Privacy, face matching and AI.

How Surfaced handles tamariki’s photos, names and words: what goes where, what never leaves the phone, and what whānau decide.

Checked against the product on 21 October 2026.

Four things Surfaced never does.

Surfaced never sends a photo, a video or a voice recording to the AI that drafts.
Claude, an AI from Anthropic, drafts from words alone: what a kaiako typed or dictated, and the context listed below. Dictation happens on the phone, and the recording never leaves it.
The AI never decides who is in a photo.
A kaiako names who each moment is for. Face matching runs on your centre’s phones and only suggests tamariki whose whānau said yes. It can tick a name it is sure of, but nothing is sent until a kaiako presses Send, and any name can be unticked. Naming by hand always works.
No AI draft reaches whānau before a kaiako checks it.
Every AI draft waits for a kaiako, who can edit it, rewrite it or approve it. Whānau see ‘AI-assisted · reviewed by a kaiako’ on it. A named photo is different: it goes to whānau with the kaiako’s own words and no AI draft, unless your centre has photos wait for a head teacher.
Surfaced holds no face template it can read.
Face templates, and the small face samples that refresh them, are kept by Surfaced only encrypted, under a key only your centre’s approved phones hold. The samples are deleted when consent is withdrawn. Templates are deleted from every phone when consent is withdrawn, and from a phone when it is removed, as each phone next checks in with Surfaced.

Where each kind of information goes.

Reaches it
Only as ciphertext
Never

Where each kind of information goes
	On a kaiako’s phone	Surfaced, stored in Sydney	The AI that drafts	Whānau
Photos	Reaches it. Taken in the app. Nothing goes to the camera roll.	Reaches it. Stored, with location data removed.	Never.	Reaches it. The families it is sent to, as taken. With a protected child in it, only that child’s whānau.
Videos	Reaches it. Up to two minutes, taken in the app.	Reaches it. Stored, with its own sound.	Never, not a frame and not its sound.	Reaches it. As a still image.
A note, typed or dictated	Reaches it. Typed, or dictated on the phone.	Reaches it. Stored, with the draft made from it.	Reaches it. The words, with the context listed below, and only with whānau consent.	Reaches it. Only the version a kaiako approved.
Dictated audio	Reaches it. Turned into words on the phone.	Never.	Never.	Never.
Face templates, only with whānau consent	Reaches it. Made and matched on the phone.	Only as ciphertext. Stored and passed between your centre’s approved phones as ciphertext, under a key only those phones hold. Deleted when consent is withdrawn.	Never.	Never.
Face samples, only with whānau consent	Reaches it. Cut from a face a kaiako confirmed. Used to refresh templates.	Only as ciphertext. Stored and passed between your centre’s approved phones as ciphertext, under a key only those phones hold. Deleted when consent is withdrawn.	Never.	Never.

Photos

On a kaiako’s phone: Reaches it. Taken in the app. Nothing goes to the camera roll.
Surfaced, stored in Sydney: Reaches it. Stored, with location data removed.
The AI that drafts: Never.
Whānau: Reaches it. The families it is sent to, as taken. With a protected child in it, only that child’s whānau.

Videos

On a kaiako’s phone: Reaches it. Up to two minutes, taken in the app.
Surfaced, stored in Sydney: Reaches it. Stored, with its own sound.
The AI that drafts: Never, not a frame and not its sound.
Whānau: Reaches it. As a still image.

A note, typed or dictated

On a kaiako’s phone: Reaches it. Typed, or dictated on the phone.
Surfaced, stored in Sydney: Reaches it. Stored, with the draft made from it.
The AI that drafts: Reaches it. The words, with the context listed below, and only with whānau consent.
Whānau: Reaches it. Only the version a kaiako approved.

Dictated audio

On a kaiako’s phone: Reaches it. Turned into words on the phone.
Surfaced, stored in Sydney: Never.
The AI that drafts: Never.
Whānau: Never.

Face templates, only with whānau consent

On a kaiako’s phone: Reaches it. Made and matched on the phone.
Surfaced, stored in Sydney: Only as ciphertext. Stored and passed between your centre’s approved phones as ciphertext, under a key only those phones hold. Deleted when consent is withdrawn.
The AI that drafts: Never.
Whānau: Never.

