Log in
I am a student
New to YouHue? Ask your teacher for help
I am an educator
Don’t have an account? Sign up
YouHue is a daily wellbeing check-in service for schools. It is provided by YouHue FZ-LLC, 195, Ground Floor, Building 5, Dubai Media City, P.O. Box 73030, Dubai, United Arab Emirates ("YouHue", "we", "us").
This policy explains what personal information we collect, how we use and protect it, who we share it with, how long we keep it, and the choices and rights people have. It applies to students, school staff, and parents and carers who use YouHue, and to visitors to our website.
We follow the privacy laws that apply where our schools are, including the UK GDPR and Data Protection Act 2018, the EU GDPR, Australia's Privacy Act 1988 (including the Australian Privacy Principles), New Zealand's Privacy Act 2020, and US student-privacy laws including COPPA and FERPA.
The school is the controller. When a school uses YouHue, the school is the controller of the personal information about its students, staff and families ("school data"), and YouHue is its processor. We use school data only to provide YouHue to the school, on the school's instructions and under our agreement with the school.
The school owns its data. We never sell school data, never use it for advertising, and never build profiles of students except to provide YouHue to their school.
Data we control. YouHue is the controller only of the information we collect for our own purposes: for example, website visitors, people who contact us, our marketing to school staff, and payments for teacher purchases.
Data processing agreements. A data processing agreement (DPA) is available to every school. We offer a standard DPA for UK and EU schools (written to UK GDPR Article 28) and for US schools, and we review school-issued DPAs on request. Where a DPA conflicts with this policy, the DPA prevails.
About students. From the school, and from students as they use YouHue: their name (first and last name, first name and last initial, or initials, as the school chooses); their email address, if they sign in with Google; their class and grade or year level; their check-ins, meaning the mood chosen, mood tags, any written reflection, and the date and time; and information the service produces about check-ins, such as sentiment, themes, alerts and insights ("AI outputs").
About school staff. Name, work email address, password (stored securely, never in readable form), role, school details, the document a staff member provides to verify their role, and account activity.
About parents and carers. Their answers to family questionnaires, if the school uses them.
Sensitive information. A student's written reflections may reveal information about their health or wellbeing. We treat them as sensitive ("special category") information and protect them accordingly.
From other systems. If the school connects YouHue to Clever, Wonde (MyLogin) or ManageBac+, we receive the class lists and account details the school chooses to share through that connection.
On our website. Analytics about how our website is used, collected without cookies (Plausible Analytics), and the details people give us when they contact us or book a demo.
We collect only what we need to provide YouHue. People can choose not to give some information, but students and staff can't use YouHue without an account, and a check-in can't be recorded without a mood.
We collect personal information from the school, when it sets up classes and accounts, directly or through a connected system (Clever, Wonde/MyLogin or ManageBac+); from students, staff and families, as they use YouHue; and automatically, through the service and our website, for example account activity and error reports.
To provide YouHue. Check-ins, class and school views, reports, and short supportive responses shown to students after a check-in.
To support student safety. Routing possible safety concerns to the school's designated staff, quickly.
To give schools insight. Producing insights, including monthly insights, for teachers and school leaders.
To run the service. Securing, supporting and maintaining the service, and fixing errors.
To keep the service safe and accurate. This includes reviewing missed or mistaken safety alerts and refining the instructions we give our AI systems. We never train or fine-tune any AI model on school data.
To communicate with school staff. About their accounts and the service and, where allowed, about YouHue updates. Staff can opt out of marketing emails at any time.
To take payments. Processing payments for teacher purchases.
To meet our legal obligations.
No decision about a student is made solely by automated processing. AI outputs support school staff, who decide what to do. YouHue doesn't diagnose and isn't a clinical or emergency service.
Providers. We use Google (Gemini) to analyse check-in reflections for sentiment, themes and possible safety concerns, and to generate reports, suggestions and supportive responses. We use Anthropic (Claude) to generate monthly insights. Both process data in the United States.
What is sent. Before any AI processing, each student's account details are replaced with a random token. The reflection is sent as written, with the mood and grade level, so it is pseudonymised, not anonymised. Family questionnaire answers are processed in the same way. Names are put back only inside the school's dashboard, and the AI is not allowed to write a name back.
No training. The AI providers do not use this data to train or improve their models.
Retention by providers. Anthropic does not store our prompts or responses after the response is returned (zero data retention), except where the law or misuse detection requires it. Google may keep prompts and responses for a limited period, solely to detect misuse, as its terms allow.
Human oversight. Safety alerts go to the school's designated staff, who decide what to do. We review missed and mistaken alerts to improve accuracy.
We share personal information only with the school that controls it; with our sub-processors (section 8), only as needed to provide the service and under written contracts that protect the data at least as well as our DPA; when the law, or a court or tribunal order, requires or authorises it, or where privacy law permits it (for example, to lessen a serious threat to someone's life, health or safety); or with the consent of the person concerned or, for students, of the school.
We do not share, publish or give access to user data, including de-identified or aggregated data, for advertising, market research or similar purposes. If YouHue's business is sold or merged, school data stays protected by this policy and the schools' agreements, and schools will be told in advance.
These are the third parties that process personal information for us. Those that handle school data process it in the United States; the website services listed last process website-visitor data only.
Amazon Web Services (aws.amazon.com). Purpose: hosting and storage. Data: all service data. Location: United States (US East, Virginia).
Google, Gemini (cloud.google.com). Purpose: AI analysis of check-ins, including safety checks, sentiment, themes, reports, suggestions and supportive responses. Data: pseudonymised reflections, mood, grade level and family questionnaire answers. Location: United States.
