Nurture Signal DPIA pack (Australia)
Your school carries out the Data Protection Impact Assessment (or, under the Australian Privacy Principles, the Privacy Impact Assessment), because it decides to use Signal and is generally the controller of the data. This pack is the vendor half — the processing description, data flows, risks and controls — written to be lifted into your own template.
It covers Nurture Signal on the Australian deployment (au.gonurture.com).
If another deployment serves your school, ask us which sections change.
1. Description of the processing
What it does. A host (a teacher or other staff member) runs a session. Participants join on their own devices with a six-character code and respond — answers, polls, engagement checks, reflections, comments and reactions. The host sees responses live and reviews the session afterwards.
Why schools use it. To see how a whole class is engaging and understanding, in the moment and afterwards — including quieter students.
Scale. Sessions are kept after they end, and a teacher can group them by class. Over time this builds a record of each student’s participation across sessions, for as long as your school uses Signal. Scale is the number of teachers who host, times their classes, times how long you keep the data.
What it is not. Signal is not an LMS or a student records system and holds no gradebook or student file. Run standalone, it imports no existing records.
Canvas, where installed. Your Canvas administrator can install Signal as an LTI 1.3 tool. Signal then receives identity details at each launch and records course membership for each person who opens it (section 3). Signal is not currently available in Microsoft Teams.
2. Personal information processed
| Category | Fields | Data subjects |
|---|---|---|
| Account | Name, email address, school, profile picture where the identity provider supplies one, and the provider’s account ID (so the same person is recognised next time) | Staff and students who sign in |
| Participants without an account | A guest’s display name, or the name and optional email a teacher types in for a shared-screen roster | Guests and teacher-added participants |
| Content a host writes | Prompts and rewrite instructions given to the AI, session and question text, instructions to participants, answer options and explanations, success criteria and model answers (including model answers hidden from students). Unrestricted text, so it holds whatever a host types | The host, and anyone they write about |
| Session activity | Every response type: answers and reasoning, open-answer responses, poll choices and reasons, engagement-check levels and explanations, confidence ratings and comments, reflections, questions, comments, replies, reactions and timestamps | Participants |
| Derived results | Correctness, scores and marks, guess or low-effort flags (automatic or set by the host), AI feedback and session recommendations. Two behavioural signals: leaving the session view (shown to the host live) and whether a written answer was typed or pasted. These are educational performance and conduct records | Participants who answer; for leaving the view, everyone in a live session |
| Group membership | Which participants belong to a class group, across sessions, guests included | Participants in grouped sessions |
| Canvas records (where installed) | Canvas user, course and assignment IDs; name, email and course role from the launch; course membership of those who open Signal; the score Signal writes back for its own assignment; and, through the API token, the course’s assignment list (titles, dates and which students each is visible to) | Canvas users who open Signal; with the API token, also the Canvas IDs of students an assignment is visible to |
| Technical | Sign-in events, browser and device, IP address, logs and approximate location. Also: masked session replays from error monitoring, and product analytics where configured — both record clicks and navigation without a name or email, and both are personal information | All users |
| Curriculum documents (optional) | Teaching material a host uploads for AI grounding, and passages from it. Uploads are not restricted, so a document containing a student’s name or work is processed like any other | None, if hosts upload teaching material only |
| Support | Whatever is shared when contacting us | Whoever contacts us |
Not collected. No field asks for, and no feature imports: your gradebook, work produced outside Signal, audio or video, file uploads from participants, or passwords (sign-in is passwordless). The exceptions are conditional on features your school turns on: the Canvas launch data, the Canvas course assignment list read through the API token, and curriculum uploads.
Written answers are student work. Signal keeps open answers, marks them against the teacher’s criteria, and sends them to the AI provider to do so.
Nothing people write or upload is filtered. No field asks for sensitive information, but it can arrive through participant free text, host-written content and curriculum uploads. Record these as conditional paths your own practice controls (see section 6).
3. Data flows
- Joining. A user opens
au.gonurture.comand signs in, or joins as a guest where allowed. For shared-screen sessions the teacher types in the roster; nothing is collected from those students directly, so the school gives them notice. - Sign-in. The identity provider returns the account ID, name, email and
profile picture, and returns the user directly to your deployment. With
Microsoft Entra, Signal requests
openid,profile,email,User.Read(to fetch the profile photo) andoffline_access(a refresh token), and no mail, files, calendar, directory or write access (Entra admin consent). Google works the same way. Otherwise sign-in is by a one-time emailed code, which goes through our email provider outside Australia. - Storage. Session data is written to the Australian deployment’s database and object storage.
