PRIVACY NOTICE (UK/EU)

This Privacy Notice explains how Symplano ("we", "us") processes your information when you use our mobile app and website. We designed Symplano for parents and guardians, not children.

1. WHAT WE PROCESS

Account & Family

• • Parent/guardian name and email
• • Family member names and relationships
• • Details about your children that you give us, such as their first names, year groups, schools and classes, and any activities you have added for them.
• • iOS waitlist email address (if you join the waitlist on our website)

Signing in with Google

If you choose Sign in with Google, Google gives us your name, your email address and your Google profile picture, and confirms that the sign-in was successful. We use this only to create your Symplano account and to sign you in.

We do not ask Google for access to your Gmail, your Google Drive, your contacts or your Google Calendar, and we cannot read any of them. We do not use anything Google gives us for advertising, and we do not share it with anyone other than the providers listed in section 7.

If you would rather not use your Google account, you can create a Symplano account with an email address and password instead.

Calendar & Scheduling

• • Events and activities you create
• • Reminder preferences (e.g., D‑1 @ 19:00)
• • Pack lists and activity rules (e.g., "PE kit on Tuesdays")

School Communications (when you enable parsing)

• • Content you choose to share (e.g., emails, WhatsApp, newsletters, PDFs)
• • We extract scheduling facts (dates, times, locations, child, item lists)

Device & Telemetry (minimised)

• • Device IDs for secure login/sync
• • Basic usage analytics and crash logs to improve stability and UX

2. HOW SYMPLANO USES AI

When you share a school newsletter, email or message with Symplano, we send its text to OpenAI to identify dates, times and events. The text may include names and other information about teachers, pupils from other families and your own child. We use the result to create calendar events and match them to children using the family details held in your account.

Under our agreement with OpenAI, the text we send is not used to train OpenAI's models. OpenAI may keep what we send for up to 30 days to check for misuse of its service, and then deletes it, unless the law requires it to keep it for longer or keeping it is reasonably necessary to protect its service or other people from harm.

How long we keep the newsletter text. When accuracy improvement is on, we keep the text so we can check our own accuracy. It is stored so that the app itself cannot read it back. It expires 48 hours after it is stored and is deleted by a clear-out that runs every hour.

If you correct an event. When you fix something we got wrong, we save the short passage of text around that one event so we can stop making the same mistake. Before it is saved we remove your own children's names, and names written as a title and surname or as a first name with a class code. This is deliberately partial: a first name on its own may remain, because a rule broad enough to catch it would also delete the school and event names we need.

Passages are checked for wording about health, special educational needs, safeguarding or medical matters. If any is found, the passage is discarded rather than saved, and we count how often that happens so we can check the filter is working.

Saved passages are kept for a maximum of 24 months and are then deleted automatically.

Turning it off. You can switch off accuracy improvement in Symplano's settings at any time. From that moment we stop keeping the text of newsletters you share and stop saving corrections: the newsletter is still read so your events are still created, it just isn't kept afterwards. Text already kept stays until its normal expiry: 48 hours after it was stored, it expires and is deleted by the clear-out that runs every hour. To have passages saved before you switched off deleted sooner than the 24-month limit, email privacy@symplano.com and we will remove them.

With this off, our parsing may simply improve more slowly.

3. THE LAWFUL BASES WE RELY ON

Providing Symplano to you and your family, contract (UK GDPR Article 6(1)(b)). Your account, your children's details, your calendar, sharing across your family's devices, and reading the newsletters you send us. This is what the service is, so it cannot be switched off separately, but you control it: share a newsletter or don't, and you can delete your account at any time.

People named in communications shared by a Symplano user, legitimate interests (UK GDPR Article 6(1)(f)). A shared communication may contain the name or other details of a teacher, a pupil from another family or another person. We use the shared text to extract scheduling information and, where accuracy improvement is on, as described in section 2. Such people can contact privacy@symplano.com to ask about their information or object to this processing.

