Under Article 30 of the UK GDPR, School Atlas maintains a record of the personal data we process. This page publishes a summary for transparency. The full record is available to the Information Commissioner on request.
What this record covers
Each entry below describes one processing activity: the purpose, the categories of personal data involved, the lawful basis under Article 6 of the UK GDPR, how long we keep the data, and who else sees it. Where an activity involves a sub-processor, the country of processing is shown.
International data transfers
School Atlas is a UK controller. Some processing happens via sub-processors based outside the UK and EEA — most notably Stripe (US, payments), Anthropic (US, AI inference), Resend (US, email) and Sentry (US, error monitoring). Each transfer is shown against the activity below.
All transfers outside the UK rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and where a recipient is also DPF-certified we additionally rely on the UK Extension to the EU–US Data Privacy Framework (the “UK–US Data Bridge”). Supabase (database / auth) is hosted in the EU. We do not transfer pupil data to any sub-processor outside the UK / EEA.
1. Account creation and authentication
- Purpose: Identify returning users, secure access, provide the service the user has signed up for.
- Categories of data: Email address, hashed password, account creation timestamp, last sign-in.
- Lawful basis: Art 6(1)(b) contract.
- Retention: Until account deletion, then 30 days in deleted-accounts audit table before purge.
- Recipients / sub-processors: Supabase (auth + database, EU).
2. User profile and preferences
- Purpose: Personalise shortlists, saved searches, notification settings.
- Categories of data: Display name (optional), postcode area (optional, for distance calculations), notification preferences, saved schools and searches.
- Lawful basis: Art 6(1)(b) contract.
- Retention: Until account deletion.
- Recipients / sub-processors: Supabase (EU).
3. Child profiles (parent-managed)
- Purpose: Let parents shortlist schools against a specific child (year group, phase, preferred school types). Never shared outside the parent account, never used for marketing, never profiled.
- Categories of data: Name (parent may use a first name, initials or a nickname); optional date of birth (to compute the child's current school year); current year group; school phase; preferred school types; any free-text notes the parent writes. No SEND data is captured in a structured field — parents may mention SEND matters in their free-text notes if they choose.
- Lawful basis: Art 6(1)(b) contract with the account-holding parent (or person with parental responsibility), performed on the child's behalf. The child is the data subject for the personal data held in the record; the parent acts as their representative under parental responsibility and exercises access/rectification/erasure rights for them. Art 8(1) UK GDPR consent is not engaged because the child is not the direct user of the service. Where the parent enters Art 9 special-category content into the free-text notes field, the additional condition is the parent's explicit consent under Art 9(2)(a) + DPA 2018 Sch 1 Pt 1 para 1 (see migration 00414).
- Retention: Until the parent deletes the profile or deletes their account. Deleting the parent account cascades to all child_profiles rows via a foreign-key ON DELETE CASCADE.
- Recipients / sub-processors: Supabase (EU) only. No onward disclosure.
4. Subscription and payment processing
- Purpose: Take payment for paid plans, manage renewals, issue invoices.
- Categories of data: Stripe customer ID, subscription status, plan, billing period. We do not store card numbers, CVCs, expiry dates or last-four digits — those are held exclusively by Stripe under their PCI-DSS Level 1 attestation. Our database holds only the opaque Stripe customer ID and the resulting subscription state.
- Lawful basis: Art 6(1)(b) contract.
- Retention: Subscription status mirror kept for the life of the account, then deleted as part of account deletion. Invoice and transaction records on the Stripe side are retained by Stripe for 7 years to meet UK financial-record obligations (HMRC self-assessment requires retention until the 5th anniversary of the 31 January following the tax year — Stripe holds for 7 to satisfy the longer retention rules in other jurisdictions in which it operates). We can retrieve those records on demand for an SAR but do not duplicate them locally.
- Recipients / sub-processors: Stripe (US, under UK Addendum to EU SCCs; Stripe is also DPF-certified so the UK–US Data Bridge applies).
5. Parent reviews of schools
- Purpose: Publish moderated first-hand reviews to help other parents.
- Categories of data: Review text (1,000 chars max), declared relationship (parent / former parent / prospective), rating. Reviewer identity held internally, never published.
- Lawful basis: Art 6(1)(a) consent at submission + Art 6(1)(f) legitimate interest (platform operation and Defamation Act s.5 defence).
- Retention: Published reviews retained for the life of the platform or until withdrawn by the author. Rejected reviews retained 12 months as moderation audit trail, then deleted.
- Recipients / sub-processors: Supabase (EU). Public, once published.
6. AI advisor conversations
- Purpose: Answer parent questions about UK schooling.
- Categories of data: Conversation messages (free-text) + account ID.
- Lawful basis: Art 6(1)(b) contract (Pro feature).
- Retention: Conversation messages stored in our Supabase database (EU) for the life of the account and deleted on account deletion. Forwarded to Anthropic under their published Data Processing Addendum and Commercial Terms: no training on Customer Content, up to 30-day retention for abuse monitoring then deletion. Child-profile fields (name, date of birth, notes) are stripped server-side before any request leaves our servers.
- Recipients / sub-processors: Anthropic (US, under Anthropic’s published Data Processing Addendum incorporating the UK Addendum to EU SCCs).
7. Search analytics
- Purpose: Understand search demand across the UK and improve the service.
- Categories of data: Outward code of the postcode searched, filters applied, a pseudonymised session hash (one-way hash of IP address and a server-side salt), user ID when signed in.
- Lawful basis: Art 6(1)(f) legitimate interest (product improvement). Nothing is stored on the visitor's device.
- Retention: 12 months, then deleted. Enforced by scheduled job.
- Recipients / sub-processors: Supabase (EU). Not shared.
