Legal
Folio privacy policy
How PaperTrail Folio handles the personal information of the students, teachers and others at the schools that use it.
1. Who we are, and what this policy covers
PaperTrail Folio (“Folio”) is made by PaperTrail Academic, a sole proprietorship operated by Michael Smith (“we”, “us”). This policy covers the Folio application at folio.papertrailacademic.com, the Folio demo, and these Folio pages.
PaperTrail’s other products (its academic-integrity tools for teachers) have their own privacy policy. Folio is a separate product with a separate database, and nothing is shared between them.
2. Your school is in charge of your information
Folio is used by schools. The school decides who is in Folio and what is recorded there, so the school is the controller of that information. We are the processor: we hold and handle it only to run Folio for the school, under an agreement with the school and on its instructions.
If you are a student, a parent or a member of staff, your school is the first place to go with a question about your information. If you write to us instead, we will pass your request to your school and help it answer.
3. What Folio holds
About everyone who signs in
- Name, school email address and role at the school.
- When you sign in with Google, Google tells us your name, email address and profile picture. Folio uses these to recognise you and match you to your school’s records. It does not read your email, files or calendar.
- A record of what you did in Folio and when (for example, that a mark was released or a file was handed in), kept so the school has a history of its records.
- Your settings, such as when you want the weekly CAS summary.
About students
- Year group, courses and classes, the student’s IB candidate session number and personal code if the school records them, and whether the student has left the school.
- Work for the Diploma Programme: CAS experiences, typed and spoken reflections, and evidence (photos, video, audio, documents and links); the Extended Essay’s research question, notes, research log, final essay and reflective statement; TOK and internal assessment work; and the declarations the student makes about it.
- What teachers and supervisors record about that work: marks, comments, justifications, reflection-session records, predicted grades, and the school’s final IB results if the coordinator enters them.
- For a student who transfers in, the records and files from the previous school that the coordinator adds.
- The avatar the student chooses.
About others
- Outside CAS supervisors: the name and email address a student enters for them, and their sign-off and comment.
- Ask Folio (only if the school switches it on): the questions a person asks and the answers given.
“Report a problem” and “Make a suggestion” send an email to us. They are not stored in Folio.
4. How it is used
We use this information only to provide Folio to the school: to show each person the records they are allowed to see, to send the emails Folio sends, to make the files and forms the school sends to the IB, to keep Folio secure, and to fix problems.
We do not sell personal information, show advertising, build profiles of students for any other purpose, use it to market to students, or use it to train AI models.
Folio does not judge whether work was written with AI. Marks and comments are the judgement of the school’s teachers.
5. Students under 18
Most students who use Folio are under 18. Students do not sign up for Folio themselves: their school adds them, and is responsible for telling students and parents about Folio and for any consent its laws require. We hold only what the school’s use of Folio needs. Parents do not have Folio accounts; schools share information with parents themselves, for example through Folio’s printable student report.
6. Who else handles it
These companies process information on our behalf to run Folio, under their own data-protection terms:
| Service | What it does | Where |
|---|---|---|
| Supabase | Database, file storage and sign-in | Frankfurt, Germany |
| Vercel | Runs the application | Frankfurt, Germany |
| Sign-in; the weekly copy into the school’s own Shared Drive, if the school uses it | Google’s infrastructure | |
| Resend | Sends Folio’s emails (names and links, never the work) | United States |
| GitHub | Runs the scheduled jobs that make the Drive copy and whole-school exports | United States |
| Anthropic | Answers Ask Folio questions, only if the school switches it on. A student’s question is sent without her name. | United States |
We may also disclose information where the law requires it. If we are asked to, we will tell the school first unless the law forbids it.
7. Where it is stored
Folio’s records and files are stored in Frankfurt, Germany, in the European Union. Some of the services above are in the United States, so some information (email addresses and names in emails, Ask Folio questions, and data passing through the scheduled jobs) is handled there. We rely on those providers’ data-protection agreements for these transfers.
8. How long it is kept
- Records are kept while the school uses Folio, so that its history stays complete. A student who leaves is marked as left; her record is kept for the school.
- A file a student removes from her CAS is erased overnight.
- Whole-school exports are deleted after 14 days.
- Ask Folio questions and answers are deleted after one year.
- When a school stops using Folio, it has 60 days to take a full export, and we then delete its records and files within 90 days of the end. Database backups are kept for 7 days, so deleted information has gone from them 7 days later.
9. Security
Each school’s records are kept apart by the database itself, files are in private storage, and only people the school has added can sign in. We have no standing access to a school’s records; when we need to look, it is read-only, time-limited and shown to the school. The details are on Security & data. If we learn of a breach affecting a school’s information, we will tell the school without undue delay.
10. Your rights
Depending on where you live, you may have the right to see the information held about you, to have it corrected or deleted, or to object to how it is used. Because your school controls your information in Folio, ask your school; we will help it respond. You can also write to us at hello@papertrailacademic.com.
11. Cookies
The Folio application uses only the cookies it needs to keep you signed in. There are no analytics, advertising or tracking cookies, in the application or on these pages.
12. The demo and this website
The Folio demo is an invented school. The email address you type to enter it is not kept and nothing is sent to it, and the demo school is put back as it was every night. Please do not put real student information into the demo.
These pages collect no personal information. The contact form opens an email in your own email app; we receive only what you choose to send. The pages load fonts from Google Fonts.
13. Changes and contact
If we change this policy in a way that matters, we will tell the schools that use Folio before the change takes effect, and update the date above.
Questions: hello@papertrailacademic.com.
This product has been developed independently from and is not endorsed by the International Baccalaureate Organization.