Purple Mash

Provider statements (checked 25 October 2026): schools use Purple Mash for pupils to complete activities set by teachers and create work (writing, coding, art, blogs and emails inside the platform), for teachers to set and mark tasks and view results in a Data Dashboard, and for subject leaders to plan from the computing scheme of work and curriculum maps. Pupils can use it at school and at home. Staff and pupil accounts are created by MIS sync through Groupcall Xporter or Wonde, by CSV import or manually. Usage, technical and cookie data are collected automatically, and the privacy notice says analytics data is received from providers such as Google based outside the EU. Data is seen by school users according to their role, by parents through the Parent Portal using printed parent codes, by 2Simple as processor and by its subprocessors. The only subprocessor named publicly is Amazon Web Services (hosting); the full list is available on request. Where a school buys the AI add-on, teacher prompts are processed using OpenAI ChatGPT-5. The terms also allow users to publish templates or resources publicly and to submit competition entries, which grants 2Simple a licence to use that content. Not independently verified.

Provider statements: pupils from EYFS to Year 6, school staff and parents (through Parent Portal access). The MIS data scopes the provider asks schools to authorise are: structural school information including headteacher contact details; staff names and work email addresses, with staff home contact details used only where no work email exists; pupil first and last names and gender; pupil UPN and former UPN, used as the unique identifier; and extended pupil information including date of birth, which the provider says it does not currently view. The privacy notice lists identity data including date of birth and educational cohort, plus technical, usage and profile data. Pupil work, in-platform emails and blogs are stored as user data. The provider's sources disagree on special category data: the data protection FAQ says customers' use of 2Simple products does not involve special category data, the privacy notice says 2Simple does not collect it, but the data processing agreement lists 'in limited circumstances, special categories of personal data' among the data processed. No SEN, health or safeguarding fields are described in the MIS scopes, but pupils' free-text work and in-platform emails could contain personal, health or safeguarding disclosures. Not independently verified.

Provider statements: Purple Mash is designed around individual named pupil accounts, and the provider states pupil accounts require a first and last name, with the UPN used to avoid duplicates. Schools choose which data areas to share when setting up Groupcall Xporter, and can toggle individual data scopes on or off in the Wonde portal. The provider says it does not currently use date of birth and only uses staff home contact details where no work email exists, so a school may be able to withhold these scopes. The sources do not explain why pupil gender is needed. The AI terms tell users not to enter any personal data into Purple Mash AI. Ask the provider: Can pupil accounts work with initials or pseudonyms instead of full names? Is gender needed for any feature? Can the school decline the date of birth and staff home contact scopes without losing functionality? Not independently verified.

Provider statements: the User Agreement For All Products (12 August 2026) states the subscribing school is controller and 2Simple is processor. A data processing agreement dated 9 January 2026 is publicly available and covers processing on documented instructions, assistance with data subject requests and DPIAs, breach notification within 48 hours, a general authorisation for subcontractors with the list provided on request, audit at the school's cost and deletion at termination. The privacy notice (16 September 2025) says 2Simple may act as joint controller and/or processor depending on how products are accessed, and the FAQ says it 'usually' acts as processor for pupil, parent and staff data. Points for the school to resolve: (1) the agreement defines data protection law by reference to the EU Data Protection Directive and EU GDPR and does not name UK GDPR or the Data Protection Act 2018, although the FAQ says it contains UK GDPR Article 28 terms; (2) breach notification is 48 hours in the data processing agreement but 72 hours in the product terms; (3) the product terms suggest schools obtain consents and possibly parental consent, so the school should decide its own lawful basis; (4) the subprocessor list is not published. The data protection officer contact given is the general support address. The registered office in the terms (188 Brent Street, London NW4 1BE) matches Companies House (independently checked); the privacy notice gives 2 to 10 Baron Street, London N1 9LL as the postal contact. The ICO fee register was not checked. Not independently verified apart from the Companies House details.