Face samples, only with whānau consent

On a kaiako’s phone: Reaches it. Cut from a face a kaiako confirmed. Used to refresh templates.
Surfaced, stored in Sydney: Only as ciphertext. Stored and passed between your centre’s approved phones as ciphertext, under a key only those phones hold. Deleted when consent is withdrawn.
The AI that drafts: Never.
Whānau: Never.

What the AI that drafts receives.

When a kaiako’s note is drafted, Claude receives:

The kaiako’s words, as they typed or dictated them.
For each tamaiti the note is about: their first or preferred name; their age band, such as ‘3 to 4 years’; the languages spoken with them; their iwi or hapū, if the enrolment records it; what their whānau have asked for or noticed at home, if recorded; their recent entries; and any learning a kaiako is still following.
Up to two of the kaiako’s own approved stories, as examples of their style.
The kaiako’s name, the room, the date and the time of day.
Your centre’s name, its philosophy and its te reo glossary.

It never receives a photo, a video, any audio, or a child’s surname or date of birth.

Claude only drafts when every tamaiti the note is about has whānau consent to ‘Claude helping to write the story’. If nobody is named, every tamaiti it goes to must have that consent. Otherwise no draft is written, and the kaiako writes it.

Anthropic may process drafts outside New Zealand.

Surfaced uses Claude under Anthropic’s Commercial Terms of Service, effective 17 June 2025, which say: ‘Anthropic may not train models on Customer Content from Services.’

Face matching and the Biometric Processing Privacy Code.

The Biometric Processing Privacy Code 2025 applies to face matching. Your centre is the agency responsible for it, and Surfaced acts as your centre’s agent.

Face matching is optional, and a separate choice for each child’s whānau.
It runs on your centre’s phones and only suggests tamariki whose whānau said yes.
It is used only to suggest names. It is not used for attendance, security, analytics or marketing.
Photos whānau upload, such as a child’s cover photo, are never used for face matching.
A kaiako’s own photo, if they add one, is shown to the centre’s staff and to the whānau of children at the centre. It is never used for face matching.
When a centre’s declared trial under rule 1(2) of the Code ends, face templates are deleted and face matching stops.
Each centre that uses face matching publishes its own notice under rule 3 of the Code. Your centre can give you the link.

Where data is stored.

Your centre holds its information, and Surfaced processes it for your centre.

Your centre’s information is stored in Sydney, Australia, and the site and console run in Sydney.
The background jobs that make drafts keep their records in the United States. Those records hold only reference numbers and counts, never a draft, a note or a child’s name.
Sign-in emails are sent through Resend.
Anthropic, which makes Claude, may process drafts outside New Zealand.

And how it is protected:

Whānau see photos through links that expire after an hour.
Every table in the database checks who may read each row.
By default, a new phone joins when a kaiako signs in on it, and a manager can require approval for new phones. A manager can see every phone in the console and sign one out remotely.
The kaiako app locks when idle and blocks screenshots by default. During the pilot, a kaiako can allow them on their phone for an hour, after which it switches itself off.
Publishing, consent changes, phone approvals, staff and roster changes and record exports are written to an audit log.
Whānau can delete their Surfaced account themselves.

What whānau decide.

Each family sees its own child’s ‘Your choices’, and can change any of them at any time. They include ‘Face matching on centre devices’ and ‘Claude helping to write the story’.

Photos and videos go to the families a kaiako sends them to. A centre can mark a child as protected, and photos and videos with that child in them then go only to that child’s whānau.

What whānau see

What you can check yourself.

Your centre’s face-matching notice, at the link your centre gives you.
The audit log in the console: who did what, and when.
A child’s record, which a head teacher can export as a ZIP file.
Your own child’s choices, if you are whānau.

Pilot Surfaced at your centre.

Surfaced is in pilot, with the kaiako app on iPhone. Tell us about your centre and how you document learning today.

Talk to us

Or email hello@surfaced.co.nz