Privacy Policy
What MESO collects, what it deliberately does not, and how to exercise your rights over it.
Last updated
Who this covers
This notice covers MESO Lab: both this website and the MESO planning platform. Where something applies to only one of the two, it says so.
MESO is a planning tool for teachers. It is not a student information system, and the boundary below on student data is a design constraint rather than a policy preference.
Information we collect
| Category | Examples |
|---|---|
| Identity data | Name, email address, user ID |
| Professional data | School name, year groups taught, subjects taught, teaching experience |
| Usage data | Platform interactions and feature usage, with consent |
| Technical data | IP address, for security, and session data |
| User content | Unit plans, lesson plans, assessments and chat conversations |
On this website specifically, we process only what you send us. If you submit the publisher enquiry form we receive the name, email address and message you type into it. If you never submit the form, this website collects no personal data about you.
Information we do not collect
These are hard boundaries. MESO has no feature that would gather any of them, and no student profiling of any kind takes place.
- Student personal information
- Student academic records
- Classroom attendance or behavioural data
- Third-party personal information
How we use your data
- To provide and improve the platform
- To personalise your experience
- To communicate important updates about the service
- To keep the platform secure and maintain its integrity
- To comply with our legal obligations
Third parties who process data for us
Every provider listed here is bound by a data processing agreement, is required to maintain appropriate security measures, and processes data only as far as is necessary to deliver the service.
| Provider | Purpose | Data processed |
|---|---|---|
| Supabase | Database and authentication | Account data and your content |
| Google Cloud (Vertex AI) | AI content generation | The text of your request and the generated response |
| Google Cloud Speech-to-Text | Transcribing voice input | The audio you record |
| AWS Bedrock | Curriculum search | The topic or outcome text being matched |
| Amazon SES | Sending sign-in, confirmation and password-reset emails | Your email address and the contents of those emails |
| Web3Forms | Delivering this website's publisher enquiry form | The name, email address and message you submit |
Where your data is processed
Your account, your plans and your uploaded documents are stored in the European Union. Curriculum search runs in the EU as well.
AI generation does not. When you create a plan, resource or assessment, or send a message to MESO Assist, the text of your request and the generated response are sent to Google Cloud and processed in the United States. Voice input is transcribed there too, so the audio you record leaves the EU.
These transfers rely on Google's data processing agreement, standard contractual clauses, and Google LLC's certification under the EU-US Data Privacy Framework. Nothing you send is used to train third-party models.
This is why we ask you not to enter identifiable student information. Describe the class rather than naming the pupil, and nothing identifying leaves the EU in the first place.
How your data is protected
- All data is encrypted in transit using SSL/TLS, and at rest
- Row-Level Security isolates each user's data from every other user's
- Security assessments and monitoring are carried out regularly
- Access is limited to authorised personnel on a need-to-know basis
- We maintain incident response procedures for potential breaches
Your rights under the GDPR
You have the right to:
- Access the personal data we hold about you
- Rectify information that is inaccurate
- Erase your data, the right to be forgotten
- Port your data to another service in a machine-readable format
- Object to certain kinds of processing
- Restrict processing in specific circumstances
To exercise any of these, email contact@mesolab.ai. You can also export your data, edit your profile and delete your account directly from Settings inside the platform, and withdraw consent for analytics on this website using the Manage cookies link in the footer.
Deleting your account starts a 30-day grace period during which it can be recovered. After that the data is anonymised and cannot be retrieved.
How long we keep data
| Data type | Retention period |
|---|---|
| Active account data | For as long as the account exists |
| Deleted account data | 30 days, as a recovery period |
| Anonymised data | 90 days after deletion |
| Audit logs | 7 years, for legal compliance |
Contacting us about privacy
Email contact@mesolab.ai with any question about this notice, or to make a rights request. If you are a school or publisher carrying out due diligence, say so and we will respond with the documentation you need.