Privacy Policy & GDPR Statement

• Account information: Your name and email address when you register
• SEND Passports: Personal, medical, sensory, communication, and emergency contact information you voluntarily enter about yourself or a family member (including a child)
• Family Management data: Calendar events, diary entries, sensory logs, and mood records you create — which may include health, medical, and wellbeing information
• Forum posts: Content, display name, and email associated with topics and replies you post
• Service reviews: Your name and review text when you submit a service rating
• Contact form submissions: Your name, email, and message
• Favourites: Saved services stored locally in your browser
• Payment information: Handled securely by Stripe — we never store card details

We process your data under the following lawful bases (UK GDPR Article 6):

• Consent: When you create an account or voluntarily enter data
• Contract: To provide the services you have signed up for
• Legitimate interests: To improve platform safety and performance

For Special Category data (health, disability, and wellbeing information — including data about children), the additional lawful basis is explicit consent under UK GDPR Article 9(2)(a). You provide this consent by voluntarily entering such information into the platform.

• Platform is SOC 2 Type II certified and ISO 27001 certified
• All data is encrypted at rest (platform-level) and in transit (HTTPS/TLS)
• SEND Passport and Family Management data use row-level security (RLS) — only the account owner can read, update, or delete their own records, enforced at the database level
• Passport sharing requires explicit per-request approval from the owner
• Payments are processed by Stripe (PCI DSS Level 1 compliant) — we never store card numbers
• Authentication uses secure session tokens; passwords are never stored in plain text
• Administrative operations use a separate service-role context, distinct from user-level access
• Regular security scanning detects permission gaps, exposed credentials, and vulnerabilities

For a full breakdown of security measures, see our Data Security Statement.

We do not sell your personal data. Data is only shared with the following vetted third-party providers as needed to deliver specific features:

• Stripe: Payment processing — receives transaction and billing metadata only. No passport, health, or personal profile data is shared.
• Resend: Transactional email delivery — receives the email address and message content needed to send emails you've requested (contact form replies, share request notifications, reminders).
• ElevenLabs: Text-to-speech audio generation — receives the text you ask to be spoken aloud, which could include personal content.
• AI / LLM Provider: Generates the Lost & Found emergency breakdown and powers the Buddy agent — receives relevant passport or conversation data needed to produce a response. Data is not used for model training.
• Third parties only where required by law or a court order

Children's sensitive data (SEND Passport, diary, sensory logs) is never sold, shared with advertisers, or used for profiling. It is only sent to the AI/LLM provider when you (or someone you've shared a passport with) actively trigger the Lost & Found emergency feature.

• Account data: Retained while your account is active; deleted on request
• SEND Passports: Retained until you delete them from your account
• Family Management data (calendar, diary, sensory logs): Retained until you delete them
• Forum posts & reviews: Retained until deleted by you or our moderation team
• Contact form data: Retained for up to 12 months
• Approved passport share records: Retained for 30 days then purged automatically

You (and parents/guardians acting on behalf of a child) have the following rights:

• Right of access: Request a copy of the data we hold about you or your child
• Right to rectification: Ask us to correct inaccurate data
• Right to erasure: Ask us to delete data ("right to be forgotten")
• Right to restrict processing: Ask us to limit how we use data
• Right to data portability: Request data in a portable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: At any time — withdrawal does not affect prior lawful processing
• Rights of the child: Children have independent rights under UK GDPR. Where a child is old enough to understand, their views should be considered when exercising these rights

To exercise any right, please contact us. We will respond within 30 days.

We use minimal browser storage. Favourites are stored in your browser's local storage only — they are not sent to our servers. We do not use advertising or tracking cookies. Essential session cookies are used only to keep you logged in.

If you have questions, wish to exercise your rights, or have concerns about how your child's data is handled, contact us at:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
ico.org.uk | 0303 123 1113

Children's Commissioner: For concerns specifically relating to children's data rights, you may also contact the Children's Commissioner for England.