Privacy Policy
Owner: DPO | Effective date: 10 September 2026
Next review: September 2027
This notice explains how SENDlink LTD trading as Student Radar handles personal data and how to raise a question or exercise a right. For school records, the school or trust normally decides why and how information is used and acts as controller. We process those records on its instructions.
School information and sources
Depending on the school’s authorised use, records may include pupil identity, attendance, assessments, SEND and health information, safeguarding records, attachments, communications, staff accounts and family contacts. Sources include the school’s MIS integration through Wonde, authorised staff and the family or other input routes used by the school.
Some records contain special-category information or criminal allegations. The school identifies the lawful basis, relevant sensitive-data conditions and safeguards, and explains its processing in its own privacy information. A subscription agreement does not replace those requirements.
Our own business information
We act as controller where we determine a separate purpose for our business-contact, enquiry, contractual and billing records. Handling information on a school’s instructions remains processor activity.
| Purpose | Lawful basis and retention |
|---|---|
| Enquiries and business relationships | Legitimate interests in answering enquiries and managing the relationship, balanced against individual rights. Retained only while needed. |
| Contract administration | Legitimate interests in administering and evidencing the agreement. Policy period: agreement plus six years. |
| Accounting and tax | Applicable legal obligations and the relevant statutory retention period. |
| Our own service security | Legitimate interests in protecting the service, with minimisation. Security logs: 90 days; diagnostics: 30 days. |
These purposes do not authorise unrelated reuse of school pupil narratives. Our contact details appear at the end of this notice.
AI and analysis
AI is included in the service to help staff explore information and prepare drafts. Authorised staff review the sources, limitations and output before use, and can amend or reject it. AI does not determine a diagnosis, SEND status, safeguarding action or another significant decision automatically.
Analysis can involve profiling even where a person makes the decision. The school explains the features it uses and the role of staff judgement. Minimised or pseudonymised inputs remain personal data where they can identify or be linked to a person.
We prohibit AI providers from training their models on school Personal Data and require no retained input or output content, including abuse-monitoring copies. These controls apply to the authorised AI features and transcription modes under the DPA. Changes to those arrangements require assessment and the school’s prior written authorisation.
Providers and international processing
Providers include Supabase for database, authentication, storage and applicable execution; Vercel for delivery, analytics and monitoring; Wonde for MIS integration; OpenAI for AI assistance; Brevo for email; and AssemblyAI for authorised transcription. Twilio, Sentry and Contentsquare apply where used. Recipients receive the contact, communication, audio, attachment, device or interaction information needed for the authorised service.
Our location policy keeps the primary school-record database, file storage and their backups in the United Kingdom. Other processing, including email delivery, AI and provider support, is limited to the providers, purposes and locations authorised in the DPA. UK primary storage does not mean that all processing takes place in the UK.
Brevo publishes EU hosting locations in France, Germany and Belgium. Provider locations, support access and onward processing are recorded in the authorised DPA schedule. Restricted transfers rely on applicable UK adequacy regulations or appropriate safeguards, with the assessment required for that mechanism. Ask dpo@studentradar.com for information about the relevant safeguards.
Retention and protection
The DPA requires return of school Personal Data and deletion of remaining live copies, or deletion at the school’s choice, within 30 days of termination. It requires a 30-day rolling backup cycle and final expiry of isolated residual copies by day 60 from termination. Deleted records must be excluded from new backups, and deletion instructions reapplied before restored data returns to use.
Our retention rules are 30 days for diagnostic and request logs, 90 days for security and authentication logs and 12 months for truly anonymous analytics. Diagnostic logs must exclude pupil narratives and AI prompts. School-record audit history and saved AI material follow the associated record and DPA exit terms.
The school arranges continued custody of records it needs after exit. Limited retention required by law remains protected under the DPA. Our Information Security Policy describes the required access, encryption, development and incident standards.
Your rights
Depending on the processing, you may have rights of access, correction, erasure, restriction, objection and portability. Portability applies to qualifying automated processing based on consent or contract; it is separate from the school’s service export facility. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.
For school-controlled information, contact the school first or ask us to forward your request. The school assesses a child’s competence and any representative’s authority. We handle requests about our own controller records. Rights requests normally require a response within one calendar month, subject to applicable lawful adjustments or extensions.
Our target for assisting a school with a subject-access request is five working days, with a maximum of 10 calendar days and faster assistance where its statutory deadline requires it. The school determines the response, exemptions, redactions and authority of anyone acting for the individual.