- AI. The text a feature works on goes to Azure OpenAI in Australia East. No name, email or ID is sent as a field, but a name typed into that text goes with it — record this as a conditional identity transfer.
- Error monitoring. Diagnostics with no IP, cookies, request bodies or identity, plus masked session replays (one in ten sessions and every session with an error) that record clicks and navigation.
- Product analytics, where configured: usage activity to Microsoft Clarity, recorded against a pseudonymous account ID, never a name or email. Where the application runs on Vercel, Vercel’s web analytics also records page views without cookies or an account ID. These are deployment settings; ask us whether they apply to yours.
Our general Australian privacy policy covers Nurture Assessments, which sends a student’s first name to its AI. Signal does not, and Signal’s privacy policy governs Signal.
Canvas (where installed)
These move data between your LMS and Signal. Canvas is your system, not our sub-processor.
- Launch — Canvas sends the claims you chose at install and the user’s course role. Signal keeps the Canvas IDs, name, email and role (which it uses to treat the user as a teacher or a student), and does not keep an SIS ID or avatar if Canvas sends one.
- Roster — Signal records course membership for each person who opens it from the course. The install grants read-only access to Canvas’s course roster (Names and Role Provisioning), but Signal does not currently use it, so it does not collect the full course roster.
- Score — Signal creates its own assignment and writes its score to your gradebook. Over the LTI connection it touches no other assignment.
- API token — the full integration also uses a Canvas API token your school issues from a dedicated Canvas account, stored encrypted. Signal uses it to create and manage its own assignments, placing them in an assignment group and keeping Canvas dates in step. It reads the course’s assignment list to do so, and does not read your gradebook or change other assignments.
Your administrator can review, restrict or remove the integration at any time.
A teacher’s connected AI assistant
A teacher can connect their own AI assistant to read their Signal data. It is the only flow that sends names, emails and profile pictures to an AI vendor as fields, and the vendor is the teacher’s choice, under its own terms. Your school can switch the capability off (every request is then refused) or require redaction for every teacher (identity fields become pseudonymous references; names typed into text are not removed). Teachers connect to their school’s own deployment —
au.gonurture.com/mcp for Australian schools — so the connection is
Australian; what the assistant then reads goes to the vendor the teacher chose.
Curriculum grounding (where enabled)
When a host attaches teaching material to a group, the file is stored and copied to a private indexing container (Office files also get a preview copy). Azure AI Services extracts the text, Azure AI Search indexes it, and Azure OpenAI makes it searchable. Relevant passages are then included in the host’s AI requests. All of this runs in Australia.
4. Data residency
All Signal data is stored in Microsoft Azure in Australia: database, file storage and curriculum indexes. Nurture runs the database itself rather than using a separate database service, and AI generation runs on Azure OpenAI in Australia East. The application runs on Azure or, for some cloud deployments, on Vercel, which stores no account records or session content; we confirm which for yours. A school can also run Signal entirely in its own Azure tenancy. Microsoft and Google sign-in return the user directly to the deployment that started the sign-in, and a user who starts on our global site is sent to your deployment before signing in, so no account is created on another deployment.
These paths reach a provider or person outside Australia. Record each one.
| Path | What is involved | Control |
|---|---|---|
| Application hosting on Vercel | Where your deployment’s application runs on Vercel, requests and the pages they return pass through Vercel, and Vercel’s web analytics records page views (page, referrer, browser, device and country) without cookies or an account ID. Data stays stored in Azure in Australia | Deployment setting; we confirm it in writing |
| Your Canvas instance | Where installed, the scores and assignment updates Signal writes go to your Canvas, wherever your school hosts it | Your Canvas hosting region; check it if it is outside Australia |
| Email sign-in codes | The recipient’s email address and the one-time code, via our email provider | We pin sign-in to your directory. That also stops the account-link code a teacher’s first Canvas launch would otherwise email |
| Sign-in with Google | Account ID, name, email and profile picture, to Google | Pin to Microsoft Entra instead, which uses your own tenant |
| Teacher’s connected AI assistant, or other tools users connect | Session data the teacher can see, to a vendor they chose. Includes names unless redacted | Switch off for your school. Redaction alone does not keep content in Australia |
| Error monitoring | Masked session replays recording clicks and navigation | Cannot be switched off per school |
| Product analytics | Usage activity against a pseudonymous account ID, never a name or email | Where configured; we switch it off on request |
| Nurture staff access | Authorised staff in Ireland may view data for support, monitoring and security, debugging and maintenance, incident response, reporting, service administration and legal or compliance obligations, the purposes our DPA permits. Nothing is stored outside Australia | Contractual and technical controls |
If your requirement is that no one outside Australia may see student data, raise it early — that is a different question from where data is hosted. The full provider list is the sub-processor register.