Provider statement: the help article on Purple Mash customer data (last modified 14 July 2025) states Purple Mash servers are hosted with Amazon Web Services in Ireland and that all customer data is held in that data centre, replicated across multiple availability zones. The data protection FAQ (June 2026) says 2Simple uses cloud infrastructure in the European Economic Area and that any transfer outside the UK relies on UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum. The product terms say data will not leave the UK and EEA except under lawful transfer mechanisms, and the data processing agreement requires the school's prior written consent for any restricted international transfer. Not stated: where OpenAI processes Purple Mash AI prompts and outputs, which OpenAI contract terms apply (the AI terms link to OpenAI's general consumer privacy policy), where support and analytics providers process data, and whether any 2Simple staff or subprocessors access data from outside the UK or EEA. Ask the provider: Where are AI prompts and outputs processed and under which transfer safeguard? Which subprocessors process data outside the UK and EEA? For schools under EU GDPR, note the hosting is in Ireland and the data processing agreement refers to EU law. Not independently verified.

Provider statements: the product terms (section 8) say user data, including usernames, saved work, blogs and emails, is deleted within two weeks of a written request from the account holder; 12 months after a subscription ends; 12 months after items are left in, or deleted from, the trash bin; and, for pupils who have left, after a pupil records update moves them to the trash and the 12-month trash period passes. Deleted data stays in backups for up to one month. Templates and resources published publicly remain until the creator asks for removal. Section 7.10 says processing stops at termination and data is deleted, or returned in an agreed format on request subject to advance payment of a reasonable fee. The data processing agreement (clause 12.1) says 2Simple will promptly delete all related personal data on termination and confirm deletion, which sits uneasily with the 12-month period in the terms. The privacy notice says customer billing data is kept for six years and anonymised data may be used indefinitely. The provider's DfE alignment document says Purple Mash AI prompts and outputs are logged, but no retention period for these logs was found. Ask the provider: Which applies at contract end, prompt deletion or 12 months? Can the school have all data deleted immediately at the end of the contract, and is an export available free of charge before then? How long are AI prompt and output logs kept? Not independently verified.

Provider statements: the help article states connections use TLS 1.3 with the AES 256 GCM cipher; staff passwords must be at least seven characters with a number, upper and lower case letters, and are hashed with Argon2 and a random salt; server and database access is through a VPN and limited to three 2Simple employees; access to the administration site is restricted; and all access to customer data is logged. The FAQ lists encryption in transit, access controls, secure authentication, monitoring, backups, vulnerability management, secure development, staff training and incident response. Single sign-on is available with Microsoft 365, Google and Apple accounts, and through a Microsoft Teams app. The website displays a Cyber Essentials Plus logo, but no certificate number or expiry date is published and the IASME register was not checked, so the certification is not verified. Breach notification is 48 hours (data processing agreement) or 72 hours (product terms). Not stated: encryption at rest, multi-factor authentication for staff or admin accounts, the password policy for pupil accounts, penetration testing, and whether the school can view audit logs. Ask the provider: Is data encrypted at rest? Can MFA be required for admin and staff accounts? How are pupil logins protected? Can you supply your Cyber Essentials Plus certificate number and latest penetration test summary? Not independently verified.

Provider statements (checked 25 October 2026): Purple Mash AI is an optional paid add-on, restricted to staff accounts; pupils cannot use it. It generates quiz questions in 2Quiz and writing prompts and scaffolds in 2Publish using a model the provider names as OpenAI ChatGPT-5. The FAQ states nothing entered into or produced by Purple Mash AI is used to train or improve the model, that no student data, quiz answers or teacher content is sent back to OpenAI or used for training, and that AI is not used to mark pupil work. The AI terms tell users not to enter any personal data and say outputs may be biased or inaccurate and must be reviewed by teachers. The provider's DfE alignment self-assessment says prompts and responses are logged and reviewed by 2Simple to refine prompts and filtering. Not stated: whether OpenAI retains prompts or outputs (for example for abuse monitoring) and for how long, whether OpenAI is a contracted subprocessor under business terms (the AI terms link to OpenAI's general consumer privacy policy), how long 2Simple keeps AI logs, and which other 2Simple products include the Microsoft and ChatGPT functionality mentioned in the privacy notice. Without the add-on, no AI features were found in Purple Mash itself. Ask the provider: Is OpenAI engaged under API or enterprise terms with zero or limited data retention? How long do OpenAI and 2Simple keep prompts and outputs? Does any Microsoft or AI functionality operate in the base Purple Mash product? Not independently verified.

