Privacy Policy

The School Gate is a private beta product operated by Dora Papp-Sutcliffe (“we”, “us”). This policy explains what personal data we collect, why, and what your rights are under UK GDPR.

Who is responsible for your data

The data controller is Dora Papp-Sutcliffe, operating The School Gate. You can reach us at hello@schoolgatehq.com.

What data we collect

We collect the minimum necessary to run the service:

• Your email address and name (from sign-up).
• The school sender email addresses and school names you add during setup.
• Children's first names and year groups that you provide.
• Email content from the specific school senders you authorise — subject lines, body text, and PDF attachments only. We never read any other email in your inbox.
• Structured information extracted from those emails: dates, events, tasks, and notices.
• Your OAuth connection tokens (stored encrypted) to access Gmail or Microsoft 365.

What we do with your data

We use your data solely to provide the service: parsing school emails, extracting relevant information, and displaying it to you. We do not use your data for advertising, profiling, or any purpose beyond delivering The School Gate to you.

Who we share it with

We use a small number of third-party processors to run the service:

• Supabase — database and authentication. Data is hosted in the EU.
• Vercel — hosting and serverless functions.
• Anthropic— AI extraction of structured information from email content. Email content is sent to Anthropic's API for this purpose only and is not used to train their models under our agreement.
• Google / Microsoft — only to read the school emails you authorise, via OAuth. We do not share your data with them beyond what is required for the connection.

We do not sell your data. We never will.

How long we keep your data

We keep your data for as long as your account is active. You can delete your account at any time from Settings › Account. Deletion is permanent: all personal data, email records, and extracted items are removed within 30 days.

Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Object to processing or request restriction.
• Data portability (receive your data in a machine-readable format).
• Withdraw consent at any time (where processing is based on consent).

To exercise any of these rights, email us at hello@schoolgatehq.com. We will respond within 30 days.

Cookies and tracking

We use a session cookie for authentication only. We do not use advertising cookies, tracking pixels, or analytics that identify you individually.

Security

OAuth tokens are stored encrypted at rest. All data is transmitted over HTTPS. We do not store your email account password.

How to complain

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. We would always prefer to resolve concerns directly first — please email us.

Changes to this policy

We may update this policy as the service develops. Material changes will be communicated by email before they take effect.