It does embed content from two services:
The customers who pay for us (schools, nurseries, child-minders, educators and similar educational organisations) are data controllers for the data they add to Tapestry. We are their data processors.
The good news is that this means that, even if we wanted to, we can't do anything with the data on Tapestry without an instruction from our customer: the data is private, and what we do with it has to be agreed in a contract.
But it does mean that some duties fall upon our customers, and some fall upon us. We need to work together to be GDPR compliant overall.
If you are someone whose data is stored in Tapestry and just want a few key facts. They are: