Privacy notice

Who we are #

This site is run by [controller: legal name], [address], registered with the ICO under number [ICO registration number]. Questions about this notice go to hello@schoolaigovernance.co.uk.

What we collect, and why #

The contact form. Your name, email address and message, so that we can reply. Kept for [12 months] after the last message, then deleted. Lawful basis: our legitimate interest in answering people who write to us [confirm].

The update email. Your email address and the date you confirmed it. We send nothing until you confirm by clicking the link in the first email. Every email has a one-click unsubscribe, and unsubscribing deletes your address from the list. Lawful basis: your consent.

The policy builder and the fill-in templates. Your answers are carried in the link in your browser and are not sent to or stored by us unless you have an account and press Save.

Accounts. An account is free and optional. We keep your email address and name, the school details you enter, the documents you save, and a record of what you download while signed in (which document, in which format, and when), for as long as you have the account; delete it from the account page and they go with it within [30 days]. Sign-in is handled by Clerk, which sets the cookies needed to keep you signed in and no others; the saved data is held by Neon in London; and your registration is recorded in Attio, which we use to keep our own list of who has an account. We email you about the account itself and, if a saved document relies on guidance that changes, about that change, with a link to stop those notes. Lawful basis: the account terms you accept when you register (contract), and our legitimate interest in telling you that a document you keep with us is out of date [confirm]. The account terms say the same in full. Our host's server logs may briefly record the addresses of pages you visit, including a builder link; those logs are kept for [period] [confirm with the host].

Analytics. We use [analytics provider], which sets no cookies and records no personal data: it counts page views and the country they came from, and cannot identify you. There is no cookie banner because the only cookies are the ones that keep an account signed in, which need no consent, and there are none at all until you sign in.

The courses. The free course and the staff course run on a separate course site, provided for us by Path Assess under our name. Registering there is covered by the course site's own privacy notice at [link].

Who helps us #

We use other companies to run the site, and each acts only on our instructions: [hosting: Vercel, data stored in [location]]; [email: Resend, data stored in [location]]; [analytics: [provider], [location]]; [courses: Path Assess, [location]]; [sign-in: Clerk, [location]]; [database: Neon, London]; [CRM: Attio, [location]]. Where data leaves the UK, the transfer is protected by [safeguard, for example the UK addendum to the standard contractual clauses] [confirm each].

Your rights #

You can ask for a copy of the personal data we hold about you, ask us to correct or delete it, object to our using it, or withdraw consent to the update email at any time. Write to hello@schoolaigovernance.co.uk and we will answer within a month.

Complaints #

Tell us first: since 19 June 2026 controllers must have a route for data protection complaints, and we will acknowledge yours within 30 days and answer it as quickly as we can. You can also complain to the ICO (the Information Commission from 30 September 2026, still known as the ICO) at ico.org.uk.

Changes #

When this notice changes, the date at the top changes and the What's changed page says what moved.