PRIVACY NOTICE (UK/EU)

This Privacy Notice explains how Symplano ("we", "us") processes your information when you use our mobile app and website. We designed Symplano for parents and guardians, not children.

1. WHAT WE PROCESS

Account & Family

• • Parent/guardian name and email
• • Family member names and relationships
• • Children's first names and year groups only (no DOB required)
• • iOS waitlist email address (if you join the waitlist on our website)

Calendar & Scheduling

• • Events and activities you create
• • Reminder preferences (e.g., D‑1 @ 19:00)
• • Pack lists and activity rules (e.g., "PE kit on Tuesdays")

School Communications (when you enable parsing)

• • Content you choose to share (e.g., emails, WhatsApp, newsletters, PDFs)
• • We extract scheduling facts (dates, times, locations, child, item lists)
• • Originals are not retained beyond short‑lived processing buffers

Device & Telemetry (minimised)

• • Device IDs for secure login/sync
• • Basic usage analytics and crash logs to improve stability and UX

2. HOW SYMPLANO USES AI

When you share a school newsletter, email or message with Symplano, we send its text to our AI provider, OpenAI, so it can find the dates, times and events inside it. We use what comes back to create events in your family calendar and to suggest which child each one belongs to.

Under our agreement with OpenAI, the text we send is not used to train OpenAI's models. OpenAI may hold what we send for up to 30 days to check for misuse of its own service, and then deletes it.

The AI does not learn from your data. The AI model itself never changes or trains on your newsletters. When Symplano gets better at parsing, it is because Symplano keeps its own record of the corrections you make — described below — not because the AI has been taught anything about your family.

What we never send. The details you save about your children — names, schools, classes — are never shared with the AI. Working out which child an event belongs to happens on our own servers after the AI has finished, using only what you have entered yourself.

What we do send. We send the newsletter text as the school wrote it. Newsletters often name other people — a teacher, a coach, another family's child — and we do not strip those names before the text is read. We have tested this: removing every name reliably also removes the school names, venues and event titles that make the text readable at all. We would rather tell you this plainly than claim a protection we cannot deliver.

How long we keep the newsletter text. 48 hours. It is stored so that the app itself cannot read it back, it is used only to check our own accuracy, and it is deleted automatically by a clear-out that runs every hour. We do not keep the original newsletter after that.

If you correct an event. When you fix something we got wrong, we save the short passage of text around that one event — never the whole newsletter — so we can stop making the same mistake. Before it is saved we remove your own children's names, and names written as a title and surname or as a first name with a class code. This is deliberately partial: a first name on its own may remain, because a rule broad enough to catch it would also delete the school and event names we need.

Every passage is checked for wording about health, special educational needs, safeguarding or medical matters. If any is found, the passage is discarded rather than saved, and we count how often that happens so we can check the filter is working.

Saved passages are kept for a maximum of 24 months and are then deleted automatically.

Turning it off. You can switch off accuracy improvement in Symplano's settings at any time. From that moment we stop keeping the text of newsletters you share and stop saving corrections — the newsletter is still read so your events are still created, it just isn't kept afterwards. Anything still held is removed at the next clear-out, within 48 hours. To have passages saved before you switched off deleted sooner than the 24-month limit, email privacy@symplano.com and we will remove them.

Symplano works exactly the same either way. With this off, our parsing may simply improve more slowly.

3. THE LAWFUL BASES WE RELY ON

Providing Symplano to you and your family — contract (UK GDPR Article 6(1)(b)). Your account, your children's details, your calendar, sharing across your family's devices, and reading the newsletters you send us. This is what the service is, so it cannot be switched off separately — but you control it: share a newsletter or don't, and you can delete your account at any time.

People named in newsletters who are not Symplano users — legitimate interests (Article 6(1)(f)). A newsletter you share may name a teacher or another family's child. We do not seek that information, we do not build profiles from it, we do not keep the newsletter beyond 48 hours, and we remove what we reliably can from anything saved for longer. If you are named in a newsletter someone shared with Symplano and you want to know more or object, email privacy@symplano.com.

Improving Symplano's accuracy from corrections — legitimate interests (Article 6(1)(f)). The 48-hour text and the saved passages described above. You have the right to object under Article 21, and the settings switch is that objection: it takes effect immediately, costs nothing, and unlocks no features either way. We have carried out and recorded a legitimate interests assessment for this processing and will review it as the service develops; you can request a summary at privacy@symplano.com.

