Privacy Policy

1. Who is responsible for your information

Philippa Cooper trading as Parent Insight is the data controller for the information described in this policy. Please write to support@parentinsight.co.uk about anything on this page, including a request to see, correct or delete information.

2. Parents provide the information, not children

This service is bought and used by parents and carers. Children do not create accounts, are not asked to complete anything and do not submit information directly. Everything held about a child is provided by their parent or carer.

3. What information I hold

I ask only for information that is needed to write a considered, accurate written service for your family.

• Your identity, contact and account information: your name, email address, any telephone number you give, and the account details needed to sign you in.
• Your child's name, age or date of birth, school year and school, only where these are needed for the service.
• What you write in the questionnaire, including information about learning, SEND, behaviour, wellbeing, health or disability where you choose to share it.
• Documents you choose to upload, such as school reports or assessments.
• The completed written service prepared for you.
• Records of the consents you have given, any rights requests you make, and the audit entries needed to show these were handled properly.
• Payment confirmation records, and minimal security and sign-in logs needed to keep the service safe.

4. Card details

Card details are handled entirely by the payment provider. Parent Insight does not receive or store them.

5. Why I am allowed to hold it

For the paid service you ask for, I rely on Article 6(1)(b) of the UK GDPR, because the processing is necessary to provide the service under our contract.

For information about health, disability or other special category information, I rely on your explicit consent under Article 9(2)(a). That consent is asked for before any such information is saved, and it can be withdrawn at any time by writing to me. If you withdraw it, processing of that information stops, unless a separate legal duty requires me to keep a limited record.

For proportionate security of the service and for keeping the records I need to show it was delivered properly, I rely on Article 6(1)(f), my legitimate interests.

Where a legal obligation actually applies, for example keeping tax records, I rely on Article 6(1)(c).

Marketing is separate and switched off unless you choose to opt in. You can opt out at any time and it never affects the service you receive.

6. Who processes it on my behalf

A Supabase project in London (eu-west-2) is the processor for current parent account authentication, questionnaire and case answers, consent records, and private file storage. I cannot claim that every subprocessor or operational log used by a provider stays within the UK.

Lovable Cloud hosts the public website and holds limited records from earlier free-resource requests, such as a name, email address, consent choice, source and date. Parent accounts, questionnaire and case information, consent records and private case files are held in the separate Supabase project described above.

Resend is the SMTP delivery service used by Supabase Auth to deliver verification, sign-in and password-recovery messages. It processes the destination email address and delivery information such as timestamps and delivery status. No information about your child is intentionally included in these messages.

I do not sell personal information and I do not share it for anyone else's marketing. Information is not shared with your child's school, your local authority or any other professional unless you ask me in writing, or unless the law or a safeguarding duty requires it.

7. Email and automated writing

Emails containing case content are disabled, and artificial intelligence is not used to generate your written service. The only messages sent are essential account messages from Supabase Auth — email verification, sign-in links and password recovery — delivered by Resend as described above. These carry your email address and delivery information, and no content about your child.

Please do not email information about your child's learning, SEND or health. If you do, I will ask you to use the secure area instead.

8. Payments

Payment processing is currently paused. When it is switched back on, Stripe will handle payment and card data as a separate provider under its own privacy terms, and Parent Insight will keep only the payment confirmation and accounting records it needs.

9. Analytics and advertising

Google Analytics and Google Ads tags load only after you accept cookies. They never receive questionnaire answers, uploaded documents or any case content.

10. How access is controlled

You can reach your own records only, after signing in with an email address confirmed as yours. Authorised Parent Insight staff can reach records where their work requires it. Uploaded documents are held in private storage and reached through time-limited links. These are careful, proportionate measures; no service can promise absolute security.

11. Information outside the UK

Where a processor or one of its subprocessors handles information outside the UK, appropriate UK transfer safeguards or adequacy mechanisms are relied upon as applicable under that provider's terms and data processing agreement. I cannot claim that no information ever leaves the UK.

12. How long information is kept

Deleting information from live records is done promptly, but it can take a limited further period to age out of a provider's routine backups.

• Unsubmitted drafts that are left inactive: 90 days.
• Questionnaire answers, uploaded documents and delivered case content: 12 months after delivery, unless you delete them sooner or a necessary legal hold applies.
• Your account and profile: while your account is active, and normally deleted within 30 days of a valid deletion request.
• Invoices, payment and contract records: 6 years, where this is required for tax or legal record keeping.
• Consent, withdrawal, deletion and necessary audit evidence: 6 years.
• Provider security and authentication logs: only for the operational period configured by the provider.

13. Your rights

You have the right to ask for access to your information, correction of anything inaccurate, erasure, restriction of processing, portability where it applies, and to object to certain processing. You may withdraw consent at any time, and you may complain to the Information Commissioner's Office at ico.org.uk.

I may need to verify your identity before acting on a request. I will normally respond within one month.

14. Safeguarding and legal disclosure

If the law requires it, or if it is necessary to protect a child from harm, I may need to disclose information to the appropriate authority. In that situation I disclose the minimum necessary.

15. What I do not do

I do not sell personal information, and there is no automated decision-making and no diagnosis. Every written service is prepared and decided by a person.

16. Changes to this policy

This policy was last updated on 16 September 2026. If it changes materially, I will tell you before the change affects you.