Improving Symplano's accuracy from corrections, legitimate interests (UK GDPR Article 6(1)(f)). The 48-hour text and the saved passages described above. You have the right to object under Article 21, and you can switch off accuracy improvement in Settings. You can also object by emailing privacy@symplano.com. We have carried out and recorded a legitimate interests assessment for this processing and will review it as the service develops; you can request a summary at privacy@symplano.com.

Keeping accounts secure and preventing misuse, legitimate interests (Article 6(1)(f)).

Meeting legal obligations, Article 6(1)(c).

We do not rely on your consent for AI processing, and we do not ask you to agree to AI processing as a condition of using Symplano. Where we rely on legitimate interests you can object; where we rely on contract, you control the processing by choosing what to share and whether to keep your account.

4. SPECIAL CATEGORY INFORMATION

Newsletters sometimes mention health, illness or special educational needs. We have to be honest about what that means in practice: if a newsletter you share contains it, that wording passes through the AI as part of the text and is handled in the same way as the rest of it.

If you would rather a particular newsletter never reached us at all, don't share it.

5. COMMUNICATIONS

• • Service messages (Contract/Legal obligation): critical updates, security, changes to terms
• • Tips & product updates (Consent): optional, OFF by default

6. YOUR CONTROLS

Settings ▸ Privacy

• • Tips & updates (Consent): default OFF
• • Data management: Delete account

7. WHO RECEIVES OR PROCESSES YOUR DATA

We use the following companies to provide or support Symplano. Their roles and the information they receive depend on the feature you use:

• • Supabase: database & auth
• • OpenAI (API inference only): used to assist parsing/normalisation.
• • RevenueCat: subscriptions and payments
• • Resend: sending account and invitation emails
• • Google: Play Store distribution and billing, and Sign in with Google where you choose to use it
• • Sentry: crash and error monitoring
• • Vercel: website hosting

8. STORAGE LOCATION & TRANSFERS

Primary storage in the UK/EEA with encrypted transport and at‑rest encryption.

Crash data is processed by Sentry in the EU (Germany); app data is stored by Supabase in London, UK.

If a provider processes data outside the UK/EEA, we use approved transfer safeguards (e.g., UK IDTA/EU SCCs) and minimise personal data in those flows.

9. CHILDREN'S PRIVACY

Symplano is for parents and guardians aged 18 or over. We ask only for the details about your children that scheduling needs.

10. RETENTION

• • Active accounts: retained for your ongoing use
• • Deleted accounts: removed within 30 days of confirmation
• • Deleted children: when you delete a child, we keep a record that the child was deleted, and when, for 12 months, so that your other devices remove the child too.
• • Shared newsletter text: kept up to 48 hours, then automatically deleted
• • Correction excerpts: a short redacted passage, kept up to 24 months
• • Backups: ≤90 days (disaster recovery)
• • iOS waitlist: if you join our iOS waitlist we keep your email address for up to 12 months, then delete it

11. YOUR RIGHTS

Under UK/EU data protection law, you can request: access, rectification, erasure, restriction, portability, and objection. You can withdraw consent at any time for consent‑based features. Contact privacy@symplano.com.

You may lodge a complaint with the UK Information Commissioner's Office (ICO) or your local EU supervisory authority.

Deleting Your Account

You can request deletion of your Symplano account and associated data at any time:

• • In the app: Settings → Privacy & Data → Delete my account
• • By email: privacy@symplano.com (from the email registered to your account)

When your request is confirmed, we delete your account and associated personal data: your profile, your children's details, family members, calendar events, reminders, pack lists, and your saved preferences and corrections. Encrypted backups are purged within 90 days. We may retain a minimal record where required by law or to defend legal claims. Your account and associated data are removed within 30 days of confirmation.

Symplano Ltd (Company No. 16460787), 128 City Road, London, EC1V 2NX. Questions: privacy@symplano.com.

12. SECURITY

• • TLS in transit; encrypted storage at rest
• • Role‑based access control; least‑privilege
• • We monitor the app for crashes and errors

13. UPDATES TO THIS NOTICE

We'll post changes here and update the "Last updated" date. For material changes, we'll provide in‑app or email notice.

14. CONTACT US

For any privacy questions or concerns:

This privacy notice was last reviewed and updated on 14 October 2026.