DRAFT for review — not legal advice and not yet in force. Text in [square brackets] is still to be filled in.
Privacy policy
Draft of 16 October 2026.
This policy explains what personal data School Wisely handles when you use this website (schoolwisely.co.uk) and the map app (schoolwisely.co.uk/map/), why, who else sees it, how long it is kept, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Who we are
School Wisely is run by [Controller name], an individual based in the UK (“we”, “us”). [Controller name] is the “controller” of the personal data described here: we decide why and how it is used.
- Email: [Contact email — e.g. privacy@schoolwisely.co.uk]
- Post: [Postal address — a business address service is fine]
- Registered with the Information Commissioner's Office (ICO): [ICO registration number — pending]
The short version
- You can use the website and the map without an account and without telling us anything about yourself.
- We use no analytics, no advertising and no tracking cookies, and we never sell personal data.
- If you sign in, we hold your email address so you can sign in. If you join a waitlist, we hold your email address to tell you when that feature is ready, and for nothing else.
- We do not collect any information about your children.
- A few services we rely on receive your device's IP address when your browser loads things from them. They are listed below.
- You can ask for a copy of your data, have it deleted, object, or complain — see “Your rights”.
What this website collects
The public pages (home, areas, schools, about) are plain web pages. They have no sign-in, no scripts, no cookies and no forms that send us anything. The search box on the home page simply opens the map with what you typed in the page address (for example /map/?q=…).
Like every website, our host Cloudflare processes your IP address and the details of each request (the page asked for, your browser type, the time) to deliver the page and to protect the site against attacks. We do not keep logs of who visited which page. Cloudflare's dashboard shows us traffic totals (such as the number of requests and the countries they came from) and, for requests its security checks block or challenge, details including the IP address. We look at these only to keep the site working and secure.
The map app: postcode searches, sign-in and waitlists
Postcode searches and the address check
When you search for a postcode, your browser sends that postcode straight to postcodes.io, a free postcode lookup service run by Ideal Postcodes, to find where it is. When you check an address, the app then sends that postcode, its location and its area codes to our database to work out which schools and priority areas are nearby. We do not store the postcode, save it to an account or link it to you. postcodes.io receives the postcode and your IP address under its own terms.
Signing in (optional)
Where the app offers sign-in, it works with a link sent to your email address (a “magic link”); there is no password. Our database and sign-in provider, Supabase, sends that email for us and then holds your email address, an account number, when you signed up and last signed in and, for security, the IP address and browser details of your sign-ins. Today an account is only used to fill in your email address on waitlist forms. If we add features that store more (such as a saved shortlist), we will update this policy first.
Waitlists for paid features
Some panels in the app describe paid features that are not ready yet and let you join a waitlist. If you do, we store your email address, which feature you asked about, the school page you were on (if any), the date, and your account number if you were signed in. We use this only to email you about that feature when it is ready, and to count how many people are interested in each feature. Any email we send will say it is from School Wisely and let you unsubscribe in one step. We do not add you to any other mailing list, use your address for any other marketing, or share it. We delete your entry whenever you ask, and with your account if you were signed in.
Feedback
The "Send feedback" form in the app (linked from every page of this website) stores your message, the page or screen you sent it from, the school it is about (if any), the date, your account number if you were signed in, and, only if you give it, your email address. We use the message to fix mistakes and improve School Wisely (legitimate interests: running and improving the service you are using), and the email address only to reply to you (consent: leave it out if you don't want a reply). Please don't put anything about your children or other personal details in the message. We keep feedback for [12 months — proposed], then delete it; sooner if you ask, and with your account if you were signed in. It is stored in our database (Supabase, London) and not shared.
What we do not collect
We do not ask for your name, phone number, home address, payment details or your device's location, and we collect nothing about your children. Information about children (such as a date of birth for admissions) belongs to a paid planner that is not available yet; this policy will be updated, with any consent it needs, before that launches.
Do you have to give us anything?
No. Nothing on School Wisely requires personal data, and no law or contract requires you to provide it. Without an email address you cannot sign in or join a waitlist; everything else works the same.
People named in school information
We republish facts from schools' and councils' own published documents, such as admissions policies and admissions contact details. Occasionally these name a member of staff or a governor (for example an admissions officer or the clerk to the governors) or give a work email address or phone number. We take these only from documents the school or council has published, show them only as part of that school's admissions information with a link to the source, and keep an archived copy of each document as it was published. Our lawful basis is legitimate interests: giving parents accurate admissions information they can check against its source. If you are named and would like something corrected or removed, email [Contact email — e.g. privacy@schoolwisely.co.uk]; you also have the rights below, including the right to object.
