Privacy Policy
How we handle
your personal data.
Pocket Debate collects the minimum data necessary to deliver its educational platform. This policy explains what we collect, how we use it, who we share it with, and the rights you hold.
Summary of Key Points.
A plain-English overview. Each row links to the relevant section for full detail.
| Who we are | Pocket Debate Inc. is the data controller. Contact: contact@pocketdebate.com. | 01 |
| What we collect | Account data, debate transcripts, audio (transcription only), device/usage data, communications. No special category data collected by design. | 02 |
| How we use it | Platform delivery, AI verdicts and feedback, school reporting, content moderation, security, legal compliance. | 03 |
| Who we share with | Two sub-processors only: AWS (EU infrastructure) and Groq (speech-to-text, US, under SCCs and Zero Data Retention). We do not sell data. | 05 |
| International transfers | All platform data stays in AWS EU regions. The only transfer outside the EEA is audio to Groq for transcription, covered by SCCs and Zero Data Retention. | 06 |
| Retention | Audio deleted immediately on transcription. Transcripts deleted after 7 days. Feedback retained for subscription duration. | 07 |
| Your rights | Access, rectification, erasure, restriction, portability, objection, and human review of AI decisions. Submit requests to contact@pocketdebate.com. | 08 |
| AI & automated decisions | Arbiter AI generates formative feedback and scores. No AI output is determinative without human review. No data is used to train AI models. | 09 |
| Age restriction | Platform restricted to users aged 14 and above. Schools confirm student eligibility. | 12 |
| Student data ownership | Schools own all student personal data. Pocket Debate processes it only on the school's instruction. | 13 |
| Policy reviews | Reviewed twice annually, January and July. Material changes communicated 30 days in advance. | 17 |
Who We Are.
Pocket Debate Inc. ("Pocket Debate", "we", "us", "our") is the data controller responsible for the personal data processed through the Pocket Debate platform. We provide an online oracy platform for competitive debating with AI-powered verdicts and feedback, primarily operating in closed school and institution networks.
What Data We Collect.
Pocket Debate collects the minimum personal data necessary to deliver its educational debate platform. Data is collected directly from users, from schools that administer accounts, and automatically through use of the service.
Account data
Name, school email address, year group, and role (student, teacher, or administrator).
Source: User or school administrator
Debate activity data
Debate transcripts, AI-generated verdicts and feedback, ELO rankings, tournament history, and motion assignments.
Source: Generated during platform use
Audio data
Spoken audio submitted for transcription during debate sessions. Deleted immediately on transcription completion.
Source: User submission
Device & usage data
IP address, browser type, session duration, feature interactions, and error logs.
Source: Collected automatically
Communications data
Emails, support requests, and correspondence with Pocket Debate staff.
Source: User
How We Use Your Data.
Personal data is processed only for the purposes described below. We do not sell personal data to third parties and do not use it for advertising or behavioural profiling unrelated to the educational platform.
Platform delivery
Creating and managing user accounts; delivering debate sessions, AI verdicts and feedback, and ELO ranking.
Account, debate, and audio data
AI transcription & adjudication
Transcribing spoken debate audio via Groq Whisper and generating structured verdicts and feedback via Arbiter AI.
Audio data and debate transcripts
Reporting to schools
Providing teachers and administrators with individual and cohort performance summaries, progress reports, and ELO standings. These reports are not anonymised and are visible to the relevant school staff.
Debate activity data
Content moderation & safeguarding
Reviewing debate transcripts within the 7-day retention window to identify content that may raise safeguarding, welfare, or acceptable-use concerns.
Debate transcripts (7-day window only)
Platform improvement
Analysing aggregated, de-identified usage patterns to improve features and reliability. No personal data is used for AI model training.
Device & usage data (de-identified)
Security & integrity
Detecting fraud, abuse, or misuse; maintaining platform security and monitoring for anomalous activity.
Device & usage data, account data
Legal compliance
Meeting our obligations under applicable law, including responding to lawful requests from competent authorities.
Any data necessary
Communications
Responding to support requests, sending service notifications, and communicating material policy changes.
Communications data, account data
Legal Bases for Processing.
Every processing activity described in this Policy relies on at least one lawful basis under Article 6 UK/EU GDPR.
- Contract (Art. 6(1)(b))
- Processing necessary to perform our agreement with the user or school, including account management and platform delivery.
- Legitimate interests (Art. 6(1)(f))
- Platform security, fraud prevention, aggregated analytics for product improvement, and direct communications with institutional contacts. A Legitimate Interests Assessment is maintained internally.
- Legal obligation (Art. 6(1)(c))
- Compliance with applicable law, regulatory requirements, and lawful requests from public authorities.
- Consent (Art. 6(1)(a))
- Where we rely on consent (for optional platform features), this is obtained separately and may be withdrawn at any time without detriment to core service access.
