Schools
School data & privacy
Draft for PDPA owner review. Not a signed school DPA. Do not attach this to a procurement pack yet.
This note is for schools, makerspaces, and workshops evaluating Overhaul. It sits beside the Privacy Policy, which still applies to every account.
1. What we collect from student users
A student who has their own login is a normal Overhaul user. For that account we store:
- Email, hashed password (or Google sign in if they use it), and the role chosen at signup (including “student”)
- Chat prompts, uploaded photos/files, generated cutouts, wiring, firmware, and which AI model ran
- Plan type, send/credit usage, and billing records if the account is paid
- Session cookies needed to stay signed in, plus product analytics (pages and feature use)
School staff who fill the “Tell us about your program” form send organisation name, role, approximate student count, budget timing, and a problem description to us for follow up. That is not a student account.
2. Can a teacher or admin see student activity?
No. There is no school admin dashboard. Chats and files belong to the signed in account: a user can only read their own data. A teacher cannot open a student’s threads from another login.
Team is billed per user account. If each student has a seat, that is a separate login, not a classroom observer role. We have not shipped workspace sharing that would let staff inspect student work.
3. Retention and deletion
Account, chat, and billing records stay while the account is open, and for a reasonable period after closure if needed for security, accounting, or law. Generated images may remain so a project can be reopened.
To delete a student or staff account, email hello@overhaulsg.com or use the contact form. Paid invoices may be kept where the law requires it. We do not yet offer in app bulk classroom deletion.
4. Where data is stored and processed
Overhaul is a Singapore company. The website, accounts, chats, and files are hosted by third party infrastructure providers. We do not publish a full region map on this page until the PDPA owner signs off. Do not assume every processor keeps a copy only in Singapore.
Prompts, uploads, and generation requests are sent to third party AI providers. Those providers process that content to return cutouts, diagrams, and code.
5. Model training and third party AI
Overhaul does not run its own model training pipeline on student prompts. We still send prompts and uploads to third party AI providers to generate output. Whether those providers train on API traffic is governed by their terms, not by a setting in this product. There is no in app control to keep a prompt off those APIs and still generate a build.
Do not paste other people’s personal data, secrets, or student identifiers that are not needed for the build.
6. Data protection contact
Email hello@overhaulsg.com or use /contact?intent=privacy. Ask for a data protection reply if this is a school procurement question.
Until the PDPA owner signs this page off, cite the Privacy Policy and email us, not this draft, in a school proposal.