Privacy Policy

1. Who we are

Chapter Technologies Ltd is the data controller for personal data processed through the Chapter Schools platform. We are registered in England and Wales.

Contact: hello@chapterschools.com
Platform: chapterschools.com

Where a school subscribes to Chapter Schools, the school acts as a separate data controller for its students, staff, and parents. Chapter Technologies Ltd acts as a data processor on behalf of the school for the purposes of delivering the Platform. This relationship is governed by our Data Processing Agreement (DPA), available at chapterschools.com/dpa.

2. What personal data we collect

School staff (careers leads, teachers, admins)

• Name and email address
• Job role and school affiliation
• Platform activity and usage logs
• Account preferences and settings

Students

• Name, year group, form group, and date of birth (where provided)
• School email address — where a student voluntarily adds and verifies their school email address within the Chapter student app, this is used to link their Chapter account to their school record on the Chapter Schools platform. This linking is student-initiated and confirmed via a one-time verification code sent to the school email address.
• Career exploration activity, interests, and goals (from the Chapter student app)
• Gatsby Benchmark evidence generated through school activities
• Guidance session records and notes
• UCAS application data (sixth form — subject to school enabling this feature)
• NEET risk indicators (computed, not stored as a categorical label)
• Work experience placements and apprenticeship exploration activity

Parents and guardians

• Name and email address (provided by the school or by the parent during registration)
• Communication preferences
• Email engagement data (opens, clicks) via Resend

Usage data (all users)

• IP address and device/browser information
• Pages visited and features used
• Session duration and interaction logs

3. How we use personal data

We use personal data to:

• Deliver and maintain the Chapter Schools platform and its features
• Enable Gatsby Benchmark tracking and Ofsted evidence reporting for schools
• Support careers guidance, lesson planning, and student career development
• Link a student's Chapter app account to their school record, where the student has verified their school email address and consented to this connection
• Send parent digest emails and school communications
• Generate AI-powered insights, lesson plans, and worksheet content
• Process payments and manage school subscriptions via Stripe
• Provide customer support and platform onboarding
• Improve the platform through anonymised analytics
• Comply with legal obligations

Legal basis for processing

• Contract: Processing necessary to deliver the service to subscribed schools
• Legitimate interests: Platform security, fraud prevention, service improvement
• Legal obligation: Compliance with safeguarding and data protection law
• Consent: Where we send optional marketing communications (school contacts only)

4. AI processing and Anthropic

Chapter Schools uses Anthropic's Claude AI to power features including Chappy (our AI assistant), lesson plan generation, worksheet creation, student insight summaries, and guidance session recommendations.

When AI features are used, relevant context (such as lesson topics, anonymised student cohort data, or guidance notes) may be sent to Anthropic's API. We do not send identifiable student personal data (names, dates of birth, contact details) to Anthropic. Anthropic processes data in accordance with their privacy policy and API usage terms.

AI-generated content is always presented to the user for review before being saved or shared. No automated decisions with legal or significant effect are made solely by AI.

5. Data sharing and sub-processors

We use the following third-party sub-processors to deliver the Platform:

• Supabase (PostgreSQL database and authentication): Data stored on servers within the EU (Ireland). supabase.com
• Vercel (web hosting and deployment): Application hosted in the EU region. vercel.com
• Anthropic (AI features): API-based, no persistent student data stored. anthropic.com
• Resend (transactional email): Used for invitations, parent digests, and notifications. resend.com
• Stripe (payment processing): Used for school subscription billing. No student data is shared with Stripe. stripe.com

We do not sell personal data to third parties. We do not share personal data with third parties for their own marketing purposes.

Where data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTAs).

6. Data retention

• Student data: Retained for the duration of the school's subscription. Upon termination, schools may request a data export; data is deleted from our systems within 90 days of subscription end.
• Staff accounts: Retained until the account is closed or the school subscription ends.
• Parent accounts: Retained until the parent requests deletion or the school subscription ends.
• Billing records: Retained for 7 years in accordance with UK financial record-keeping requirements.
• Audit logs: Retained for 12 months for security and compliance purposes.

7. Children's data

Chapter Schools processes personal data relating to children (students under 18). We treat this data with the highest level of care and apply the following protections:

• Student data is only accessible to authorised school staff with appropriate roles
• No student data is used for advertising or profiling for commercial purposes
• AI features do not process individual identifiable student data
• Schools are responsible for ensuring they have appropriate lawful basis to share student data with Chapter Schools (typically public task or legitimate educational interest)
• Parents/guardians may request access to or deletion of their child's data via their school's careers lead

8. Your rights

Under UK GDPR, individuals have the following rights:

• Right of access: Request a copy of your personal data
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your data (subject to legal obligations)
• Right to restriction: Request we limit how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Rights related to automated decision-making: We do not make solely automated decisions with significant legal effects

To exercise any of these rights, contact us at hello@chapterschools.com. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit (TLS/HTTPS) and at rest
• Row-level security policies in our database (users can only access data they are authorised to see)
• Role-based access control across all features
• API authentication using JWT tokens with short expiry
• Regular security reviews and dependency updates

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify school administrators of material changes via email or in-platform notification at least 30 days before they take effect.

The current version is always available at chapterschools.com/privacy.

11. Contact

For any privacy-related queries, data subject requests, or to request our Data Processing Agreement:
Email: hello@chapterschools.com
Subject line: Privacy / Data Request