Keeping accounts secure and preventing misuse — legitimate interests (Article 6(1)(f)).

Meeting legal obligations — Article 6(1)(c).

We do not rely on your consent for AI processing, and we do not ask you to agree to AI processing as a condition of using Symplano. Where we rely on legitimate interests you can object; where we rely on contract, you control the processing by choosing what to share and whether to keep your account.

4. SPECIAL CATEGORY INFORMATION

Newsletters sometimes mention health, illness or special educational needs. We never ask for this information and we do not use it. We have to be honest about what that means in practice: if a newsletter you share contains it, that wording passes through the AI as part of the text and sits in the 48-hour store like the rest of it. What our filter guarantees is narrower and specific — such wording is blocked from being saved into the longer-term store, so it is gone within 48 hours rather than kept for months.

If you would rather a particular newsletter never reached us at all, don't share it.

5. COMMUNICATIONS

• • Service messages (Contract/Legal obligation): critical updates, security, changes to terms
• • Tips & product updates (Consent): optional, OFF by default

6. YOUR CONTROLS

Privacy & Choices (onboarding)

After sign‑in, you'll see a short screen explaining what's needed to run Symplano, plus optional toggles. You can proceed with basic features even if you keep optional toggles OFF.

Settings ▸ Privacy

• • Tips & updates (Consent) — default OFF
• • Data management — Export data, Delete account, Consent history (view decisions with timestamps and policy versions)

We maintain a consent & preferences ledger recording purpose, lawful basis, decision, region, policy version, and timestamp.

7. WHO PROCESSES YOUR DATA (PROCESSORS)

Trusted providers under data‑processing agreements, used solely to deliver the service:

• • Supabase — database & auth
• • OpenAI (API inference only) — used to assist parsing/normalisation.
• • RevenueCat — subscriptions and payments
• • Resend — sending account and invitation emails
• • Google — Play Store distribution and billing
• • Sentry — crash and error monitoring
• • Vercel — website hosting
• • Logging/monitoring — error and performance telemetry (minimised; no raw school content)

8. STORAGE LOCATION & TRANSFERS

Primary storage in the UK/EEA with encrypted transport and at‑rest encryption.

Crash data is processed by Sentry in the EU (Germany); app data is stored by Supabase in London, UK.

If a provider processes data outside the UK/EEA, we use approved transfer safeguards (e.g., UK IDTA/EU SCCs) and minimise personal data in those flows.

9. CHILDREN'S PRIVACY

Symplano is for parents/guardians (18+). We collect only the minimum child data to support scheduling (first name and year group). We avoid special‑category data.

10. RETENTION

• • Active accounts: retained for your ongoing use
• • Deleted accounts: removed within 30 days of confirmation
• • Shared newsletter text: kept up to 48 hours, then automatically deleted
• • Correction excerpts: a short redacted passage, kept up to 24 months
• • Backups: ≤90 days (disaster recovery)
• • iOS waitlist: if you join our iOS waitlist we keep your email address for up to 12 months, then delete it

11. YOUR RIGHTS

Under UK/EU data protection law, you can request: access, rectification, erasure, restriction, portability, and objection. You can withdraw consent at any time for consent‑based features. Contact privacy@symplano.com.

You may lodge a complaint with the UK Information Commissioner's Office (ICO) or your local EU supervisory authority.

Deleting Your Account

You can request deletion of your Symplano account and all associated data at any time:

• • In the app: Settings → "Delete my account"
• • By email: privacy@symplano.com (from the email registered to your account)

When your request is confirmed, we permanently delete your account and associated personal data — your profile, your children's details, family members, calendar events, reminders, pack lists, and your saved preferences and corrections. Encrypted backups are purged within 90 days. We may retain a minimal record where required by law or to defend legal claims. Your account and associated data are removed within 30 days of confirmation.

Symplano Ltd (Company No. 16460787), 128 City Road, London, EC1V 2NX. Questions: privacy@symplano.com.

12. SECURITY

• • TLS in transit; encrypted storage at rest
• • Role‑based access control; least‑privilege
• • We monitor our systems continuously, run security checks before every release, and carry out a full security review at least once a year
• • 72‑hour breach notification where required by law

13. UPDATES TO THIS NOTICE

We'll post changes here and update the "Last updated" date. For material changes, we'll provide in‑app or email notice.

14. CONTACT US

For any privacy questions or concerns:

This privacy notice was last reviewed and updated on 31 August 2026.