Document version: 2026-09-26

Privacy Notice

This notice explains how School Fit Finder handles account data, assessment data, consultation requests, analytics events, and optional partner-contact flows in the current product design.

1. Data controller and scope

School Fit Finder operating team acts as the data controller for School Fit Finder. This notice explains how personal data is processed when a visitor uses the assessment, creates an account, views a protected result, or optionally enables school introductions.

This document should be reviewed together with the public support and terms pages so visitors can understand the difference between public guidance, member-only features, and optional lead sharing.

2. Data categories

  • Account data: full name, email address, password hash, verification records, session and security logs.
  • Assessment data: intake answers, assessment answers, calculated result, saved schools, and member-side history.
  • School-introduction data: the parent’s explicit introduction permission, verified parent email, parent name, curriculum, school stage, city, preferred area and budget range when the parent chooses to provide them.
  • Technical data: IP-derived security logs, browser/session identifiers, analytics events, page paths, and referrer information.

3. Purposes of processing

  • To provide the assessment, create and protect member accounts, and display the locked result only after sign-in.
  • To store the member result, respond to support requests, prevent misuse, and maintain system security.
  • To introduce a parent to selected matching schools only when the parent has separately and explicitly enabled school introductions. Child identity, date of birth, health/SEND information, raw assessment answers, detailed assessment profile, and browsing history are excluded from this sharing scope.
  • To measure conversion and product quality through analytics and conversion tracking.

4. Legal basis and collection method

Personal data is collected electronically through forms, cookies or similar technologies, security telemetry, and authenticated platform activity. The legal basis depends on the processing purpose and may include contract performance, legitimate interests, legal obligations, and explicit consent where required.

School-introduction permission and optional marketing communication are separated from the basic account and result flow. School-introduction permission is optional, does not control access to the result, and can be withdrawn later.

5. Recipients and transfers

If school introductions are enabled, limited parent contact data and parent-confirmed school-search criteria may be transferred to selected matching schools for admissions purposes within the recorded consent scope. Assessment answers and child personal or sensitive information are not part of that transfer. Infrastructure vendors, analytics providers, and email service providers may also receive limited data strictly as processors or service providers where required for operations.

If cross-border data transfer is involved, additional contractual or legal safeguards should be documented before production launch.

6. Retention

  • Account and security records are retained while the account remains active and for a reasonable follow-up period required for legal, audit, or security obligations.
  • School-introduction consent records and any resulting school-contact records are retained according to the active retention policy and may be deleted earlier after a valid erasure request when no overriding legal obligation applies.
  • Consultation requests, consent snapshots, and operational history are retained for up to 365 days by default, then automatically deleted unless a legal obligation requires longer retention.
  • Analytics events are retained in aggregated or event-level form only for the operational window defined by the operator.

7. Data subject rights

  • Request information about whether personal data is processed.
  • Request access, correction, deletion, restriction, objection, or portability where applicable.
  • Withdraw school-introduction permission or marketing consent without affecting prior lawful processing.

8. Contact and response handling

Privacy requests should be sent to privacy@schoolfitfinder.org. Operational help can be requested through support@schoolfitfinder.org. Terms-related notices can be sent to legal@schoolfitfinder.org.

Target first response window: within 2 business days.

Document version: 2026-09-26