day delete window; 7-year cap on safeguarding flags; 90-day pastoral audit log. | Low |
| Children's Code non-compliance | Low | High | AADC self-assessment maintained (see Children's Code self-assessment); no profiling, no nudge techniques, no targeted advertising; high-privacy defaults. | Low |
| Pupil types a full name or other identifying detail into a free-text field | Medium | Medium | Acceptable Use clause in the Terms of service §3 requires staff to instruct pupils not to enter surnames, addresses or identifying personal scenarios; inline UI helper text on every pupil free-text field repeats the instruction; free-text content is stored as unindexed transient data, never used for analytics or model training, and is purged on account closure under the retention schedule. | Low |
4a. Controller / Processor matrix
| Data category | Controller | Processor | Lawful basis |
|---|---|---|---|
| Staff account data (name, email, role) | Class Prayer Ltd | Lovable Cloud | Contract / Legitimate interests |
| School billing & marketing data | Class Prayer Ltd | Lovable Cloud; Lovable Emails | Contract / Legitimate interests |
| Pupil accounts (first name, class code) | The School | Class Prayer Ltd | Public task / Legitimate interests of the School |
| Pupil free-text (prayers, reflections, refinements) | The School | Class Prayer Ltd; Lovable AI Gateway (scrubbed) | Public task / Legitimate interests of the School |
| Safeguarding flags | The School | Class Prayer Ltd | Legal obligation (Children Act 2004 s.11; KCSiE) |
5. Consultation
School DPOs are consulted at onboarding and given access to this DPIA, the retention schedule, and the breach procedure. Material feature changes that introduce new categories of personal data are notified at least 30 days in advance.
6. Outcome and review
Residual risk across the register is Low. The DPIA is reviewed at least annually and whenever a feature introducing new personal data, a new sub-processor, or a new lawful basis is shipped.
Questions? Email info@classprayer.app.