Privacy policy

1. Who we are (data controller)

Schola (“we”, “us”) is the data controller for the personal data described in this policy. You can reach us at admin@scholahome.com. [Registered name, business address and ICO registration number to be inserted before publication.]

2. The data we hold

Your account: your email address and an encrypted (hashed) password. If you opt in, a flag recording that you'd like community emails.

Your family's records (the content you enter in the app): your children's details (such as name, date of birth and address), parent/carer details, learning notes, schedules, tutor and provider details, photos, voice recordings, documents, reflections and the reports you build. Some of this can include special category data under UK GDPR — for example a child's special educational needs, an EHC plan or health information — which we only process because you choose to enter it (see lawful basis below).

Website enquiries: if you fill in a form on our site, the name, email and any details you provide.

Technical data: standard server logs (such as IP address and browser type) kept by our hosting providers for security and reliability.

3. Why we use it, and our lawful basis

• To provide the app — storing and syncing your records, generating your reports. Lawful basis: performance of a contract with you (UK GDPR Art. 6(1)(b)).
• Special category data (e.g. SEN/EHC or health details you enter about your child). Lawful basis: your explicit consent, given by choosing to record it (Art. 9(2)(a)); you can remove it at any time.
• Community & product emails — only if you opt in. Lawful basis: consent (Art. 6(1)(a)); you can unsubscribe with one click.
• Security, support and improving the app. Lawful basis: our legitimate interests (Art. 6(1)(f)) in keeping Schola safe and working well, balanced against your rights.
• Meeting legal obligations where the law requires it. Lawful basis: legal obligation (Art. 6(1)(c)).

4. Where your data is stored, and who processes it

We host Schola on established providers who act as our processors under written data-processing terms. We do not sell your data or share it with advertisers.

• Supabase — accounts (authentication) and the secure database that holds your records. Hosted in the UK/EU (London) region.
• Netlify — hosts this website and processes website form submissions.
• Our email provider — sends account emails such as confirm-your-account and password-reset (and community emails if you opt in).
• Google Fonts — serves the typefaces used on our pages.

[This list will be kept current; the named providers are confirmed before publication.]

5. International transfers

We aim to keep your app records in the UK/EU. Where a provider processes data outside the UK, we rely on the safeguards the UK GDPR requires — an adequacy decision, or the UK International Data Transfer Agreement / Standard Contractual Clauses — so your data keeps the same protection.

6. How we keep it secure

• Your data is encrypted in transit (HTTPS/TLS) and encrypted at rest on our providers' servers.
• Access is protected by row-level security, so your account can only ever read and write its own records — other users, and the public, cannot see them.
• Passwords are stored only as a secure, salted hash — we never see your actual password.
• We limit staff access and use reputable, security-audited providers.

7. How long we keep it

We keep your account and records for as long as your account is active. If you delete your account or ask us to erase your data, we remove it from our live systems and it is cleared from routine backups within [30 days]. Website enquiry and email data is kept until you unsubscribe or ask us to delete it.

8. Your rights under UK GDPR

You have the right to: access the data we hold about you; have it corrected; have it erased; restrict or object to certain processing; receive a copy in a portable format (data portability — you can also export your records from within the app); and withdraw consent at any time. To exercise any of these, email admin@scholahome.com and we'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

9. Children's data

Schola is for parents and guardians, who create the account and choose what to record about their own children. Accounts are not intended for children to create or use on their own, and we do not market to children. As the parent/guardian you control your children's information in your account, and you can view, export or delete it at any time. Where you record special category data about your child (such as SEN or health details), we process it on the basis of your explicit consent, as set out in section 3.

10. Cookies & tracking

We keep this minimal. Schola uses only the essential storage needed to keep you signed in (your authentication session). We do not use advertising cookies or third-party tracking, in line with the Privacy and Electronic Communications Regulations (PECR).

11. Changes to this policy

If we make material changes we'll update this page and the “last updated” date, and where appropriate we'll let you know by email.

12. Contact

Questions, requests, or anything unclear: admin@scholahome.com — we aim to reply within two working days.