For data protection officers and school leaders. Last updated: 18 August 2026. This page states facts about how the service handles data so your school can make its own assessment; it is a summary of, not a substitute for, our privacy policy.
Is It AI? screens a piece of writing for patterns associated with AI-generated text and returns an AI-pattern score with flagged passages and reasons. Results are screening signals for a teacher to weigh alongside their own knowledge of the student; they are never proof that a student used AI, and we say so on the result itself. Our measured error rates and their limits are published on the methodology page.
When a teacher scans student work, the school remains the data controller for that work. The tables below set out exactly what we receive, where it goes and how long anything is kept, so that assessment can be made on facts.
| Data | Recipient | Purpose | Retention |
|---|---|---|---|
| Submitted text (which may be student work) | Anthropic (Claude API), plus our own servers in memory | AI-pattern analysis during the scan | Transient. Held in memory for the duration of the scan, then discarded. We store no copy, in whole or in part. Anthropic processes it under its API data policy, which does not use API inputs to train models by default |
| Scan record (scan type, result, score, date) | Our database (Prisma Postgres) | Scan history, CSV and PDF export for account holders. Contains no words from the submission | Until the account is deleted |
| Content fingerprint: a one-way SHA-256 hash of the normalised text, with scores and flagged-passage character positions | Our database (Prisma Postgres) | De-duplication, so thirty scans of the same essay bill as one. The record contains no words from the text and the text cannot be reconstructed from it | 24 hours |
| Account data (email, name, password) | Our database (Prisma Postgres) | Authentication and account management; passwords are bcrypt-hashed | Until the account is deleted |
| IP address, as a one-way SHA-256 hash | Our database (Prisma Postgres) | Rate limiting for anonymous scans; the full IP is not stored | 24 hours |
| Payment details | Stripe | Billing. We never see full card details, and Stripe never receives submitted text | Per Stripe's policy; our payment records, 7 years (legal requirement) |
| Email address, for transactional email | Resend | Welcome, password reset and billing emails. Emails never contain submitted text | For delivery of each message |
A detection result is a screening signal, never proof, and any school policy built on it should say the same. The JCQ's guidance on AI in assessments points towards process a student can see and answer: our results show which passages were flagged and why, so a conversation with the student starts from something both sides can read, and a decision never rests on a bare percentage. How the scores are produced, and the measured error rates behind them, are published on the methodology page.
Questions from a DPO, or a request for anything above in writing for your records: hello@isitai.co.uk. The full policy is at isitai.co.uk/privacy.