Privacy Policy

Last updated: 15 March 2026

ParentInform ("we", "us", "our") is committed to protecting the privacy of parents, teachers, and school staff who use our service. This policy explains what data we collect, how we use it, and your rights under UK data protection law (UK GDPR and Data Protection Act 2018).

1. Who We Are

ParentInform is a school communication service that connects parents with their school via WhatsApp. Each school is the data controller for the information shared through the service. ParentInform acts as a data processor on behalf of the school.

For queries about this policy, contact us at: hello@parentinform.co.uk

2. What Data We Collect

Data	What We Store	Purpose
Parent phone number	Never stored. Immediately converted to a one-way cryptographic hash (SHA-256). The original number is discarded and cannot be recovered.	Identify returning users without storing personal data
Phone hash	Pseudonymised hash string	Session management, analytics (aggregated)
Messages sent by parents	Intent type only (e.g. "holiday", "lunch"). Message content is not stored except for feedback messages, which parents voluntarily submit.	Respond to queries, service improvement
Year group / class section	Optional. Stored if parent chooses to set it (e.g. "P2-B")	Provide class-specific information
School admin email	Email address for admin panel login	Magic link authentication
School information	Events, holidays, lunch menus, school info entered by staff	Answering parent queries

3. What We Do NOT Collect

• Children's names, ages, or any personal data about pupils
• Parent names or addresses
• Raw phone numbers (hashed immediately on receipt)
• Location data
• Device information
• Cookies or tracking pixels (our landing page uses no analytics or cookies)

4. Lawful Basis for Processing

We process data under the following lawful bases:

• Consent (Article 6(1)(a)): Parents opt in by voluntarily sending a JOIN message. They can withdraw consent at any time by sending STOP.
• Legitimate interests (Article 6(1)(f)): Schools have a legitimate interest in communicating effectively with parents about school activities.

5. Data Retention

• Parent sessions: Automatically expire after 90 days of inactivity. Parents can delete their session immediately by sending STOP.
• Message logs: Intent logs (not message content) are retained for up to 12 months for analytics, then deleted.
• Feedback messages: Retained until the school chooses to delete them.
• School data: Retained for the duration of the school's subscription. Deleted within 30 days of contract termination.

6. Data Sharing and Sub-processors

We use the following third-party services to operate ParentInform:

Service	Purpose	Data Shared	Location
Twilio	WhatsApp message delivery	Phone numbers pass through Twilio's infrastructure (not stored by us)	USA (EU SCCs in place)
Supabase	Database hosting	Phone hashes, school data, message intent logs	EU (AWS eu-west)
Cloudflare	Website hosting & DNS	No personal data	Global CDN

We do not sell, rent, or share personal data with any other third parties. We do not use parent data for marketing purposes.

7. International Transfers

Twilio (our WhatsApp messaging provider) is a US-based company. Messages pass through their infrastructure to reach WhatsApp. This transfer is covered by Standard Contractual Clauses (SCCs) as required by UK GDPR. Our database is hosted in the EU.

8. Your Rights

Under UK GDPR, you have the right to:

• Access: Request what data we hold about you
• Erasure: Send STOP to immediately delete your session, or contact us to request full deletion
• Rectification: Update your class by sending CLASS [your-class]
• Portability: Request your data in a portable format
• Object: Object to processing at any time
• Complain: Lodge a complaint with the Information Commissioner's Office (ICO)

To exercise any of these rights, email us at hello@parentinform.co.uk.

9. Children's Data

ParentInform does not collect any data about children. The service is designed for use by parents and school staff only. No pupil names, ages, or personal information is collected or stored.

10. Security

We take the security of your data seriously:

• Phone numbers are hashed using SHA-256 before any storage — the original number cannot be recovered
• All data is transmitted over encrypted connections (HTTPS/TLS)
• Database access is protected by Row Level Security (RLS)
• Admin access uses magic link authentication (no passwords to compromise)
• We follow the principle of data minimisation — we only collect what is strictly necessary

11. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. For significant changes, we will notify schools directly.

12. Contact

If you have any questions about this privacy policy or how we handle your data:

Email: hello@parentinform.co.uk
Website: parentinform.co.uk