domain-test.educationevidence.io customer privacy notice

Open Development & Education is the data controller for the personal information described in this notice.

Contact details#

Email: contact@opendeved.net

What we collect and why#

Messages and support#

If you contact us, we use your name, contact details, message, and communication history to answer you, handle complaints, and keep a useful support record.

Our lawful basis is legitimate interests. We need to respond to people who contact us and understand earlier communication when resolving a problem.

Essential site operation and security#

Our hosting, security, and authentication systems may process your IP address, request details, browser information, security signals, and account or session information. We use this information to deliver the site, prevent abuse, enforce rate limits, and provide login where it is enabled.

Our lawful basis is legitimate interests. Running a reliable and secure public service benefits visitors and our organisation. Some essential browser storage is also necessary to provide a feature you requested, such as keeping a language choice or signed-in session.

Product analytics after consent#

If you allow product analytics, we use PostHog and Google Analytics to understand how the library is used and where it needs improvement. We may process:

• A pseudonymous browser and session identifier
• Browser, device, screen, operating system, timezone, and approximate location information
• Page paths without query strings or fragments
• Navigation and allowed interface interactions
• Search-present status, result counts, page number, sorting, and selected values from a fixed list of non-text filters
• File opens and downloads
• Copy and export actions and their format
• Feature, model, status, duration, and token counts for AI requests
• Performance measurements, dead clicks, and technical error types
• Standard UTM campaign source, medium, campaign, term, and content values

PostHog creates a pseudonymous product profile so events from the same consented browser can be understood across visits. We do not attach your name, email address, AI conversations, document text, free-text searches, or form values to that profile.

Our lawful basis is consent. PostHog and Google Analytics do not load in the browser until you allow product analytics. You can withdraw consent at any time through Cookie settings in the footer.

Session replay after separate consent#

If you separately allow session replay and diagnostics, PostHog records a masked visual reconstruction of your session so we can reproduce interface problems. All page text, input values, and element attributes are masked. Request and response bodies, request headers, console logs, canvas content, JSON-LD, and cross-origin frames are not recorded.

Our lawful basis is consent. Session replay can only be enabled with product analytics and can be turned off separately at any time.

Limited aggregate measurement after analytics is declined#

If you decline product analytics, the browser does not load PostHog or Google Analytics and does not create a browser analytics profile. The site may send a limited event to its own server for fixed categories and counts, such as a page path without its query string, result totals, or an action type.

These events do not contain a browser identifier, visitor IP address, free-text search, document content, AI conversation, or user-provided text. The server groups them under one identifier for the library and day, disables person-profile creation, and then sends the aggregate event to PostHog.

Our lawful basis is legitimate interests. We need basic, low-risk totals to keep the service reliable and understand whether core features are being used. We reduce the privacy impact by removing browser identity and content and by grouping all declined visitors together.

Information we deliberately exclude from analytics#

We do not send the following to product analytics or aggregate measurement:

• Passwords, login credentials, payment details, or form values
• Free-text search queries
• AI prompts, AI responses, or chat transcripts
• Publication, PDF, or other document text
• Copied text
• Email addresses
• URL query strings and fragments
• Request or response bodies used by session replay

We do not use advertising cookies, enable Google advertising signals, or sell personal information.

Where information comes from#

We receive information:

• Directly from you when you contact us, sign in, or change analytics choices
• From your browser and network when you use the site
• From your interactions with the library
• From PostHog and Google Analytics after consent
• From our hosting, security, database, and authentication services when they operate the site

Who we share information with#

We use service providers only for the jobs described below:

• PostHog Inc. processes consented product analytics, optional masked session replay, and limited server-side aggregate events.
• Google LLC processes consented traffic and usage analytics. It may also provide Google sign-in when that option is enabled.
• Cloudflare, Inc. may deliver the site and provide bot protection, abuse prevention, and rate limiting.
• Our hosting and database providers store and serve the application, account, and operational data. The active host may be Vercel, DigitalOcean, or another provider selected by the library operator.
• Configured authentication providers process login and session information when login is enabled.

These providers act under contracts and may use infrastructure outside the UK. Where information is transferred internationally, we use an applicable UK adequacy regulation, the UK Extension to the EU-US Data Privacy Framework where the recipient participates, or approved contractual safeguards. Contact us for more information or a copy of the relevant safeguards.

How long we keep information#

At the end of the applicable period, we delete the information or make it anonymous. Where a provider controls technical backup cycles, deletion completes through its normal secure backup rotation.

Your rights#

Depending on the information and lawful basis, you may have the right to:

• Ask for a copy of your personal information
• Correct incomplete or inaccurate information
• Ask us to delete information
• Ask us to restrict how information is used
• Object to processing based on legitimate interests
• Receive or transfer information you provided in a portable format
• Withdraw consent at any time

Withdrawing consent does not affect processing that was lawful before withdrawal. It is as easy to withdraw analytics consent as to give it: open Cookie settings in the footer and save different choices or decline.

Contact us at contact@opendeved.net to make a rights request. We normally respond within one month. Some rights have legal limits and may not apply in every case.

We do not use analytics profiles to make decisions that have legal or similarly significant effects on you.

How we protect information#

We use HTTPS encryption, access controls, pseudonymous analytics identifiers, content filtering, masked replay, consent controls, and providers selected for their security practices. Turning analytics off stops the browser analytics tools, clears their browser storage, and prevents new browser-profile events.

Cookies and browser storage#

Our explains the essential and optional browser storage used by the site. It also explains the difference between Accept All & Continue, Save preferences, and Decline.

How to complain#

Contact us first at contact@opendeved.net so we can try to resolve your concern.

You can also complain to the Information Commissioner's Office:

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone: 0303 123 1113

Website: ico.org.uk/make-a-complaint

Changes to this notice#

We review this notice when our use of information changes. If a change affects an existing analytics choice, we can increase the analytics policy version so the site asks for consent again.

Last updated#

August 27, 2026