Why we use it and our lawful basis
| What | Why | Lawful basis |
|---|---|---|
| IP address and request details | Delivering the website and app, keeping them secure | Legitimate interests: running a working, secure service |
| A postcode you search or check | Finding the place and the schools near it, at your request; not stored | Legitimate interests: giving you the answer you asked for |
| Email address, account number, sign-in times | Providing the account you asked for | Contract: providing the service you signed up to |
| Sign-in IP address and browser details | Preventing misuse of accounts | Legitimate interests: keeping accounts secure |
| Waitlist email, feature, school page | Telling you when that feature is ready; counting interest | Consent: you can withdraw it at any time |
| Names and work contact details in schools' published documents | Showing sourced admissions information | Legitimate interests: accurate, checkable information for parents |
| Emails you send us (questions, requests, complaints) | Answering you and keeping a record of what we did | Legitimate interests: answering you; legal obligation for rights requests and complaints |
Where we rely on legitimate interests, we have checked that the use is one you would expect, uses as little data as possible, and does not override your interests.
Services that receive requests from your browser
Loading the app means your browser fetches some things from other services. Each of them receives your IP address and the usual technical details your browser sends (browser type, and only our site's name as the referring page, never the full address). None of them receives your email address. Cloudflare and Supabase work for us (see the next section); the others are independent services that answer your browser directly, under their own privacy policies.
| Service | What your browser gets from it | What it sees |
|---|---|---|
| Cloudflare | This website, the app and the map data (our host) | IP address, pages and files requested |
| Supabase | School details and the address check; sign-in and waitlists (our database, in London) | IP address, requests; your account and waitlist data as described above |
| postcodes.io | Postcode lookups | IP address and the postcode you searched |
| OpenFreeMap | The base map (streets, places, labels), its fonts and styles | IP address and which part of the map you are viewing (its policy says its access logs leave out IP addresses and are deleted after 7 days) |
| The app's drawing engine and fonts (www.gstatic.com, fonts.gstatic.com), part of the Flutter framework the app is built with | IP address and the files requested | |
| unpkg | The map library's code (MapLibre) | IP address and the files requested |
How long we keep data
| Data | Kept for |
|---|---|
| Your account (email, account number, sign-in times) | Until you ask us to delete it [or after 24 months without signing in — to be decided] |
| Sign-in security records (IP address, browser) | [90 days — to be approved] |
| Waitlist entries | Until the feature is ready and we have emailed you, then deleted within [3 months — to be approved] ; sooner if you ask. Entries made while signed in are deleted with your account. |
| Postcodes you search or check | Not stored by us |
| Names and work contact details in schools' documents | Shown while they are part of the current published information. Archived copies of documents are kept as the record of what was published, and removed on a valid request. |
| Emails you send us | As long as needed to answer you, then [up to 2 years — to be approved] as a record |
| Request logs at Supabase | 1 day (Supabase's free plan, which we use now); 7 days if we move to its paid plan |
| Database backups | None at present (the free plan has none). On a paid plan, daily backups are kept for 7 days, so deleted data disappears from them within a week |
| Request logs at Cloudflare | We keep none; Cloudflare keeps its own security logs under its policy |
Your rights
You have the right to:
- get a copy of the personal data we hold about you;
- have it corrected if it is wrong;
- have it deleted (for example your account or a waitlist entry);
- ask us to restrict how we use it;
- receive the data you gave us in a portable format;
- withdraw your consent to the waitlist at any time (this does not affect what we did before);
- complain to us and to the ICO (see below).
Your right to object
Where we rely on legitimate interests (see the table above), you can object at any time to our using your data. We will then stop, unless we have compelling reasons that override your interests or need the data for a legal claim. We do not use personal data for direct marketing other than the waitlist email you asked for; if you object to that, we delete your entry.
To use any of these rights, email [Contact email — e.g. privacy@schoolwisely.co.uk], ideally from the address concerned. It is free. We may ask you to confirm it is you. We will answer within one month (up to two months more for complex requests, in which case we will tell you within the first month). We make no decisions about you by automated means and do no profiling.
Children
School Wisely is made for parents and carers, but anyone can read the website and use the map without giving us anything, including young people looking at schools or sixth forms. We do not track visitors, show adverts, use your device's location or build profiles of anyone. Accounts and waitlists are for adults (18 or over).
If you are under 18: you are welcome to look around, and nothing you do on the site is recorded about you. Please do not sign in or join a waitlist; ask a parent or carer instead. If you think a child has given us their email address, tell us and we will delete it.
Contact and complaints
Questions or concerns: [Contact email — e.g. privacy@schoolwisely.co.uk], or write to [Postal address — a business address service is fine]. If you are unhappy with how we have handled your personal data, please tell us first, by email or post; no special form is needed. We will acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome without undue delay.
You can also complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
Changes to this policy
We will update this policy before we collect anything new, and show the date of the latest version at the top. If a change affects data you have already given us, we will email you first.