Data Sharing & Sub-processors.
Pocket Debate does not sell or rent personal data. We share data with two sub-processors only, each subject to a written data processing agreement. No personal data is used by any sub-processor to train or improve AI models.
Cloud hosting, database, storage, and AI model inference.
Data shared: All platform data at rest and in transit. Anthropic Claude adjudication runs on AWS Bedrock EU infrastructure.
Speech-to-text transcription via Whisper Large v3 for all debate modes.
Data shared: Audio data only, during debate sessions. Deleted immediately on transcription under Zero Data Retention.
International Transfers & the Groq Position.
The majority of Pocket Debate's processing takes place within the European Union. AWS infrastructure is configured to EU regions (eu-west-3, Paris, and eu-central-1, Frankfurt). Anthropic Claude, accessed via AWS Bedrock with an EU inference profile, processes data entirely within those EU regions. No personal data is transmitted to the United States in connection with these services.
The sole international transfer is audio data sent to Groq Inc. for speech-to-text transcription. The account below is intended to assist institutional data protection officers and procurement teams in their assessments.
The Groq Transfer.
GDPR compliance
Groq is formally GDPR compliant and holds SOC 2 Type II certification. In fulfilment of Article 27 GDPR, Groq has appointed dedicated EU and UK representatives: DP-Dock GmbH in Hamburg and DP Data Protection Services UK Ltd in London. Full compliance posture is published at trust.groq.com.
Transfer mechanism
Groq's Data Processing Addendum incorporates the 2021 EU Standard Contractual Clauses (Module 2, controller-to-processor) automatically. The UK International Data Transfer Agreement (IDTA) is also incorporated for UK-scoped transfers. Both instruments are in place prior to any processing of school data.
Zero Data Retention
Pocket Debate operates Groq with Zero Data Retention (ZDR) enabled. Under ZDR, audio is processed transiently to produce a transcript and is not written to any storage medium by Groq. No audio, transcript, or metadata is retained after the API call completes.
No AI training
Groq's services agreement and DPA explicitly prohibit use of customer data to train, fine-tune, or improve any model. This prohibition applies regardless of ZDR configuration and is contractually enforceable.
Audio is not biometric data in this context
Audio is processed solely to generate a text transcript of spoken argument content — not for voice identification, speaker verification, or any biometric purpose. Accordingly, the audio does not constitute biometric data within the meaning of Article 9 UK/EU GDPR as processed by this platform, and Article 9 lawful bases are not required for this processing activity.
Residual risk assessment
The transfer is limited to audio of short duration — the spoken content of a single debate speech. The audio contains no names, account identifiers, or other direct identifiers. ZDR ensures nothing is stored. SCCs with a Transfer Impact Assessment are the standard accepted mechanism for US cloud processing. Pocket Debate assesses this transfer as low residual risk.
Retention Periods.
Pocket Debate retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, and to comply with applicable legal, regulatory, or contractual obligations. Schools may negotiate shorter retention periods in their Data Processing Agreement.
| Account data | Subscription + 12 months | Enables post-subscription data export |
| Debate transcripts | 7 days | Content moderation and safeguarding review; permanently deleted after |
| AI-generated feedback & verdicts | Duration of subscription | Educational record; enables longitudinal progress tracking |
| ELO rankings & tournament data | Duration of subscription | Competitive record integrity |
| Audio data | Deleted immediately on transcription | Minimum necessary; privacy by design. Not retained by Groq under ZDR. |
| Device & usage logs | 90 days | Security monitoring; platform diagnostics |
| Communications data | 3 years from last contact | Legitimate interests; dispute resolution |
Your Data Rights.
Every individual whose personal data is processed by Pocket Debate has the rights described below under UK GDPR and EU GDPR. To exercise any right, submit a request to contact@pocketdebate.com. We acknowledge within five working days and respond substantively within 30 calendar days.
Right to be Informed
We provide clear information about what data we collect, why, how it is used, who it is shared with, retention periods, and your rights — through this Policy and school-facing documentation.
Right of Access
Request a copy of the personal data we hold about you, including account information, feedback history, and ELO records, subject to identity verification.
Right to Rectification
Request correction of inaccurate or incomplete personal data, either directly or through your school administrator.
Right to Erasure
Request deletion of your personal data, subject to lawful retention requirements. User accounts and associated data can be deleted upon valid request.
Right to Restriction
Request that processing be restricted in certain circumstances. We can suspend or limit an account while a request is assessed.
Right to Data Portability
Where applicable, we can provide your personal data in a structured, machine-readable format (CSV or JSON), including account information and feedback records.
Right to Object
Object to processing based on legitimate interests. We will stop or limit processing where legally required.