5. Lawful basis and the DPA
Your school decides its lawful basis and gives students and families notice, including any consent its policy requires. Nurture processes data on your instructions under our Data Processing Agreement; a signed copy is available on request.
The DPA’s processing details (Appendix 1) cover both Signal and Nurture Assessments.
Residency in the agreement. Section 12 commits Nurture to storing account information and customer data in Australia for Australian deployments, and names the exceptions set out in section 4: sign-in; error monitoring and product analytics, configured to exclude names, email addresses and session content; tools users choose to connect; remote access by our staff; and application hosting on Vercel, where your deployment runs there. We confirm in writing how your deployment is configured.
6. Risks and controls
| Risk | Control |
|---|---|
| Data leaving Australia | Australian deployment with Australian AI. Exceptions are in section 4, including paths that are not sub-processors: your own Canvas, a teacher’s connected assistant and our staff’s remote access |
| Outsiders joining a session | Turn off guests and restrict joining to your email domains, enforced server-side. Teachers cannot override either |
| Canvas data exchange | Only if installed. You choose the launch claims; Signal does not read the course roster; over LTI the only write is Signal’s own score. Signal uses the Canvas API token to read the course’s assignment list and change only its own assignments (section 3) |
| Sensitive information in free text or uploads | Not filtered. Hosts can switch off comments, questions and replies per session, comments are private to the host by default, and hosts can remove contributions. Brief staff to keep student details out of session content and uploads, or leave grounding off |
| A student seeing another’s response | Comments are private by default. Presenter view hides names and holds results back |
| Inappropriate content | Hosts can mute or remove a participant, pause or end a session, and switch comments and reactions off |
| Student identity reaching an AI provider | Signal’s own AI sends no identity fields, but names typed into text or uploads go with them. A connected assistant receives names unless redacted, or can be switched off |
| Student data used to train AI | The providers Signal uses do not train on school data. A connected assistant follows its vendor’s terms — switch it off or assess those vendors |
| Automated decisions | AI marking and guess flags are aids; the teacher decides. No decision with legal or similarly significant effect is automated |
| Data kept after you leave | Deleted or returned within 30 days of the agreement ending, subject to the exceptions in section 8 |
| Unreported breach | Incident and AI-incident response plans, and notification under the Notifiable Data Breaches scheme |
7. Security measures
- Encryption in transit (TLS 1.3) and at rest (AES-256).
- Passwordless sign-in, and single sign-on with your directory.
- Least-privilege access, enforced in the database as well as the application.
- Logging, monitoring and security review.
- Patch management, secure development, incident response and disaster recovery plans, published in the Security Centre.
8. Retention and deletion
Account and session data are kept while needed to provide the service, and technical logs for a limited period. Under section 10 of our DPA:
- On request: we delete or de-identify requested data within 30 days of a verified request.
- On termination: we delete or return your data within 30 days, without your having to ask.
Both are subject to legal, security, audit and backup exceptions. Deleting a curriculum document stops it being used immediately; its stored copies are erased through a deletion request.
9. Individual rights
Send access or correction requests to support@gonurture.com. Where your school controls the workspace, we route them through your administrator. Unresolved complaints can go to the Office of the Australian Information Commissioner.
10. Certification
Nurture holds the Safer Technologies 4 Schools (ST4S) 2022.1 badge. The current framework’s AI module did not yet cover products like ours, so we remain in the pool for reassessment. We hold no other formal security certification; our infrastructure providers operate SOC 2 Type II and ISO 27001 aligned environments.
11. Contact
- Information Security Manager: Daniel Paul — daniel@gonurture.com
- Privacy: support@gonurture.com (Attn: Privacy)
We are happy to complete your own DPIA, PIA or vendor assessment template, or to join a call with your ICT and data protection leads.