Cookies and device storage
Authentication and security use cookies or device storage. Optional analytics and monitoring include Vercel, Sentry and Contentsquare where enabled. Optional analytics load after analytics consent. You may refuse optional analytics or withdraw consent. Contact dpo@studentradar.com for help with your preferences or information about these technologies; browser controls can affect sign-in.
Cookie and device-storage settings are separate from the retention periods for service records. Contact us for information about the technologies used, their providers, purposes and lifetimes.
Complaints and contact
Raise a privacy complaint at dpo@studentradar.com. We acknowledge complaints within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay. This does not extend the deadline for a rights request.
You can also seek advice or raise a concern with the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. The DPO reviews this notice annually and when our processing changes. Continued use is not treated as consent to new purposes or undisclosed transfers.
Contact
SENDlink LTD trading as Student Radar | Company number 16602655
dpo@studentradar.com | support@studentradar.com
10 Masefield Gardens, Plymouth, PL5 3HU | www.studentradar.com
Public website tools and Inkwell
The following information covers enquiries, public tools and Inkwell registration and licensing on this website. School-record processing is described in the policy above and the Data Processing Agreement.
Information we use
| Category | Examples | Source |
|---|---|---|
| Enquiry and application data | Name, work email, school, role, phase, pupil roll, MIS, selected capabilities and optional business priorities or notes; for a tagged demo journey, allowlisted campaign labels, landing route and Google click ID if present | Information you submit to a contact, demo or Pathfinder form, together with campaign parameters already present in the landing URL |
| Inkwell registration and licensing data | Business contact email, organisation name if supplied, exact production origin, public application ID, licence tier, registration date, subscription status and last-seen bundle version | Information submitted by the registering organisation, together with Stripe subscription events for paid licences |
| Sensory PDF / estimate request | Email address and optional role; for an inclusion-funding estimate, optional school, local authority and calculator totals | Information you submit to receive the requested output |
| Public Echo input | The bounded tapped phrase and ordered button labels or vocalisations you choose to interpret | Submitted only when you select Interpret |
| Public Sensory Profiler input | Generic sensory domain, pattern and behaviour catalogue selections. The generation API rejects name, school, SEND status, year group, setting, self-advocacy and free-text fields | Submitted only when you select Generate |
| Public Compare PDF context | Optional school name, pupil roll, setting and decision note, together with the comparison result | Submitted only when you request the PDF; not placed in the shareable URL |
| School-lookup query | The school name or search text you enter | Submitted only when you search the public school directory |
| Technical and security data | Request time, route, browser/device category, approximate country/region, referrer, security events and server logs that may include IP address | Hosting, security and browser request data |
| Website measurement | Page route, timestamp, referrer, device/browser category, country/region, Core Web Vitals and approved non-personal interaction identifiers | Vercel Web Analytics, Vercel Speed Insights and allowlisted marketing events |
Do not submit pupil records, safeguarding details, medical information or confidential case material through public enquiry forms. Do not include names or other identifying details in Echo. The Sensory Profiler is designed to prevent pupil context and free text from entering its generation route.
Public forms
We collect the fields you submit. When you arrive through a tagged campaign and complete a demo request, the lead also carries an allowlisted set of UTM labels, the original landing route and a Google click ID if one was present. Unrelated query parameters are not copied into the lead. Public lead routes apply same-origin checks, strict field and body-size limits, a honeypot and shared rate limits. Personal form values and campaign query values are not included in API error logs or marketing-event properties.
Inkwell registration and billing
Registering a real production origin sends the business contact email, optional organisation name and exact HTTPS origin to Student Radar. A public application ID is deterministically derived from that origin; it identifies the registration but is not a password or authentication credential. Paid Product and Scale subscriptions use Stripe-hosted payment fields so card details do not enter Student Radar application code.
A licence check sends only the public application ID, exact registered origin and bundle version. Inkwell performs document detection locally in the browser. Student Radar does not receive document text, pupil data, findings, snippets, hashes or counts through registration or licence checks.
Public tools
The public AI tools make no provider request merely because you view the page. Echo calls the provider only when you select Interpret. Sensory Profiler calls the provider only when you select Generate. Compare and PDF routes run only when you request the corresponding output.