Right not to be subject to Automated Decision-Making
Arbiter AI outputs are formative and educational. No automated output produces legal, disciplinary, or similarly significant effects without human review. See Section 09.
Automated Decision-Making & Arbiter AI.
Pocket Debate's Arbiter AI system transcribes spoken debate audio, evaluates argument structure, delivery, and rebuttals, and generates written feedback and a numerical score. These outputs are used for learning, coaching, and competitive ranking within an educational debate context.
Arbiter AI outputs do not produce legal, financial, disciplinary, or otherwise significant real-world effects without human involvement. Where a score contributes to a tournament outcome, the relevant teacher, school administrator, or tournament adjudicator retains the ability to review, query, and override the AI output before any final result is communicated. Human oversight is structurally embedded in the platform design — not offered as an optional add-on — in compliance with Article 22 UK/EU GDPR.
- Nature of output
- Formative feedback and indicative score for educational use. Not determinative.
- Human oversight
- Teachers, school staff, and tournament adjudicators can review, query, and override AI outputs before any result is finalised.
- Significant effects
- None without human involvement. AI outputs do not determine formal qualifications, disciplinary outcomes, or access rights.
- Right to human review
- Available on request via the school administrator or contact@pocketdebate.com.
- AI training
- No personal data processed through Pocket Debate is used to train any AI model.
Cookies & Tracking.
Pocket Debate does not set cookies, web beacons, pixel tags, device fingerprinting, or any other persistent tracking technology on a user's device. No cookie banner is presented on the platform because no such technologies are deployed.
Session management is handled through authentication mechanisms that do not rely on placing cookies on the user's device. No third-party advertising or cross-site tracking technologies are embedded in the platform.
Microsoft SSO & Social Logins.
Pocket Debate offers authentication via Microsoft Single Sign-On (SSO), the recommended and default login method for institutional deployments. It allows schools to manage access through their existing Microsoft Entra ID (formerly Azure Active Directory) infrastructure without requiring students or staff to create separate Pocket Debate passwords.
When a user authenticates via Microsoft SSO, Pocket Debate receives only the user's name, school email address, and a Microsoft account identifier. No passwords, full directory information, or data beyond what is necessary to authenticate the user's account is received. This information is used solely for account creation and authentication — not for marketing, profiling, or any other purpose. School administrators control SSO access via their Microsoft Entra ID tenant; revoking a user's Microsoft account access automatically prevents Pocket Debate login. School administrators should review Microsoft's Privacy Statement for information on how Microsoft processes account data.
- SSO provider
- Microsoft (Entra ID / Azure Active Directory).
- Data received
- Name, school email address, Microsoft account identifier. No passwords or directory data.
- Purpose
- Account creation and authentication only.
- Alternative login
- Email and password login is available where SSO is not configured, subject to school administrator approval.
Age Restrictions & School Users.
Pocket Debate is restricted to users aged 14 and above. This minimum age reflects the requirements of the EU AI Act and applicable data protection law governing the use of AI-powered services with younger children. Schools deploying Pocket Debate are required to confirm that all student users meet this age threshold prior to account creation.
Minimum age enforcement
The platform is restricted to users aged 14 and above. Schools are responsible for confirming student eligibility prior to account creation.
School as gatekeeper
All student accounts are created and managed by school administrators. Students cannot self-register. The school is responsible for communicating privacy information to students and families in an age-appropriate format.
No direct marketing to students
Student accounts are never used for marketing or commercial profiling. ELO rankings and performance data are used solely within the educational debate context.
Minimum data collection
Student accounts require only a name, school email address, year group, and role. No social media accounts, phone numbers, or home addresses are collected.
Audio data handling
Audio is deleted immediately upon transcription completion. It is not retained by Pocket Debate or by Groq under Zero Data Retention.
Parental access requests
Parents and guardians may submit data subject access requests on behalf of student users via the school administrator or directly to contact@pocketdebate.com, subject to identity verification.
Student Data Ownership & Commitments.
Pocket Debate is committed to the privacy and security of student personal data. The following principles govern all processing of student data through the platform and apply in addition to the general provisions of this Policy.
School ownership
Schools own all student personal data processed through Pocket Debate, including account information, debate records, AI-generated feedback, and ELO rankings. Pocket Debate processes this data solely on the school's instruction as data processor.
No commercial use
Student personal data is never used for marketing, advertising, commercial profiling, or any purpose unrelated to the delivery of educational debate services. Student data is not sold, rented, or shared with third parties for commercial purposes.
No AI training
No student personal data — including debate transcripts, audio, feedback, or account information — is used to train, fine-tune, or improve any AI model, whether operated by Pocket Debate or any sub-processor.
Educational purpose limitation
Student data is collected and used exclusively to provide debate session delivery, AI adjudication and feedback, ELO ranking, content moderation, and school reporting. It is not used for any other purpose without explicit school consent.
