Privacy Policy

Who we are (the data controller)

School Path AI (“we”, “us”, “our”) is the controller for the personal data described in this policy. If you have a question or want to exercise your rights, write to privacy@schoolpath.ai. We aim to reply within 30 days.

For the purposes of UK GDPR, our lead supervisory authority is the Information Commissioner's Office (ICO). You can lodge a complaint at ico.org.uk at any time.

What we collect

The categories of personal data we collect, why, and how long we keep them:

• Account data — email address, hashed password, display name. Used to authenticate you and to remember your saved schools list. Kept for as long as your account is active, plus 30 days after deletion to allow account-recovery requests.
• Usage analytics — pages visited, search filters used, viewport size, referrer. Stored against a randomly-generated session ID, not your account. Aggregated and discarded after 90 days.
• Family preference data (optional) — if you use the Recommend feature you may tell us your child's entry stage (11+ / 13+ / 16+), preferred regions, budget. We use this to generate the recommendation and store it against your account so you can refine it.
• Payment data — handled exclusively by Stripe. We never see your card number. We receive only a customer ID, subscription status, and the last 4 digits / expiry of your card. See Stripe's privacy policy.
• Support correspondence — emails you send us are stored for 24 months in case the issue recurs.

We do not collect special-category data (health, ethnicity, religion). Where a school's religious affiliation is part of the school profile (e.g. “Catholic boarding school”) that is published reference information, not personal data about you.

Children's data

School Path AI is intended for use by parents, guardians, and professional advisors making schooling decisions on behalf of a minor. The service is not directed at children under 13, and we do not knowingly collect personal data from children. If you are using the service to plan for your own child:

• We never ask for the child's name, address, school ID, NHS number, or any other directly-identifying information.
• The Recommend questionnaire only stores attributes (entry stage, preferred region, budget, ISEB score range) — not who the child is.
• If you accidentally enter a child's identifying detail in a free-text field, contact us and we will delete it immediately.

Lawful bases (UK GDPR Art. 6)

• Contract (Art. 6(1)(b)) — for delivering the paid features you signed up for.
• Legitimate interest (Art. 6(1)(f)) — for analytics and product improvement, where our interest is operating a useful service and your interest is your reasonable expectation that an online service measures its own performance. You can object at any time.
• Consent (Art. 6(1)(a)) — for any non-essential cookies and for marketing emails. You can withdraw consent in your account settings or by clicking unsubscribe.

Where data is stored

Application data lives on servers in the European Economic Area (typically London or Frankfurt). Payment data is processed by Stripe, which may transfer to the United States under their standard contractual clauses.

We do not transfer personal data outside the UK / EEA for our own purposes.

Your rights

You have the right to:

• Request a copy of your personal data (subject access request)
• Correct inaccurate data
• Delete your account and associated data
• Object to processing based on legitimate interest
• Restrict processing while a complaint is being resolved
• Receive your data in a portable format (JSON export)
• Withdraw consent for any consent-based processing
• Lodge a complaint with the ICO

To exercise any of these, email privacy@schoolpath.ai. We will respond within 30 days.

Sub-processors

We use the following third parties to deliver the service. Each is bound by a data-processing agreement.

• Stripe — payment processing
• Resend (or equivalent) — transactional email
• Hetzner / Vercel — application hosting (EU)
• Anthropic — model inference for AI features (no personal data is sent in pathway calculations; only when you explicitly use a chat feature, if/when launched)

We will update this list before adding any new sub-processor that materially changes how your data is handled.

Security

Passwords are hashed with bcrypt. All HTTP traffic is encrypted via TLS 1.2+. Database backups are encrypted at rest. Access to production systems is logged and restricted to named individuals.

We have not had a notifiable data breach. If we ever do, we will notify affected users and the ICO within 72 hours as required by Art. 33 UK GDPR.

Changes to this policy

When we make a material change to this policy we will email registered users at least 14 days before the new version takes effect. The “Last updated” date at the top reflects the most recent revision.