Updated 14 days ago
Company Context#
This document captures Springpod's values, constraints, and policies that shape how we build AI tools.
About Springpod#
Industry: EdTech — virtual work experience and careers education platform
What we do: Springpod connects young people (ages 13+) with virtual work experience, career insights, and employer partnerships. Our platform serves students, schools, and employers across the UK and US.
Primary AI use cases: Internal dashboards, student engagement tools, content generation, employer reporting, AI-powered interview skills coach, automated assessment aids, curriculum content tools
Company values that affect how we build#
These principles guide our work and are referenced throughout the framework when making build decisions.
- Student safety and wellbeing come before speed of delivery
- Democratise access — remove barriers of geography, cost, and connections
- Measurable impact — every feature must demonstrate real outcomes
- Move fast on internal tools, carefully on anything student-facing (ages 13+)
- Data minimisation — collect only what we strictly need
Constraints#
These are the hard limits on what we can build and how we can build it.
- All student data must comply with UK GDPR and Data Protection Act 2018
- No tools that process under-18 data may use unapproved third-party services
- Student-facing tools must meet WCAG AA accessibility standards
- No behavioural profiling or recommendation algorithms on student data without explicit review
- All tools must work on school-issued devices (Chromebooks, iPads, locked-down browsers)
Compliance requirements#
| Regulation | Applies? | Notes |
|---|---|---|
| UK GDPR | Yes | All personal data processing |
| Data Protection Act 2018 | Yes | Primary UK legislation, statutory basis for the Children's Code |
| ICO Children's Code | Yes | 15 standards for online services accessed by under-18s. Enforceable — up to 4% global turnover |
| Data (Use and Access) Act 2025 | Yes | Amends UK GDPR. Introduces EdTech-specific code of practice (ICO, expected Spring 2026) |
| PECR | Yes | Electronic communications to students, parents, and schools |
| Online Safety Act 2023 | Likely | Applies if any user-generated content or search features. Up to 10% global revenue |
| Equality Act 2010 | Yes | Digital accessibility — WCAG 2.2 AA is the benchmark for "reasonable adjustments" |
| EU AI Act | Conditional | Extraterritorial — applies if any EU users. Education AI is high-risk. Deadline: August 2026 |
| DfE AI Safety Standards | Yes | Generative AI product safety expectations for EdTech. Referenced by KCSIE 2025 |
| KCSIE 2025 | Indirectly | Schools must ensure EdTech meets filtering, monitoring, and safeguarding requirements |
| Gatsby Benchmarks | Yes | Platform aligned to 8 Gatsby career education benchmarks (updated Sept 2025) |
For the full regulatory reference with detailed requirements, see Regulatory Reference.
AI policy#
- AI-assisted development is encouraged for all build paths
- AI-generated content that students see must be human-reviewed before publication
- The AI-Powered Interview Skills Coach is an approved student-facing AI feature (see Prompt Library)
- AI models processing student data must be approved by the Data team
- Student-facing AI features must disclose AI involvement with age-appropriate language (e.g., "This feedback was created with the help of AI")
- No AI-generated content may make promises about career outcomes
Data classification#
| Classification | Description | Example | Build path |
|---|---|---|---|
| Public | No restriction | Marketing content, blog posts, public programme listings | Green |
| Internal | Business use only | Staff directories, internal metrics, employer pipeline data, team dashboards | Yellow |
| Confidential | Restricted access | Financial data, HR records, partnership agreements, employer contracts | Orange |
| Protected | Highest protection | Student personal data, under-18 data, school records, health/SEND information | Red |
Keeping this current#
This document should be reviewed at least once a year or whenever company policies, compliance requirements, or AI practices change. Key triggers for an update include:
- New regulatory requirements or market expansions (e.g., entering new markets may trigger additional regulatory obligations)
- Changes to the approved AI model list or data processing agreements
- Updates to the Springpod data classification scheme
- New student-facing AI features being approved or retired
- Changes to the ICO registration or data protection impact assessments
Related documents#
- Approved Tools — which tools your team can use
- Roles — who reviews and approves at each level
- Branding Standard — Springpod's visual and voice identity guidelines
Was this page helpful?