Why we use public-service information
| Purpose | Our role | Basis or instruction |
|---|---|---|
| Respond to an enquiry, arrange a demo, understand the source of that requested contact or administer a Pathfinder application | Controller | Legitimate interests in responding to the request, taking steps towards a potential service relationship, understanding which campaign led to an accepted enquiry and administering the programme. Any mandatory acknowledgement in the form confirms the stated programme terms; it is not consent to unrelated marketing. |
| Deliver requested Sensory PDF access or an inclusion-funding estimate | Controller | Legitimate interests in delivering and supporting the output you asked for. The email is not treated as marketing consent. |
| Register and administer an Inkwell production origin, paid licence and billing relationship | Controller | Taking steps towards or performing the requested licence contract, legitimate interests in operating the registration service, and legal obligations for tax and accounting records. |
| Provide public Echo interpretation and speech | Controller | Legitimate interests in providing the user-triggered service and preventing abuse. The service is not intended for identifiable health, safeguarding or criminal-offence data. |
| Provide public Sensory generation and PDF rendering | Controller | Legitimate interests in providing the user-triggered service and preventing abuse. The generation payload is limited to anonymous catalogue selections. |
| Render a Compare business-case PDF or return public school-directory results | Controller | Legitimate interests in providing the requested buyer tool. The routes do not create a persistent user profile. |
| Protect, troubleshoot and maintain the services | Controller for public services; processor where done for the school platform | Legitimate interests in security, availability and fault diagnosis, or the controller's documented instruction. |
| Measure public-site use and performance | Controller | Legitimate interests in understanding aggregated page use, approved funnel steps and performance so we can improve the site. The current measurement is cookieless and is not used for advertising. |
| Maintain contracts, accounting and legal records | Controller | Legal obligations and legitimate interests in administering agreements and establishing or defending legal claims. |
If special category data is processed in the school platform, the school must identify both an Article 6 basis and an Article 9 condition and, where applicable, a DPA 2018 Schedule 1 condition. Student Radar does not publish a blanket statement that one school condition applies to all customers or all records.
Public Echo
Echo sends the tapped phrase and ordered button labels or vocalisations to the Student Radar server. The server sends a purpose-limited prompt to the OpenAI Responses API with store:false, then sends the generated short utterance to the OpenAI audio speech endpoint. Generated text and audio may be held in a volatile Student Radar process-memory cache for up to 10 minutes. This route does not write the request or output to the Student Radar database.
Public Sensory Profiler
The profiler sends generic catalogue selections to the Student Radar server. The server sends a purpose-limited prompt to the OpenAI Responses API with store:false, validates the response and uses curated fallback content if necessary. Validated output may be cached in volatile process memory for up to 10 minutes.
The server signs the generated profile content with an HMAC-SHA256 token that expires after 10 minutes. PDF rendering accepts only the anonymous selections, unchanged generated content and valid token. Unsigned, expired, modified or client-authored profile text is rejected. PDF rendering is local to Student Radar and does not call OpenAI.
What store:false means
store:false means that Responses application-state storage is not requested for these public calls. It is not the same as Zero Data Retention. OpenAI states that default abuse-monitoring logs may contain API content and may be retained for up to 30 days unless an approved Modified Abuse Monitoring or Zero Data Retention control applies. These public tools do not claim Zero Data Retention.
OpenAI states that business/API inputs and outputs are not used to train its models by default unless the organisation opts in to data sharing.
Additional public-service providers
| Provider | Purpose |
|---|---|
| Upstash | Short-lived HMAC-pseudonymised public-API rate-limit counters, plus Inkwell Free registration and last-seen licence records in the configured London region |
| Stripe | Secure paid Checkout, subscription and billing administration, tax calculation and paid Inkwell licence metadata |
Retention for public tools and Inkwell
- public Echo and Sensory generated server cache: up to 10 minutes in volatile process memory;
- Sensory PDF signature: 10 minutes;
- OpenAI public-tool abuse-monitoring logs: up to 30 days by default, notwithstanding
store:false; - Upstash rate-limit keys: a little over two minutes after the one-minute policy window;
- Inkwell registration and licence records: while the origin remains registered or licensed and until no longer needed for administration; related contract, billing and accounting records may be kept for up to six years after the relationship ends where required;
- inactive public enquiries: reviewed under the enquiry schedule and not retained indefinitely by default.
Browser storage
For the public website and public-tool storage inventory, including clearing instructions, see the Cookie, Client Storage and Telemetry Notice.