PRIVACY NOTICE (UK/EU)

This Privacy Notice explains how Symplano ("we", "us") processes your information when you use our mobile app and website. We designed Symplano for parents and guardians, not children.

1. WHAT WE PROCESS

Account & Family

• • Parent/guardian name and email
• • Family member names and relationships
• • Children's first names and year groups only (no DOB required)

Calendar & Scheduling

• • Events and activities you create
• • Reminder preferences (e.g., D‑1 @ 19:00)
• • Pack lists and activity rules (e.g., "PE kit on Tuesdays")

School Communications (when you enable parsing)

• • Content you choose to share (e.g., emails, WhatsApp, newsletters, PDFs)
• • We extract scheduling facts (dates, times, locations, child, item lists)
• • Originals are not retained beyond short‑lived processing buffers unless you explicitly enable archival features

Device & Telemetry (minimised)

• • Device IDs for secure login/sync
• • Basic usage analytics and crash logs to improve stability and UX

2. WHY WE PROCESS IT (LAWFUL BASES)

A. Provide the core service (Contractual necessity)

We process the content you share with Symplano (e.g., a school email you forward) to create events, reminders and schedules because you asked us to. This includes AI‑assisted parsing for your own account to fulfil the requested feature.

B. Account‑only learning (Legitimate interests; opt‑out anytime)

We use your own corrections and interactions to make your future results better (e.g., child disambiguation, kit inference). This does not help other families and can be turned off in Settings ▸ Privacy.

C. Cross‑account model improvement (Consent; opt‑in)

With your explicit opt‑in, we may contribute de‑identified patterns to improve Symplano for everyone. This is optional and OFF by default. You can change this at any time in Settings ▸ Privacy.

D. Connectors & Imports (Contract + just‑in‑time notice)

If you enable email forwarding, calendar sync or file imports, we process that data to provide those features. We present a clear, purpose‑specific notice when you switch them on.

E. Communications

• • Service messages (Contract/Legal obligation): critical updates, security, changes to terms
• • Tips & product updates (Consent): optional, OFF by default

3. YOUR CONTROLS

Privacy & Choices (onboarding)

After sign‑in, you'll see a short screen explaining what's needed to run Symplano, plus optional toggles. You can proceed with basic features even if you keep optional toggles OFF.

Settings ▸ Privacy

• • Account‑only learning (LI) — default ON, toggle anytime
• • Improve Symplano for everyone (Consent) — default OFF, opt‑in
• • Tips & updates (Consent) — default OFF
• • Data management — Export data, Delete account, Consent history (view decisions with timestamps and policy versions)
• • Consent & preferences ledger fields: we store policy_version, timestamp, region, and the state of each toggle (account_only_learning, improve_for_everyone, marketing). Server ledger is the source of truth and synchronises with local flags for routing.

We maintain a consent & preferences ledger recording purpose, lawful basis, decision, region, policy version, and timestamp.

4. WHO PROCESSES YOUR DATA (PROCESSORS)

Trusted providers under data‑processing agreements, used solely to deliver the service:

• • Supabase — database & auth
• • OpenAI (API inference only) — used to assist parsing/normalisation. OpenAI does not train its models on our API inputs/outputs by default. If you opt in to "Improve Symplano for everyone", any training occurs within Symplano using our own derived features/aggregates, not within OpenAI's models.
• • RevenueCat — subscriptions and payments
• • Google/Firebase — distribution, diagnostics, limited analytics
• • Logging/monitoring — error and performance telemetry (minimised; no raw school content)

5. STORAGE LOCATION & TRANSFERS

Primary storage in the UK/EEA with encrypted transport and at‑rest encryption.

If a provider processes data outside the UK/EEA, we use approved transfer safeguards (e.g., UK IDTA/EU SCCs) and minimise personal data in those flows.

6. CHILDREN'S PRIVACY

Symplano is for parents/guardians (18+). We collect only the minimum child data to support scheduling (first name and year group). We avoid special‑category data. If sensitive details appear in shared content, we process them only to deliver the requested feature and do not repurpose them for cross‑account learning unless you expressly consent.

7. RETENTION

• • Active accounts: retained for your ongoing use
• • Deleted accounts: removed within 30 days of confirmation
• • Temporary parsing buffers: typically ≤24 hours
• • Backups: ≤90 days (disaster recovery)
• • Analytics: minimised and aggregated after 12 months

8. YOUR RIGHTS

Under UK/EU data protection law, you can request: access, rectification, erasure, restriction, portability, and objection. You can withdraw consent at any time for consent‑based features. Contact privacy@symplano.com.

You may lodge a complaint with the UK Information Commissioner's Office (ICO) or your local EU supervisory authority.

9. SECURITY

• • TLS in transit; encrypted storage at rest
• • Role‑based access control; least‑privilege
• • Regular audits and monitoring
• • 72‑hour breach notification where required by law

10. UPDATES TO THIS NOTICE

We'll post changes here and update the "Last updated" date. For material changes, we'll provide in‑app or email notice.

11. CONTACT US

For any privacy questions or concerns:

This privacy notice was last reviewed and updated on 31 August 2025.