Provider statements: Purple Mash includes self-marking quizzes and activities and built-in assessment tools, with results shown to teachers in a Data Dashboard. These support teacher judgement; no automated decision-making with legal or similarly significant effects on pupils was found in the sources, and the provider states AI is not used for marking. The privacy notice describes using identity, contact, technical, usage and profile data to form a view of what products may interest 'you' for marketing; the FAQ says pupil, learner and classroom data is not used for advertising or marketing profiling. It is not stated whether staff account usage data is used for marketing recommendations. Schools should treat Data Dashboard results as one source of assessment evidence reviewed by teachers. Ask the provider: Is any staff or pupil usage data within school accounts used for marketing or product recommendations? Not independently verified.

Provider statements: the privacy notice is written for adult customers and users and sets out access, correction, erasure, objection, restriction and portability rights, with a one-month response target. No child-friendly privacy information for pupils was found. The data processing agreement commits 2Simple to notify the school promptly of data subject requests it receives and to assist with them. The product terms allow deletion of user data within two weeks of a written request, and return of data at contract end in an agreed format subject to a reasonable fee. The FAQ says 2Simple considers the ICO Children's Code. The sources do not describe how a school can export a pupil's full work and account data to answer a subject access request. Schools should name 2Simple as a processor in their pupil and staff privacy notices and explain the Parent Portal to parents. Ask the provider: How can the school export all data held about one pupil, including emails and blogs, for a subject access request? Is age-appropriate privacy information available for pupils? Not independently verified.

Risks specific to school use, based on the sources above: (1) Pupil free text: in-platform emails, blogs and written work may contain personal or safeguarding disclosures. Safeguard: confirm who can read pupil emails and blogs, include Purple Mash in online safety and safeguarding procedures, and make sure staff know to pass concerns to the DSL. (2) Special category data: provider documents contradict each other. Safeguard: get written confirmation and tell staff not to record health, SEN or safeguarding details in Purple Mash. (3) Retention after leaving: data is kept 12 months after a subscription ends and leavers remain until a records update and the trash period pass. Safeguard: run the MIS sync each term and request written deletion at contract end. (4) AI add-on: teachers might enter pupil names or details in prompts that go to OpenAI. Safeguard: staff guidance, and obtain answers on OpenAI retention and location before enabling. (5) Public sharing: users can publish templates and resources publicly, and pupils' work can be shared. Safeguard: check sharing settings and require that pupil names are not included. (6) Unnecessary MIS fields: staff home emails and pupil dates of birth can be shared. Safeguard: decline scopes that are not needed. (7) Contract terms: automatic renewal with a short notice window, no refunds, liability capped at 12 months' fees and exclusion of losses from regulatory penalties for data breaches. Safeguard: diarise the renewal date and factor the caps into the risk assessment. (8) Data processing agreement wording refers to EU law and conflicts with the terms on breach timing and deletion. Safeguard: ask for a UK GDPR specific agreement or written clarification. (9) Parent Portal codes: lost or shared letters could expose a child's work. Safeguard: control distribution and know how to reset codes.

For the school's data protection lead: the provider's FAQ states that a DPIA would not normally be required because special category data is not processed. That is the provider's view, and its own data processing agreement says special category data may be processed in limited circumstances. Purple Mash creates named accounts for every pupil, stores their work and communications, and the AI add-on involves a third-party AI service, so the school should carry out its own DPIA screening and may decide a full DPIA is appropriate, particularly if the AI add-on is used. Questions to resolve with the provider before use: (1) Is 2Simple a processor or joint controller for Purple Mash data, and does the data processing agreement apply under UK GDPR? (2) Is special category data ever processed? (3) Please supply the current subprocessor list, including OpenAI and any support or analytics providers, with locations and transfer safeguards. (4) Which applies at contract end: prompt deletion or deletion after 12 months? Is a free full export available? (5) Is breach notification 48 or 72 hours? (6) Is data encrypted at rest, and can MFA be enforced for staff and admins? (7) Can pupil accounts use pseudonyms, and can gender, date of birth and staff home email scopes be withheld? (8) How long do OpenAI and 2Simple keep AI prompts and outputs, and under which OpenAI terms? (9) Can you provide your Cyber Essentials Plus certificate number? (10) How can the school export all data about one pupil for a subject access request?