Privacy notice.
How Second Listen uses personal data, written for teachers, school and local authority leaders, and parents.
Last updated 29 October 2026.
Who we are
Second Listen Ltd, registered in Scotland, company number SC903104. Contact: contact@secondlisten.co.uk.
Who is responsible for your data
Second Listen is provided to a whole local authority. When your local authority uses it, the local authority decides how the data is used and is the controller. Second Listen Ltd is its processor: we handle the data only on its instructions, under a written data processing agreement. Questions about how your authority uses Second Listen can go to its data protection officer, or to us and we will pass them on.
For this website, the demo and anything you send to our contact address, Second Listen Ltd is the controller.
What we collect, and why
Teachers
- Your work email and name, so you can sign in and join your school. You sign in with a code sent to your work email; there is no password.
- The lessons you choose to record. The audio is turned into text, the text is read against eight learning and teaching indicators from HGIOS 4 QI 2.3, and you get back a few moments from the lesson with questions to think about. Nothing is scored. If you add them, your learning intention, success criteria and the class’s Curriculum for Excellence level are kept with the lesson so the reading can take them into account.
- Your reflective cycles, the notes you write about something you will try. They are yours alone.
Pupils
Pupils do not use Second Listen and do not have accounts. Their voices are recorded because they are in the room when a teacher records a lesson, and a reflection may quote something a pupil said. Second Listen does not assess, profile or make any decision about a pupil. Schools tell parents and pupils about this before lessons are recorded.
Names are replaced. As soon as a lesson has been turned into text, the names of pupils and staff in it are replaced with labels such as [Pupil A] and [Staff A], before the text is saved or sent to Amazon Web Services. The same name always gets the same label within a lesson, so the reading can still tell two pupils apart. This reduces the risk; it does not remove it. A name the software does not recognise, or one that is not being used to speak to someone, can be missed, and a detail that identifies a child without naming them (a sibling, a street, a health condition said aloud) is not touched. We therefore still treat the text as personal data. The audio itself, which Microsoft turns into text, contains the names as they were spoken.
Sensitive moments are stopped. Teachers agree in the terms of use never to record protected personal data: financial and family details, health, biometric and genetic data, political opinions, sex life, sexual orientation, trade union membership and criminal offence data. As a safety net, the text of each lesson is checked for signs of these, or of a personal disclosure, before anything is saved or sent for analysis. If any is found, the recording is aborted: it and its text are deleted, nothing is analysed, and the teacher is told to follow the school’s child protection procedures if anything worries them. Only the kind of thing found is logged, never the words. Like replacing names, this reduces the risk; it does not remove it.
School and local authority leaders
Your work email and your role, so you can manage who joins your school or authority. Every change of role is logged.
Website visitors
We run no analytics and no advertising. The website loads its fonts from our own domain, so your browser does not contact Google or any other third party. The only cookies we set are the ones needed to keep you signed in, to confirm a sensitive action, or to open the demo, so no cookie banner is needed.
People who contact us
If you email us, we use your address and message to reply. We keep them for as long as we need to deal with what you asked, and no longer than two years.
How a lesson is read
A computer reads the text of each lesson against the eight indicators and picks out moments for the teacher to think about. This is automated, but it makes no decision about anyone. Nothing is scored, graded or ranked; the moments are shown only to the teacher who recorded the lesson; and the teacher decides what, if anything, to do with them. Second Listen never assesses, profiles or makes a decision about a pupil, and never gives leaders a view of an individual teacher.
The reading is done by an AI model running on Amazon Bedrock in London, with Amazon’s zero data retention setting switched on. Suggestions for what to try next come only from a fixed bank of researched teaching approaches; the AI cannot invent a source.
Who can see what
- A teacher’s lessons, reflections and cycles can be seen by that teacher only. Not by school leaders, the local authority, or us through the product.
- School leaders see who has joined their school (names, work emails, join dates) and whole-school figures. Figures appear only once five staff have joined, and they are shares of recorded lessons, never of staff. They also see how many different staff chose each indicator as a focus when recording a lesson, shown only where five or more have, and never who.
- Comparing periods. School leaders can compare these figures by term, by school year and by short “sprints” of up to two weeks that they plan ahead. A period shows figures only when at least five different staff recorded in it and in every part of it, and figures run to the end of the last complete week, so no one person’s lessons can be picked out by comparing periods. Leaders can download the figures as an Excel file; each download is recorded.
- Local authority leads see the same for every school in the authority, and can download the list of schools and staff. They can compare periods across the authority and open a school’s whole-school figures; each time they do, it is recorded, and school leaders are told their local authority can see them. They set the authority’s term dates.
- Second Listen Ltd runs the service and has access to the database to keep it working. We do not read teachers’ lessons or reflections.
