Legal
How we collect, use, and protect your information. Written in plain English.
We handle school communications on behalf of parents. That means we take data seriously. This policy explains exactly what we collect, why, and what we do with it — no legal jargon, no surprises. Questions? Email rav@parentplan.ai.
Parent Plan is operated by AJ Strategies Ltd, a company registered in England and Wales.
Contact:
Email: rav@parentplan.ai
ICO Registration Number: C1904430
If you have any questions about how we handle your data, email us at rav@parentplan.ai. We aim to respond within 2 working days.
When you sign up, we collect your name, email address, and WhatsApp phone number. We use this to create your account and deliver your summaries.
We ask for your children's first names, year groups, and school. We use this to personalise your summaries to what's relevant for your family. We do not ask for or store any other information about your children.
When you forward a school email to your Parent Plan address, we receive and process the email and any attachments. We extract the relevant dates, events, and actions from the content. The raw email and attachments are automatically deleted 28 days after we receive them.
If you choose to connect your Gmail or Outlook inbox instead of forwarding emails, we ask for read-only access to your mailbox (Google scope: gmail.readonly; Microsoft permission: Mail.Read). We use this access for one purpose only: to find and read emails from your child's school — senders you confirm during set-up — so we can extract the dates, events, and actions that go into your WhatsApp summary. This includes reading the full text of those school emails and any attachments (for example, PDF newsletters).
We check for new school emails about every five minutes. We only process messages from the school senders you have confirmed — everything else in your inbox is ignored and never stored. We cannot send, modify, or delete anything in your mailbox: the access is read-only.
Your connection is secured with an encrypted token stored in our EU (Ireland) database. You can disconnect at any time from your account page or by revoking Parent Plan's access in your Google or Microsoft account settings — revoking takes effect at our next check, within a few minutes.
We use Stripe to handle all payments. We do not store your card details. Stripe handles all payment processing and is PCI-DSS compliant. We retain a record of your subscription status and payment history for accounting purposes.
We collect basic technical logs (delivery status, error logs) to keep the service running. We do not use tracking cookies or behavioural analytics.
Under UK GDPR, we must have a lawful basis for processing your personal data. Here is our basis for each category:
Purpose: To provide and deliver the service
Lawful basis: Contract — necessary to perform our agreement with you
Purpose: To personalise summaries to your child
Lawful basis: Contract — necessary to perform our agreement with you
Purpose: To extract relevant information and generate your summary
Lawful basis: Contract — necessary to perform our agreement with you
Purpose: To manage your subscription
Lawful basis: Contract and Legal Obligation
Purpose: To maintain service reliability and debug issues
Lawful basis: Legitimate Interests — keeping the service running securely
We do not use your data for marketing to third parties. We do not sell your data. Ever.
Whether an email reaches us by forwarding or through a connected inbox, the same automated process applies:
No human reads your emails. All processing is fully automated. Our system automatically identifies the relevant information. We improve our system's accuracy using our own test material, not the content of your inbox. We never use your email content to train generalised AI or machine-learning models, and we never share it beyond what is needed to generate your summary.
School emails we receive — whether forwarded or collected from your connected inbox — are automatically deleted 28 days after we receive them, including any attachments. The extracted information that powers your summaries (dates, events, and actions) is retained in line with Section 7 so your summaries keep working, but the original email and its attachments are gone after 28 days.
You are the parent or guardian of the children on your account. By adding your children's details, you confirm you have the right to do so.
We process your children's information on your behalf, under your direction, as part of the service you have signed up for. We extract only information that is relevant to their year group from school communications. We do not build profiles on your children. We do not share their information with any third party except as described in Section 6.
School emails may contain references to other children. We do not extract, store, or process information about children who are not on your account.
We use a small number of trusted third-party services to operate Parent Plan. Each is listed below with their role and where your data is processed.
| Provider | Role | Data location |
|---|---|---|
| Supabase | Database — stores your account, children, and extracted items | EU (Ireland) |
| Railway | Application hosting | EU |
| ImprovMX | Email forwarding — receives your forwarded school emails | EU |
| Anthropic (Claude API) | AI extraction — processes email content to extract relevant information | USA (SCCs in place — see note) |
| Meta (WhatsApp Cloud API) | Delivers your WhatsApp summaries | USA (SCCs in place — see note) |
| Stripe | Payment processing | USA (SCCs in place — see note) |
| Twilio | SMS verification (one-time codes only) | EU |
Note on USA-based processors: Anthropic, Meta, and Stripe are US-based companies. Each has signed Standard Contractual Clauses (SCCs) with us, which is the approved UK GDPR mechanism for international data transfers. Each operates under robust data protection commitments. We have reviewed their data processing agreements and are satisfied they meet UK GDPR requirements.
We do not share your data with any other third parties, including advertisers, data brokers, or analytics companies.
Parent Plan's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In plain terms, for data we receive from your connected Google account:
When you delete your account, we begin the deletion process immediately. All personal data is removed within 30 days, except payment records which we are legally required to retain.
Under UK GDPR, you have the following rights:
To exercise any of these rights, email us at rav@parentplan.ai. We will respond within 30 days.
Parent Plan uses only essential session cookies to keep you logged in to your account. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. No cookie consent banner is required because we only use strictly necessary cookies.
If we make significant changes to this policy, we will notify you by email and by WhatsApp message before the changes take effect. The date at the top of this page always shows when it was last updated.
AJ Strategies Ltd
rav@parentplan.ai
ICO Registration Number: C1904430