How we handle your school's information

Guided Digital Childhood Ltd, company number 17299814, registered office Apple Acre, Star, Winscombe, BS25 1QF, is the data controller for the personal data described in this notice. We are not required to appoint a Data Protection Officer. Our privacy lead is Justin Phillips, the founder, at hello@guidedchildhood.com.

This notice is for the staff of schools, trusts and colleges that enquire about, pilot or license Guided Childhood Schools, and for anyone who visits schools.guidedchildhood.com. It is not about pupils, because we hold no pupil data, and it is not about families, who use the separate Guided Childhood app under its own privacy policy at guidedchildhood.com/privacy.

When you ask for an invoice, a pilot, the sample lesson pack or a place in the class pack draw, we keep what the form asks for: your school's name, your name, your role, your work email address, a purchase order number if you gave one, the pupil count band, and anything you typed in the notes box. We use it to reply to you, to raise the invoice, to send your school code and to run the draw. Our basis is the steps needed to enter and perform a contract with the School and, for a lead or a draw entry, our legitimate interest in answering a school that has asked us something.

When a school code is entered, we set one cookie, gc_schools_access. It holds the code and an expiry date, signed so that it cannot be forged, and it lasts 180 days. It holds no name and no email address. It is strictly necessary for the Service to work, so no consent banner is needed under the Privacy and Electronic Communications Regulations.

We send a confirmation email to the address you gave, and a copy of each request to the founder, so that nothing waits. Our basis is the same as in 2.1.

Our hosting provider keeps short lived technical logs of requests to the site, which include an IP address, the time and the page requested. They exist to keep the Service secure and running. We do not use them to identify anyone, and our basis is our legitimate interest in running a secure service.

Some things live only in your browser and never reach us: the AI governance reviews your school writes, which may name a member of staff, the record of which passport pages a classroom screen has filled, and the name of your safeguarding lead if you type it into the Hub so the lessons can say it. They are stored on that device and never sent to us. The reviews can be exported as a file or printed, and clearing the browser clears all of them.

The classroom player sends us nothing. There is no record of which teacher taught which lesson, which class saw it, or how any pupil answered.

We do not collect any personal data about pupils. There are no pupil accounts, logins, names, photographs or profiles anywhere in the Service.

We do not sell personal data, use it for advertising, profile anyone, use analytics or tracking cookies, or use any personal data to train an AI model.

We do not track whether you open our emails or which links you follow.

We use a small number of providers who process data on our instructions to run the Service. They see only what the job needs:

• Supabase, which hosts our database in Ireland, where the requests in 2.1 are stored.
• Vercel, which hosts the website and sends the pages to your browser.
• Resend, which sends our emails.
• Stripe, in which we raise your invoice, so it holds the School's billing contact and the invoice itself.

We do not share personal data with anyone else, except where the law requires it.

Some of these providers are based in, or may process data in, the United States. Where personal data leaves the United Kingdom we rely on the safeguards UK law provides, including the UK International Data Transfer Addendum to the EU standard contractual clauses and, for Ireland, the UK's adequacy decision for the European Economic Area.

A request that does not lead to a licence, whether a lead, a sample lesson pack or a draw entry, is deleted twelve months after our last contact with you.

A licensed School's contact details are kept for the life of its licence and for six years after the last invoice, because tax law requires us to keep accounting records for that long. We keep only what that requires.

The cookie expires after 180 days, or sooner if the code is withdrawn. Technical logs are kept briefly by our hosting provider and then deleted.

Under UK GDPR you can ask to see the personal data we hold about you, have it corrected or deleted, restrict or object to how we use it, or receive a copy to take elsewhere. Email hello@guidedchildhood.com and a person will reply within two working days. We do not charge for this.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would welcome the chance to put things right first.

Everything travels over HTTPS. The school code cookie is signed with a keyed hash and checked against the current list of codes on every request, so a withdrawn code stops at once. The database sits behind row level security, and the keys that can read the request table are held only on the server. Access within Guided Digital Childhood Ltd is limited to the founder. Above all, we keep the least data possible, so there is very little to protect.

The Service is used by adults teaching children. Pupils never operate it, never sign in and never give us data. The home code a teacher sends home identifies a lesson, not a pupil or a school, and what a family does with it in the Guided Childhood app is covered by that app's privacy policy, under the parent's own account.

The version and date at the top tell you which notice applies. If we change anything significant we will email every licensed School.