Privacy Policy

1. Who is responsible for your information

Philippa Cooper trading as Parent Insight is the data controller for the information described in this policy. Please write to support@parentinsight.co.uk about anything on this page, including a request to see, correct or delete information.

2. Parents provide the information, not children

This service is bought and used by parents and carers. Children do not create accounts, are not asked to complete anything and do not submit information directly. Everything held about a child is provided by their parent or carer.

3. What information I hold

I ask only for information that is needed to write a considered, accurate written service for your family.

• Your identity, contact and account information: your name, email address, any telephone number you give, and the account details needed to sign you in.
• Your child's name, age or date of birth, school year and school, only where these are needed for the service.
• What you write in the questionnaire, including information about learning, SEND, behaviour, wellbeing, health or disability where you choose to share it.
• Documents you choose to upload, such as school reports or assessments.
• The completed written service prepared for you.
• Records of the consents you have given, any rights requests you make, and the audit entries needed to show these were handled properly.
• Payment confirmation records, and minimal security and sign-in logs needed to keep the service safe.

4. Card details

Card details are handled entirely by the payment provider. Parent Insight does not receive or store them.

5. Why I am allowed to hold it

For the paid service you ask for, I rely on Article 6(1)(b) of the UK GDPR, because the processing is necessary to provide the service under our contract.

For information about health, disability or other special category information, I rely on your explicit consent under Article 9(2)(a). That consent is asked for before any such information is saved, and it can be withdrawn at any time by writing to me. If you withdraw it, processing of that information stops, unless a separate legal duty requires me to keep a limited record.

For proportionate security of the service and for keeping the records I need to show it was delivered properly, I rely on Article 6(1)(f), my legitimate interests.

Where a legal obligation actually applies, for example keeping tax records, I rely on Article 6(1)(c).

Marketing is separate and switched off unless you choose to opt in. You can opt out at any time and it never affects the service you receive.

6. Who processes it on my behalf

A Supabase project in London (eu-west-2) is the processor for current parent account authentication, questionnaire and case answers, consent records, and private file storage. I cannot claim that every subprocessor or operational log used by a provider stays within the UK.

Lovable Cloud hosts the public website and holds limited records from earlier free-resource requests, such as a name, email address, consent choice, source and date. Parent accounts, questionnaire and case information, consent records and private case files are held in the separate Supabase project described above.

Resend is the SMTP delivery service used by Supabase Auth to deliver verification, sign-in and password-recovery messages. It processes the destination email address and delivery information such as timestamps and delivery status. No information about your child is intentionally included in these messages.

I do not sell personal information and I do not share it for anyone else's marketing. Information is not shared with your child's school, your local authority or any other professional unless you ask me in writing, or unless the law or a safeguarding duty requires it.

7. Email and automated writing

Emails containing case content are disabled, and artificial intelligence is not used to generate your written service. The only messages sent are essential account messages from Supabase Auth — email verification, sign-in links and password recovery — delivered by Resend as described above, and two service emails sent to your account sign-in email address by the website's email service: a confirmation that your payment has been received, and a notification that your Report or Brief is ready to view in your secure account. To send the ready notification, the website reads your sign-in email address from the payment record held by Stripe for that order. These messages carry your email address, the name of the service you bought and delivery information, and no content about your child.

These two service emails are delivered through the email service built into the website's host, Lovable. Its delivery provider is listed on Lovable's published subprocessor list, and Lovable does not publish how long it keeps email delivery records.

If you download the free School Meeting Planner, I email you a copy of the download link. If you also tick the optional box, I send one follow-up email about Parent Insight's services after your download. It is the only marketing email I send for that tick, and every one includes an unsubscribe link. Marketing emails use only the name and email address you gave when you downloaded the planner.

Please do not email information about your child's learning, SEND or health. If you do, I will ask you to use the secure area instead.

8. Payments

Card payments for the Parent Concern Report and the School Meeting Preparation Brief are processed by Stripe, a separate provider that handles your card details under its own privacy terms. Parent Insight never sees or stores your full card details, and keeps only the payment confirmation and accounting records it needs.

9. Analytics and advertising

Google Analytics, Google Ads and Meta (Facebook) Pixel tags load only after you accept cookies. They never receive questionnaire answers, uploaded documents or any case content.

10. How access is controlled

You can reach your own records only, after signing in with an email address confirmed as yours. Authorised Parent Insight staff can reach records where their work requires it. Uploaded documents are held in private storage and reached through time-limited links. These are careful, proportionate measures; no service can promise absolute security.

11. Information outside the UK

Where a processor or one of its subprocessors handles information outside the UK, appropriate UK transfer safeguards or adequacy mechanisms are relied upon as applicable under that provider's terms and data processing agreement. I cannot claim that no information ever leaves the UK. For example, Resend, which delivers account emails, operates mainly from the United States, and Stripe may process payment information outside the UK. Both rely on the UK International Data Transfer Addendum or equivalent safeguards in their data processing terms.

12. How long information is kept

Deleting information from live records is done promptly, but it can take a limited further period to age out of a provider's routine backups.

• Unsubmitted drafts that are left inactive: 90 days.
• Free-resource requests (your name, email address and consent choice) and enquiries that do not lead to a purchase: normally deleted after 12 months.
• Optional marketing emails: until you withdraw. After that, only a minimal record is kept so your request can be honoured.
• Questionnaire answers, uploaded documents and delivered case content: 12 months after delivery, unless you delete them sooner or a necessary legal hold applies.
• Your account and profile: while your account is active, and normally deleted within 30 days of a valid deletion request.
• Invoices, payment and contract records: 6 years, where this is required for tax or legal record keeping.
• Consent, withdrawal, deletion and necessary audit evidence: 6 years.
• Provider security and authentication logs: only for the operational period configured by the provider.

13. Your rights

You have the right to ask for access to your information, correction of anything inaccurate, erasure, restriction of processing, portability where it applies, and to object to certain processing. You may withdraw consent at any time, and you may complain to the Information Commissioner's Office at ico.org.uk.

I may need to verify your identity before acting on a request. I will normally respond within one month.

14. Safeguarding and legal disclosure

If the law requires it, or if it is necessary to protect a child from harm, I may need to disclose information to the appropriate authority. In that situation I disclose the minimum necessary.

15. What I do not do

I do not sell personal information, and there is no automated decision-making and no diagnosis. Every written service is prepared and decided by a person.

16. Changes to this policy

This policy was last updated on 8 October 2026. If it changes materially, I will tell you before the change affects you.