Information for schools and school owners
Schools, school owners, teachers, students and parents can find information here about how 321school works, the personal data it processes, and ongoing privacy and security work. The documentation distinguishes the current service, tested improvements and matters to clarify before agreed school use.
Internal control and documented progress
Fjord Service works systematically on internal control, privacy and information security as an ongoing part of operations. Access controls, private file handling, participant-link approval, school boundaries for invitations, time-limited substitute access and daily backups are deployed and checked. Data-flow mapping, provider clarifications, retention procedures and documentation continue to be maintained, with clear responsibility and verification for each measure.
Access controls, private file handling and participant-link approval went live on 28 October 2026. Firestore/Storage rules and application flows were checked with synthetic accounts, a dedicated test room and rejection of unauthorised access. Old direct download tokens were revoked for the entire mapped set of 128 audio files, rechecked on 29 October. Files, submissions and memberships were preserved. The school boundary for new invitations was deployed on 6 November and time-limited substitute access on 7 November 2026, both with documented functional checks. The evidence covers the flows and file set examined.
The school boundary for new co-teacher and observer invitations to school rooms was deployed and checked on 6 November 2026. Invited teachers must have an active affiliation with the same school. The school administrator role does not itself grant access to individual student answers or the right to invite on behalf of the room owner.
Time-limited substitute-teacher access was deployed and checked on 7 November 2026. A school administrator can grant a teacher with an active affiliation with the same school access to a specific school room, including during teacher absence. The substitute can read assignments and student answers and provide written feedback through a dedicated, scoped view. Access can be revoked and expires automatically. Grants, expiry deadlines and revocations are logged. This does not grant ordinary room administration rights or general access to the school’s other rooms.
Since 11 November 2026, a platform administrator can disable AI feedback suggestions for Lessons answers and AI help in writing activities across Space rooms linked to one verified school, including new rooms. Rooms may apply stricter settings; a room cannot override the school's restriction. These settings are not automatically enabled for every school. Rooms without a verified school link are outside their scope. Other AI features and school-owner-wide controls are not covered by these two restrictions.
Checks using synthetic accounts and test rooms confirmed rejection across the school boundary, continued ordinary student and co-teacher access, and that revocation and expiry block further substitute access. Existing student work was preserved. The evidence covers the flows tested.
Analytics and retention
Google Analytics and application product analytics are disabled in the published code policy for all roles, deployed on 28 October 2026. This was checked in source and tests and on a selected public page view. Necessary operational/security logging and educational results are described separately. Any later activation of product analytics requires a separate assessment and documented change.
The draft agreement proposes target periods to be agreed with the school owner: student work and related audio/files during active teaching, deleted within 90 days of the agreed end; operational/error logs 30 days and security logs 90 days. School instructions, earlier deletion and return are agreed in annex D. Specific incident evidence may be retained separately with a documented basis and review date. Enforcement has not been fully verified in operation; procedures, export, copies and provider periods are completed separately.