8. Visit analytics (opt-in)
- Purpose: See which parts of the site help people and where they get stuck: pages opened, tools used, prompts shown and pressed, sign-up and checkout steps.
- Categories of data: Event name and properties, page path, referrer, a random per-tab visit ID, first-touch source, user ID when signed in. Held only for visitors who pressed "Accept all" on the cookie banner.
- Lawful basis: Art 6(1)(a) consent, given through the cookie banner (PECR reg 6: the visit ID and markers are stored on the device). Without consent nothing is written to the device and no event is recorded; markers left by an earlier visit are removed on the next page.
- Retention: 12 months, then deleted. Enforced by scheduled jobs.
- Recipients / sub-processors: Upstash (UK, London region; short-lived queue before the database write); Supabase (EU). Not shared with Google, advertisers or anyone else. Google Analytics 4 was removed on 8 October 2026.
9. Site tests (A/B tests)
- Purpose: Show two versions of a page to half of visitors each and compare which helps people more.
- Categories of data: Test name, version shown, what happened (seen, clicked, converted), date, a one-way hash of IP address and date, user ID when signed in. A random bucket number is kept in a cookie and the version shown in local storage.
- Lawful basis: Art 6(1)(f) legitimate interest (improving the service). Storage on the device relies on the PECR reg 6 exception for statistical purposes (Data (Use and Access) Act 2025): the purpose is explained at /privacy#cookies and a free, account-free switch there lets a visitor leave all tests (cookie sa-no-tests; no bucket cookie, no stored notes, nothing counted).
- Retention: 12 months, then deleted. Enforced by scheduled job.
- Recipients / sub-processors: Supabase (EU). Not shared.
10. Anonymous visit counters
- Purpose: Count page types and distinct visitors per day without identifying anyone.
- Categories of data: Daily counters by page type, referrer class and device class; a one-way hash of IP address and date folded into a distinct-visitor counter and discarded; per-school page-view counts per day (IP used briefly to avoid counting one visitor twice within five minutes).
- Lawful basis: Art 6(1)(f) legitimate interest. No identifier is kept and nothing is stored on the device, so PECR reg 6 is not engaged.
- Retention: Working counters expire after 60 days; the aggregate statistics are kept.
- Recipients / sub-processors: Upstash (UK, London region); Supabase (EU).
11. Email communications
- Purpose: Deliver transactional, onboarding, weekly digest, and marketing emails.
- Categories of data: Email address, first name (optional), delivery and open status.
- Lawful basis: Art 6(1)(b) for transactional; Art 6(1)(a) explicit consent (unticked opt-in at signup) for the onboarding series; Art 6(1)(a) consent for marketing newsletters. PECR 22(3) soft opt-in is used only for re-engagement messages to former paying subscribers about similar paid products.
- Retention: Until account deletion or 30 days after unsubscribe, whichever is sooner.
- Recipients / sub-processors: Resend (US, under UK Addendum).
12. Error monitoring
- Purpose: Detect and fix bugs.
- Categories of data: Stack traces, route paths, browser details. IP addresses are scrubbed before storage and the page address is sent without its query string. For visitors who pressed "Accept all" only: a short replay of the page structure and clicks before an error, with text masked and images blocked (browser storage item sentryReplaySession).
- Lawful basis: Art 6(1)(f) legitimate interest (service reliability and fault detection; nothing is stored on the device). The replay is consent-based (Art 6(1)(a); PECR reg 6): ICO guidance treats recordings of individual visitors' actions as outside the exceptions.
- Retention: 90 days rolling.
- Recipients / sub-processors: Sentry (EU data region; US-owned provider, under UK Addendum).
13. Institution portal — school-uploaded data
- Purpose: Let a claimed school manage its profile, photos, open days, and enquiries.
- Categories of data: School staff contact details, profile copy, photos, pupil-free business data.
- Lawful basis: Art 6(1)(b) contract between the institution and School Atlas.
- Retention: For the life of the institution account; on termination, data retained 90 days for dispute handling, then deleted.
- Recipients / sub-processors: Supabase (EU). Where a school uploads pupil data, School Atlas acts as processor under the published [Institution DPA](/legal/institution-dpa).
14. Moderation and abuse handling
- Purpose: Keep reviews lawful, meet the Defamation Act 2013 s.5 notice-and-takedown duty, and satisfy the Online Safety Act 2023 s.10 duties.
- Categories of data: Notice text, complainant contact, moderator decision, timestamps, linked review.
- Lawful basis: Art 6(1)(c) legal obligation (Defamation Regulations 2013) + Art 6(1)(f) legitimate interest.
- Retention: 3 years from the date of the moderation decision — evidentiary window for possible defamation claim.
- Recipients / sub-processors: Internal only.
Special category data (Article 9)
Special category data is processed only in one narrow place: the free-text notes field on a child profile, where a parent may voluntarily record information that could reveal health, SEND status, or other Article 9 categories. Processing is conditional on the parent ticking an explicit-consent checkbox at the point of entry (UK GDPR Art. 9(2)(a); DPA 2018 Schedule 1 Part 1 paragraph 1). Notes are stored encrypted at rest, are visible only to the authenticated parent, are never used for profiling, marketing, or automated decision-making, and can be erased at any time from the child profile screen. Consent can be withdrawn by clearing the notes field, which removes both the data and the consent record.
What we do not process
- Other Article 9 categories — biometric data, genetic data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life, or sexual orientation — are not collected.
- No location tracking beyond a voluntary postcode area, and no third-party behavioural advertising pixels.
- No children's data is used to profile for marketing.
Questions about this record
If you have questions about what we process, why, or for how long, email privacy@schoolatlas.co.uk. For a formal Article 15 subject access request, you can also use the data export and deletion controls in your account.