Who we share it with
We use five companies to run the service. Each works under a data processing agreement.
| Company | What it does | What it receives | Where |
|---|---|---|---|
| Supabase | Database and storage | Everything we keep | United Kingdom |
| Vercel | Runs the website and service | Requests as they pass through; nothing kept | London |
| Microsoft (Azure AI Speech) | Turns lesson audio into text | The lesson audio. Microsoft keeps none of it: it is processed in memory and not stored, and recording logs are left switched off. We delete our copy as soon as it has been turned into text | United Kingdom (UK South) |
| Amazon Web Services (Amazon Bedrock) | Reads the text against the indicators | The lesson text, with names replaced by labels. Not stored: zero data retention is switched on | United Kingdom (London) |
| Brevo | Sends sign-in codes by email | Your work email and the code | European Economic Area (France and Germany), during the pilot |
Lesson recordings, transcripts and reflections never leave the United Kingdom. During the pilot, sign-in emails are sent through Brevo in the European Economic Area, where UK law allows personal data to be sent without further safeguards. We never sell data, and we don’t use it to train AI models. Microsoft and Amazon process it only to provide their service to us, under their data processing agreements.
What we never do
- Sell, rent or share personal data for anyone else’s purposes.
- Use lessons, reflections or any personal data to train AI models, or allow the companies we use to.
- Use personal data for advertising or marketing.
- Show a school or local authority leader a teacher’s lessons, reflections, cycles, or whether or how often they use Second Listen.
- Put lesson content in an email.
How we keep it safe
- In the UK. Lessons are stored and processed in the United Kingdom, encrypted in transit and at rest.
- No passwords to steal. Staff sign in with a six-digit code sent to their work email. It works once, lasts ten minutes and allows five attempts, and we store only a keyed hash of it.
- Only your authority’s staff. Only email addresses on a licensed local authority’s own domains are accepted, and this is checked on every request.
- A fresh check for sensitive actions. Downloading a staff list, changing roles or deleting a recording needs a new code. Anyone can sign out of all their devices at once.
- Less to lose. Audio is deleted within seconds, the transcript as soon as the lesson is read, and names are replaced before text is saved or analysed. A daily job deletes everything that has passed its time limit.
- Limited access for us. Only Second Listen’s administrator can reach the database, through an account protected by multi-factor authentication, and does not use it to read teachers’ content.
- Checked on every change. Automated tests check that personal data can reach only the companies listed above, in the places listed.
If personal data is ever lost or exposed, we will tell the local authority straight away and help it decide who else needs to be told, including the Information Commissioner’s Office and anyone affected.
How long we keep it
| Data | How long |
|---|---|
| Lesson audio | Seconds. Deleted as soon as it has been turned into text. |
| Lesson text (transcript) | Deleted from our database as soon as the lesson has been read, usually within a minute or two. Amazon keeps no copy: we have switched on Amazon Bedrock’s zero data retention setting for London, so the text is not stored once the reading is done. The one exception Amazon describes is content its automated systems flag as child sexual abuse material. |
| The moments from a lesson | 14 days. Up to six weeks if the teacher starts a reflective cycle from that lesson, so it can be looked back on and exported. |
| Reflective cycles | Until the teacher deletes them. |
| Sign-in codes | Ten minutes to use; deleted from our records after a day. Brevo keeps a log of each email, including the address it went to, for one month. |
| Accounts, school membership and roles | While your local authority uses Second Listen. When it stops, see below. |
| The log of role changes and staff-list downloads | While your local authority uses Second Listen. |
| Failed sign-in attempts | 30 days, recorded without storing your network address itself. |
| Emails you send us | As long as we need to deal with them, and no longer than two years. |
| Whole-school figures | Kept, because they are counts, not personal data. |
When a local authority stops using Second Listen
Its staff can no longer sign in. We return its data to it, or delete it, as it chooses, within 30 days, and confirm in writing when that is done. Copies in backups are put beyond use straight away and deleted in the normal backup cycle. Whole-school figures are counts that cannot identify anyone, so they are kept unless the authority asks us to delete them.
Lawful basis
Your local authority, as controller, decides the lawful basis. We expect it to be public task: supporting teaching and learning and professional learning in its schools. Using Second Listen is a teacher’s own choice: no one is required by law or by contract to record a lesson, and nothing about whether or how a teacher uses it is shown to anyone else.
For this website, the demo and messages sent to us, where we are the controller, we rely on legitimate interests: running our website and replying to people who contact us.
Your rights
You can ask to see the data held about you, to have it corrected or deleted, to restrict how it is used, or object to its use. Teachers can delete their own reflective cycles at any time. For anything else, contact your local authority’s data protection officer or us at contact@secondlisten.co.uk, and we will respond within one month.
Parents who have a concern about lessons being recorded should speak to the school first.
If you are unhappy with how your data has been handled, you can complain to your local authority or to us. We will acknowledge a complaint within 30 days and respond without undue delay.
You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, though we would like the chance to help first.
Changes to this notice
We will update this page when anything here changes, and change the date at the top. See also questions and answers.