At a glance
| Term | Summary |
|---|---|
| Controller | The school, trust, college or organisation that holds the Cohort workspace ("you") |
| Processor | Truberri, a trading name of Annarrah Limited ("we") |
| Purpose | Giving your readers interactive books and showing you how they engage and what they answer |
| Where data is stored | UK (London) |
| Breach notice | Without undue delay, and within 48 hours of us becoming aware |
| Deletion after you leave | Within 30 days, after an export window |
This agreement forms part of our terms of service and applies automatically to every Cohort plan. If your organisation needs a countersigned copy, email hello@truberri.com and we'll send one.
1. Parties
Truberri is a trading name of Annarrah Limited (company number 14512520), registered in England and Wales, with its registered office at 853-859 Salisbury House, 29 Finsbury Circus, London, England, EC2M 5QQ. Contact us at hello@truberri.com.
The controller is the organisation that opens the Cohort workspace. The person who accepts the terms confirms they are authorised to do so on its behalf.
2. What we process
| What | Details |
|---|---|
| People | Pupils, students and participants you enrol ("readers"), and your staff who use Truberri Studio |
| Data | Name and email or school-issued sign-in; class membership; answers to questions in books; reading activity (opens, chapters viewed, completion); consent to identified responses; staff names, emails and roles |
| Special category data | Not intended. If a book asks about health, religion or similar topics, you are responsible for having a lawful basis and must tell us |
| Processing | Storing, organising, displaying, summarising (in aggregate) and deleting, as needed to provide the service |
| Duration | For as long as you have a Cohort plan, plus the deletion period in section 9 |
3. Your responsibilities
- Have a lawful basis for enrolling readers and for switching on identified responses.
- Tell readers and, where appropriate, parents or carers how their data is used. Our privacy policy can help.
- Only switch on identified responses for a class when you need to see individual answers to teach or support readers.
- Use your own judgement on safeguarding. Truberri is not a safeguarding system and does not monitor answers.
4. Our responsibilities
We will:
- process personal data only on your documented instructions, which are this agreement and your settings in Truberri Studio, unless the law requires otherwise (in which case we'll tell you first, if we're allowed to)
- make sure everyone who can access the data is bound by confidentiality
- keep the security measures in section 6 in place
- help you respond to readers who exercise their rights, and pass on any request we receive directly
- help you with data protection impact assessments and any consultation with the ICO
- tell you if we believe an instruction breaks data protection law
- never sell the data, use it for advertising, or use it to train AI models
5. Children
- Readers under 13 can only use Truberri through accounts created by their school.
- We follow the ICO's Age Appropriate Design Code: high privacy by default, no nudges to share more, no public profiles, no advertising.
- Individual answers are only visible to your staff when Truberri has approved your workspace, the class has identified responses switched on, and the reader saw and accepted a notice naming who can see their answers.
- Readers can always see, edit, export and delete their own answers.
6. Security
- Data stored in the UK and encrypted at rest and in transit (TLS).
- Access rules enforced in the database (row-level security), tested automatically, so readers can never see each other's answers and staff see only what their role allows.
- Only named roles (owner, admin, analyst) can see individual answers; editors and viewers cannot.
- Book files served through signed links that expire after one hour.
- Payment, AI and service keys kept on our servers, never in apps or browsers.
- Staff access limited to what's needed for support, and logged. Actions taken on behalf of a workspace are recorded in its audit log.
- Regular encrypted backups.
7. Sub-processors
You authorise us to use the sub-processors below. Each is bound by a written contract with data protection terms at least as strong as this agreement. We'll give you at least 30 days' notice by email before adding or replacing one, and you can object. If we can't resolve your objection, you can end your Cohort plan and receive a pro rata refund.
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | UK (London) |
| Stripe | Subscriptions, book sales, payouts and tax | UK, EU and US |
| Anthropic (Claude) | Turning uploaded manuscripts into books and writing theme summaries of 5 or more answers | US |
| Resend | Sign-in links and service emails | EU |
| PostHog | Product analytics | EU (Germany) |
| Sentry | Error reports | EU |
| Google Workspace | Our email inbox | EU and US |
| Cloudflare | Hosting this website | Global network (served from the data centre nearest you) |
Anthropic only receives manuscripts uploaded by your staff and, for theme summaries, written answers from groups of 5 or more readers without names attached.
8. Transfers outside the UK
Where a sub-processor handles data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, plus supplementary measures where needed.
9. Personal data breaches
If we become aware of a breach affecting your data, we'll tell you without undue delay and within 48 hours, with what we know: what happened, the data and people affected, likely consequences and what we're doing about it. We'll keep you updated and help you meet your own duty to notify the ICO and readers.
10. End of the agreement
Return
When your Cohort plan ends you have 30 days to export your aggregates and, where identified responses were on, individual answers.
Deletion
After that we delete your workspace data, including from backups, within 30 days, unless the law requires us to keep it. Readers who also hold their own Truberri accounts keep their own copies of their answers.
11. Audits
We'll give you the information you reasonably need to show we meet this agreement. Once a year, or after a breach, you may audit our compliance on 30 days' notice, during working hours, at your cost, under confidentiality. We'll first try to answer through written questions and documentation.
12. General
If this agreement conflicts with our terms of service, this agreement wins for anything about personal data. Liability under it is subject to the limits in our terms, except where the law doesn't allow that. It is governed by the law of England and Wales.