Writ for Schools — Agreement & DPA

Service Agreement

1. Parties and structure

This agreement is between Writ ("Writ", "we") and the school or college named on the order form ("the School"). It consists of these terms, the order form (naming the cohort size, cycle year, fee, and the School's nominated head of UCAS), and the Data Processing Addendum below. If the documents conflict, the order form prevails, then the DPA, then these terms.

2. The service

Writ provides (a) each enrolled student full access to the Writ UCAS personal statement coach for the licensed cycle; (b) a school console for the School's nominated staff with cohort progress oversight, head-of-UCAS oversight of students' in-progress work, teacher management, student-to-teacher assignment, and review of statements that students submit to the School; and (c) the access model described in clause 6. The AI coach never writes statement content for students; this restriction is enforced in our systems.

3. Licence and seats

The licence covers up to the number of student seats on the order form for one UCAS application cycle. A seat is occupied when the School registers a student's email; seats freed by removing a student may be reused within the same cycle. Staff accounts (head of UCAS, teachers) are included and do not consume student seats. Access ends at the cycle end date on the order form unless renewed.

4. Fees and invoicing

The School pays the single licence fee on the order form, invoiced once per cycle. Invoices are payable within 30 days by bank transfer. No card is required. If an invoice is more than 30 days overdue after written notice, Writ may suspend the licence until payment; student data is not deleted on suspension.

5. The School's responsibilities

The School: (a) nominates one head of UCAS responsible for the School's use of the console; (b) ensures only authorised staff are added as teachers and removes staff who leave; (c) is responsible for the lawful basis for its students' use of Writ, including obtaining any parental consent required for students under 18 and informing students and parents about the service; (d) ensures its staff use student data only for supporting UCAS applications and in line with the School's own policies; and (e) does not permit sharing of accounts.

6. Access model and safeguarding commitments

The following product properties are contractual commitments:

• The School's nominated head of UCAS can view their own cohort's work in Writ, including in-progress drafts and the coaching conversation, as oversight in support of students' UCAS applications.
• A teacher can view the progress of students assigned to them, and can read a student's statement and coaching conversation only after that student submits it to the School ("Send to my school").
• Staff of one school can never access another school's students (enforced server-side).
• The AI coach never writes statement content for students (enforced in our systems).
• Writ does not use school students' data for marketing and does not market to under-18s.

Because head-of-UCAS oversight extends to in-progress work, the School is responsible for informing students and their parents or guardians of it and for the lawful basis (clause 5). Writ provides a plain-language explanation for students and parents at writai.co.uk/student-privacy.

7. Intellectual property

Each student owns their personal statement and everything they write in Writ. The School acquires no rights in students' writing through this agreement. Writ retains all rights in the platform. Writ will not use students' writing to train models or for advertising.

8. Term, termination, and exit

The agreement runs for the cycle on the order form. Either party may terminate for material breach unremedied 30 days after written notice. On expiry or termination, staff access ends; students retain their personal accounts and their own writing (see the DPA for the School-data deletion process). Fees are non-refundable except where we materially fail to provide the service.

9. Liability

Nothing limits liability for death or personal injury caused by negligence, fraud, or anything else that cannot lawfully be limited. Subject to that, neither party is liable for indirect or consequential loss, and each party's total aggregate liability under this agreement is limited to the fees paid or payable by the School in the 12 months before the claim arose. Writ does not guarantee any admissions outcome for any student.

10. General

This agreement is governed by the laws of England and Wales with exclusive jurisdiction of its courts. Neither party may assign without consent. Notices go to the contacts on the order form and to enquiries@writai.co.uk. Changes to these published terms apply prospectively and do not affect a signed order form mid-cycle.

Data Processing Addendum

1. Roles

For personal data of the School's enrolled students and staff processed through the school licence, the School is the controller and Writ is the processor under UK GDPR. (For individual accounts outside a school licence, Writ is the controller under our Privacy Policy.)

2. Processing details

Subject matter and duration: operation of the Writ coaching service and school console for the licensed cycle. Nature and purpose: providing AI-assisted personal statement coaching to students; providing progress oversight and review to School staff, comprising head-of-UCAS oversight of students' in-progress work and student-initiated submission of finished statements to assigned teachers. Data subjects: enrolled students (typically aged 16–18, some under 18) and School staff. Categories of data: names and school email addresses; application profile data (course choices, predicted grades, academic ledger, supercurricular records and uploaded certificates); statement drafts, coaching questions and answers, and staff feedback; product usage events and technical logs. No special category data is required by the service, and the School should instruct students not to include any.

3. Writ's obligations as processor

Writ will: process the data only on the School's documented instructions (this agreement and console actions by the School's staff constitute those instructions); ensure persons processing the data are bound by confidentiality; implement the technical and organisational measures in section 6; engage sub-processors only under section 4; assist the School with data subject rights requests and with its obligations on security, breach notification, and impact assessments; notify the School without undue delay after becoming aware of a personal data breach affecting the School's data, with enough information to meet the School's 72-hour ICO obligation; delete or return the data under section 7; and make available information reasonably necessary to demonstrate compliance, including responding to the School's reasonable written audit enquiries once per cycle.

4. Sub-processors

The School authorises these sub-processors: Supabase (database, authentication, storage — hosting the application data); Anthropic (AI provider — processes drafts, profile context, and answers to generate coaching output; Writ's agreement with Anthropic does not permit training on this data); and Stripe (payments — individual plans only; not used for school-licence students). Writ will give the School at least 14 days' written notice of any intended change of sub-processor, during which the School may object on reasonable data protection grounds; Writ remains liable for its sub-processors' performance.

5. International transfers

Where a sub-processor processes personal data outside the UK, the transfer relies on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum, and Writ will provide details of the applicable safeguard on request.

6. Security measures

Encryption in transit (TLS) and at rest; row-level security enforced in the database so every access path is scoped to the requesting user's role, school, and assignment; role-scoped access enforced server-side (a teacher cannot read a student's statement content before that student submits it — not merely hidden in the interface — while the head of UCAS has oversight access to their own cohort's in-progress work); school isolation enforced server-side (staff can never query another school's students); role-based access with least privilege for Writ's own administrators; separate credentials for every user (no shared accounts); and audit-relevant records of submissions, assignments, and staff feedback retained with attribution.

7. Deletion and return

During the term, the School can remove a student (ends the seat and staff visibility). On expiry or termination, Writ will, at the School's written choice within 30 days: (a) delete school-linked associations and staff feedback, after which former staff have no access and students' accounts continue as individual accounts owned by the students (the default — students own their statements); or (b) where the School requires and confirms the student has been informed, delete named students' accounts and data entirely, subject to records we must keep by law.

8. Children's data

The service is designed in line with the ICO Age Appropriate Design Code: data minimisation (only application-relevant data is collected), no advertising trackers, and no marketing to under-18s. A student's work is visible only within their own school — to the head of UCAS as oversight of the cohort, and to an assigned teacher once the student submits — and never to another school. Plain-language explanations of who can see what are provided to students and parents at writai.co.uk/student-privacy. Because head-of-UCAS oversight includes in-progress work, the School remains responsible for the lawful basis, for any parental consent required, for informing students and parents, and for its own safeguarding policies.