School data export
Schools may request a full export of their student data at any time in CSV or JSON format. Direct requests to contact@pocketdebate.com.
School data deletion
Schools may request deletion of all student data associated with their institution at any time. Pocket Debate will complete institution-wide deletion requests within 30 days, subject to any lawful retention requirements.
Sub-processor limitation
Student data is shared only with AWS and Groq (see Section 05), each under contractual data processing agreements. No other third party receives student personal data.
Visibility
AI-generated feedback, verdicts, ELO rankings, and performance summaries are visible to relevant teachers and school administrators, and to the student themselves. They are not anonymised at the school level, as their purpose is to support individual student development.
Security.
Pocket Debate applies technical and organisational security measures appropriate to the risk and nature of the data processed. Detailed security documentation is available to institutional partners on request.
Encryption in transit
TLS 1.2 or higher on all data transmission between users, the platform, and sub-processors.
Encryption at rest
AES-256 encryption applied to data stored in AWS EU infrastructure.
Access controls
Role-based access control with principle of least privilege. Multi-factor authentication required for all administrative accounts.
Audio data
Zero Data Retention with Groq ensures audio is not retained beyond the API call. No audio is stored anywhere on the platform.
Transcript deletion
Debate transcripts are permanently deleted 7 days after session completion via automated deletion routines.
Incident response
A documented incident response procedure is maintained. In the event of a personal data breach meeting the notifiable threshold, affected schools and the relevant supervisory authority will be notified within 72 hours.
Penetration testing
The platform undergoes independent penetration testing prior to institutional launch and at least annually thereafter.
Staff training
Access to personal data is restricted to staff who have completed data protection training, required before access is granted and renewed annually.
Security Incident Response.
Pocket Debate maintains a documented security incident response procedure. Schools and institutional partners are asked to report any suspected security incidents involving Pocket Debate data to contact@pocketdebate.com immediately.
| Phase | Action | Timeframe |
|---|---|---|
| Detection & containment | Incident identified, contained, and assessed for scope and severity. Affected systems isolated where necessary. | Immediate |
| Internal escalation | Incident escalated to senior management and Data Protection Officer. Impact on personal data assessed. | Within 4 hours |
| School notification | Affected schools notified of the incident, data involved, likely consequences, and measures taken. Sent regardless of whether regulatory reporting is required. | Within 24 hours of confirmed breach |
| Regulatory notification | Where the breach meets the threshold under Article 33 UK/EU GDPR, the relevant supervisory authority (ICO for UK; AEPD for Spain) notified. | Within 72 hours |
| Data subject notification | Where required under Article 34 UK/EU GDPR, affected individuals notified directly, coordinated with the relevant school. | Without undue delay |
| Post-incident review | Root cause analysis conducted. Measures updated to prevent recurrence. Schools provided with a summary report on request. | Within 30 days |
Business Transfers.
In the event that Pocket Debate Inc. is involved in a merger, acquisition, financing, reorganisation, sale of assets, or transfer of the business or part thereof, personal data held by Pocket Debate may be transferred to a successor entity as part of that transaction. Any successor entity would be required, as a condition of the transfer, to honour the commitments made in this Privacy Policy.
Where such a transaction would result in a material change to how personal data is processed — including any change to the identity of the data controller, the purposes of processing, or the applicable retention periods — Pocket Debate will notify affected schools and users at least 30 days before the change takes effect. Schools will retain the right to request deletion of their data prior to any such transfer.
Changes to This Policy.
This Privacy Policy is reviewed twice annually, in January and July of each year, and updated as required to reflect changes in the platform, processing activities, applicable law, or regulatory guidance. The version number and date on the cover identify the current version.
Material changes — those that substantively alter how we process personal data or affect the rights of data subjects — will be communicated to institutional partners and, where appropriate, to individual users at least 30 days before they take effect. Non-material clarifications such as improved wording, corrected links, or updated sub-processor contact details may take effect immediately upon publication.
Where a school or institutional partner objects to a material change, they should contact us at contact@pocketdebate.com before the change takes effect.
Contact & Complaints.
For any question, concern, or request relating to this Privacy Policy or the processing of your personal data, please contact us at contact@pocketdebate.com. We aim to acknowledge all privacy-related correspondence within five working days. For student and parental requests, please contact your school's data protection lead in the first instance — they will liaise with us on your behalf.
Supervisory Authorities.
If you are not satisfied with our response, or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the relevant supervisory authority.
UK — Information Commissioner's Office (ICO) at ico.org.uk
EEA — The data protection authority in the relevant Member State.
Spain — Agencia Española de Protección de Datos (AEPD) at aepd.es
This Policy was last reviewed and approved for publication in June 2026.
Next scheduled review: January 2027.