Safety and privacy
No real child is ever in it.
No real student, family, member of staff or school is in Synthetic School. The only personal data in the system belongs to the adults who play it.
Never in Synthetic School
01 · Synthetic only
Every school and every student is invented.
Each school system gets its own fictional school, written from public, published material about that system.
- No import path accepts real student or staff records.
- No persona, storyline, case file or school is modelled on an identifiable person or school.
- Free text is screened for real names before it reaches a model or the log. A name that matches no one in the synthetic school is flagged, and the trainee is asked to remove it.
02 · Formative only
For learning, never for judging a leader.
The debrief shows what followed from each decision. What a trainee does with it is up to them.
- Nothing leaves the system as a score or a ranking.
- The trainee owns the play record. A coach sees it only with the trainee's consent, and an employer only when the trainee shares it.
- When a board or a senior leadership team plays together, the shared run shows only joint decisions. Each player's own record stays theirs, under the same rules.
- Every contract bars any use of play records to select, appraise, promote, discipline or rank a school leader.
- Individual measures exist only for research. They are collected with consent and shown to no trainee, coach or buyer.
03 · Child protection storylines
Hard cases, handled the way a school records them.
School leaders have to act on concerns about children. Synthetic School lets them practise the procedure without putting anyone through the detail.
From a reviewed library
Every child protection storyline comes from a reviewed library, and agents cannot start a new one. A student inside a storyline speaks only reviewed lines from that library. A child protection lead from each system reviews its library before use, then once a year.
Reported, never shown
Harm reaches the school leader only as a report, the way a member of staff would record it, without graphic detail. Violence between students arrives through incident records and witness accounts.
Firm limits on content
No sexual content involving students appears in any form, and student agents never play romantic scenes. A concern about sexual harm reaches the school leader only as a staff record naming its category, with no description. Self-harm and suicide appear only as concerns and procedure, with no methods described.
Chosen in advance
Facilitators choose which kinds of storyline a term may contain, and trainees see that list before they start. The timing stays unannounced, as it would be in post.
Opt in, pause or leave
Self-serve trainees, with no facilitator, get these storylines only after opting in. Anyone can pause or leave a scene, and the debrief covers the procedure either way.
A debrief about procedure
Students inside a storyline give no account in the debrief. It covers the procedure and what staff did.
Each pack follows its own system's published child protection procedure as fixed steps. An agent can carry out a step badly, but no agent can skip, add or reorder one.
04 · Fair personas
Agents are audited for the people they portray.
Studies have found language models flattening and misportraying identity groups, and one mixed-reality platform repeating racist and sexist stereotypes. The cast is checked for both.
- Personas are written from public, published material about each system, never from identifiable people.
- Narration is checked against the engine's state and audited by identity group, including students with additional support needs.
- A serving school leader from each system reviews its pack and persona library. A cultural reviewer also reads the international-schools personas before they are used.
- Agents propose and the engine decides, so a narration error cannot change what happens in the school.
05 · Data protection
The only personal data belongs to the adults who play.
Where it is stored
Play records are stored in a UK or EU region, encrypted at rest, and kept for 12 months after a cohort ends, unless the buyer's agreement sets a shorter period or the trainee chooses to keep them. Records are deleted on request, and automatically when retention ends.
Where model calls go
Model calls go to Anthropic in the US by default. A buyer who needs data kept in a region can use a regional cloud endpoint instead.
Which law applies
Each market gets a data protection impact assessment before its first cohort, under its own data protection law. The privacy notice names the laws that apply.
The draft privacy notice covers this website and the product.
06 · AI regulation
Built with the rules for AI in education in view.
- Synthetic School never infers a trainee's emotions, a use the EU AI Act has banned in education settings since February 2025 (Article 5).
- The Act treats four education uses as high-risk: deciding admission, evaluating learning outcomes, assessing the level of education someone receives and detecting cheating in tests (Annex III). Those obligations apply from 2 December 2027 (Lewis Silkin).
- Before any sale in the EU, we will take legal advice on whether a programme's use of the debrief counts as evaluating learning outcomes.
Report a concern
Seen something that should not be there?
If anything in Synthetic School seems to describe a real person or school, or a storyline goes somewhere it should not, tell us.
Jamie Scobie, the founder, reads every report and replies within two working days.
See the safeguards in a pilot.
Your facilitators set the storylines each term may contain, and every trainee sees the list first.