Privacy Position Paper — Cuevela pilot

1. What the product does

Cuevela is a voice-first training platform for school safeguarding leads. It simulates safeguarding conversations with an artificial child persona so staff can practise responding to disclosures. It is a training product, not a live safeguarding tool. No real children are involved. No real safeguarding decisions are made.

2. Data subjects

• Staff members (DSLs, deputy DSLs) employed by the subscribing school
• The artificial personas are fictional — they may be inspired by real scenarios but are not identifiable as real individuals

3. Lawful basis

Contract — the school purchases the training service under a contractual agreement. Processing staff session data is necessary to deliver the contracted service (training, assessment, review).

4. Data categories processed

| Category | Description | Retention | Contains PII | |----------|-------------|-----------|-------------| | Trainee audio | Voice recordings of staff during practice sessions | 14 days | Yes (voice) | | Transcripts | Text transcriptions of trainee speech | 12 months | Yes (speech content) | | Structured traces | Interaction events, evaluation records, pathway statuses | 12 months | Minimal (user ID only) | | Persona text | AI-generated responses from the fictional child persona | 12 months | No (fictional) | | Assessment artefacts | Generated session summaries, strengths/concerns | 12 months | Minimal (user ID only) | | Written feedback | Trainee free-text problem reports / improvement requests | 12 months | Yes (free-text may contain PII) | | Completion + competency record | Minimised: trainee, competency key, pass/score, completion date | 6 years, then secure deletion (delivery-tool model) | Minimal (user ID + scores) | | Authentication data | Login records, session tokens (hashed), MFA secrets | Session lifetime + 30 days cleanup | Yes (email, IP) | | Audit events | Security/admin action logs | 6 years, then personal fields redacted in place (Art 17(3)(e)) | Yes (user ID, IP) |

5. Third-party processors

| Processor | Role | Data received | DPA status | |-----------|------|--------------|------------| | AWS (eu-west-2) | Infrastructure hosting, database, file storage | All data (encrypted at rest and in transit) | Standard AWS DPA | | OpenAI | LLM persona generation | Scenario context, conversation history, persona state. No evaluation results, pathway statuses, post-actions, or user identifiers | DPA required — check tier | | ElevenLabs | Text-to-speech | Persona response text only. No trainee data | DPA required — check tier | | ElevenLabs Scribe v2 | Speech-to-text (server-side, where used) | Trainee audio (when server-side STT is active) | Covered by ElevenLabs DPA |

All LLM processing is feature-flagged and can be disabled per tenant, falling back to deterministic-only mode with no external data sharing.

6. Security mitigations

• MFA required for admin users (TOTP)
• Revocable server-side sessions with token rotation and replay detection
• Rate-limited login (5 attempts/minute)
• S3 audio storage with SSE-KMS encryption
• RDS encryption at rest (to be confirmed in deployment)
• TLS encryption in transit (to be confirmed in deployment)
• Admin data erasure with audit logging
• Retention enforcement by data class (automated daily job)
• Auth secret startup guard (blocks demo/default credentials)
• Hardened CORS policy
• Per-tenant LLM feature flag (a per-tenant setting; it does not currently provide a global external-AI kill switch, and must not be described as one until decision 61's control ships)

7. Key risks and mitigations

| Risk | Likelihood | Mitigation | |------|-----------|------------| | Staff member enters real safeguarding case data during training | Medium | Terms of use explicitly prohibit this. Platform displays "Training simulation — not for operational safeguarding use" disclaimer. No technical mechanism can fully prevent this. | | LLM provider stores or trains on session data | Low | Use business/enterprise tier with zero-retention DPA. Feature flag allows disabling LLM entirely. | | Unauthorised access to session data | Low | MFA for admins, revocable sessions, role-based access, organisation-scoped data isolation | | Data retained beyond necessity | Low | Automated retention enforcement (14 days audio, 12 months traces). Admin erasure capability. |

8. Data subject rights

• Access: Admin can export session data for a user on request
• Erasure: Admin erasure endpoint deletes all user sessions, traces, audio, and generated outputs. Logged in audit trail.
• Rectification: Not applicable — training data is a record of what happened in the practice session
• Portability: Not applicable for pilot scope
• Objection: Staff can raise with their employer (the data controller). The school decides.

9. Data controller vs processor

• Data controller: The subscribing school (they decide to train their staff using this platform)
• Data processor: Gat3house Ltd, trading as Cuevela (we process data on behalf of the school to deliver the training service)

A Data Processing Agreement between Gat3house Ltd and each subscribing school is required before pilot.

10. Commitment

This is a pilot-scope privacy position paper. A full Data Protection Impact Assessment (DPIA) will be completed before scaling beyond pilot. The DPIA will include a formal risk assessment, consultation with the ICO if required, and detailed technical and organisational measures documentation.

Approved by founder, 2026-04-10.