Anthropic (anthropic.com). Purpose: AI generation of monthly insights. Data: pseudonymised check-in data. Location: United States.
Twilio SendGrid (sendgrid.com). Purpose: transactional and notification email. Data: staff names and email addresses, and notification content. Location: United States.
Loops (loops.so). Purpose: email to staff users. Data: staff names, email addresses, school and plan. Location: United States.
Intercom (intercom.com). Purpose: customer support and help centre. Data: staff contact details and support conversations. Location: United States.
Stripe (stripe.com). Purpose: payments for teacher purchases. Data: purchaser name, email and payment details; YouHue doesn't store card numbers. Location: United States.
Sentry (sentry.io). Purpose: error and performance monitoring. Data: technical data and limited account identifiers. Location: United States.
Google Workspace (workspace.google.com). Purpose: company email and file storage, where a school shares data with YouHue by email or file. Data: whatever the school sends. Location: United States.
Webflow (webflow.com). Purpose: hosting our website and receiving the forms on it. Data: what a visitor enters in a website form, and standard web server data. Location: United States.
Zapier (zapier.com). Purpose: passing website form submissions to our systems. Data: website form submissions. Location: United States.
Cloudflare (cloudflare.com). Purpose: spam protection on our website forms (Turnstile) and hosting of the self-guided tour. Data: IP address, browser and device data, and the spam-check result. Location: Cloudflare's global network.
Plausible Analytics (plausible.io), provided by Plausible Insights OÜ, Estonia. Purpose: website analytics. Data: page views, referrer, browser, device type and country, collected without cookies. Location: European Union.
School integrations. Schools may also connect YouHue to Clever, Wonde (MyLogin) or ManageBac+ (Faria). These are the school's own integration providers. They pass class lists and account details to YouHue, which we use only under the school's instructions.
Lawful basis. For school data, we process as the school's processor, and the school determines the lawful basis (usually public task or legitimate interests, with explicit safeguards for special category data). For data we control, our lawful bases are contract, legitimate interests or consent, as applicable.
Changes to sub-processors. We notify schools at least 30 days before adding or replacing a sub-processor, and schools may object on reasonable data protection grounds, as set out in our DPA.
Where data is. School data is hosted with Amazon Web Services in the United States (US East, Virginia). YouHue FZ-LLC operates from the United Arab Emirates. Our AI providers and other sub-processors process data in the United States. The services that run our public website process website-visitor data where they operate, including outside the United States, as listed in section 8. Personal information is therefore likely to be disclosed to recipients in the United States and the United Arab Emirates.
UK schools. Transfers use the International Data Transfer Agreement issued by the Information Commissioner's Office, signed with the school's DPA.
EU schools. Transfers use the European Commission's Standard Contractual Clauses.
Onward transfers. Each sub-processor's data processing terms include an approved transfer mechanism.
Australian and New Zealand schools. We take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles and New Zealand's Information Privacy Principles.
Advance notice. We will tell schools in advance before hosting moves to, or expands into, another country, or before anyone in a new country gains access to unencrypted school data.
While a school's account is active. School data is kept, and check-ins and student profiles carry over from one school year to the next.
Inactive accounts. Accounts with no activity for 12 months are deleted.
Deletion requests. We delete school data within 48 hours of confirming a school's deletion request.
When a school leaves. At the school's choice, we return its data in a commonly used format and then delete it, or simply delete it. Deletion is completed within 30 days after the service ends, and we confirm it in writing on request. Backup copies are deleted when they expire under our normal backup cycle and aren't used in the meantime.
Data we control. Information such as staff marketing contacts and payment records is kept only as long as needed for its purpose or as the law requires.
We protect personal information with encryption in transit and at rest, pseudonymisation of student identities before any AI processing, access to school data limited to the YouHue staff who need it and protected by two-factor sign-in and access logging, regular backups, and a written incident response plan. We are strengthening these protections with background checks and annual security, privacy and online-safety training for staff with access to school data, regular vulnerability scanning, and independent penetration testing.
If a personal data breach affects a school's data, we notify the school without undue delay, and in any event within 48 hours of becoming aware of it. We tell the school what happened, who and what was affected, the likely consequences, and what we are doing about it. We help the school meet its own notification duties, and we notify regulators where the law requires.
Students use YouHue only through their school. The school decides to use YouHue and is responsible for giving students and families the information and any consents the law requires, including about our use of AI. Where US law allows, schools may give consent on parents' behalf for use within the school, as COPPA permits. We don't show advertising to students, and we don't allow students to be contacted by anyone outside their school through YouHue.
Students, parents and carers. Please contact the school first. It controls school data and can see, correct or delete it. If you contact us directly, we will pass your request to the school and help it respond.
Schools and school staff. You can ask us at any time for a copy of your data, to correct it, or to delete it, free of charge. We respond to all requests within 7 business days and resolve them as quickly as possible, and in any event within the time the law requires.
Other rights. Depending on where you live, you may have further rights, such as to restrict or object to processing, or to data portability.
Privacy contact. Our Privacy Officer, Ammar Khan, at privacy@youhue.com, or by post to the address in section 1.
How we handle complaints. We acknowledge complaints within 7 business days, investigate them, and give a written response with the outcome and any action taken.
If you are not satisfied. You can complain to your privacy regulator: in the UK, the Information Commissioner's Office (ico.org.uk); in Australia, the Office of the Australian Information Commissioner (oaic.gov.au); in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz); in the EU, your local data protection authority.
We review this policy at least once a year, and whenever our practices change. We will notify schools at least 30 days before a material change takes effect, by email to school administrators and in the product, and ask them to review it. The version number and date at the top show the latest version, and previous versions are available on request.
