Legal

Privacy Policy

Last updated: June 2026 · Version 2.0

1. Who we are

iProtocol Impact Ltd ("iProtocol Impact", "we", "us", "our") is the data controller responsible for your personal data. We are registered in England and Wales and operate from the United Kingdom.

Data Controller contact: privacy@iprotocolimpact.com
ICO registration: Pending registration with the Information Commissioner's Office
Data Protection Officer: privacy@iprotocolimpact.com

For all data protection enquiries, requests to exercise your rights, or complaints, contact us in writing at the above address. We will respond within 30 days of receiving your request.

2. Definitions

In this policy: "Platform" means the iProtocol Impact web application and all associated services. "User" means any individual who creates an account on the Platform. "Participant" means an individual whose development data is tracked through the Platform. "Organisation" means a school, charity, workplace, community group, or other entity using the Platform to manage participants. "Mentor" means an individual who provides development support to participants through the Platform. "Special category data" means data revealing racial or ethnic origin, health data, data concerning a natural person's sex life or sexual orientation, and any data relating to children.

3. Data we collect

3.1 Account and identity data

• Full name and email address
• Encrypted password (we never store plaintext passwords)
• Account type (individual, organisation, school, community, workplace)
• Date of account creation and last login
• IP address and device information at time of registration

3.2 Development and goal data

• Goals, milestones, evidence uploads, and reflections
• GOALS Framework stage and RAG status per goal
• Session notes, mood ratings, and session summaries
• Lessons learned log and development timeline
• Support logs and intervention records (for school and organisation users)

3.3 Financial data

• Subscription plan and billing status
• Payment method details — processed exclusively by Stripe. We never store card numbers, CVV codes, or full payment details on our servers
• Transaction history and invoices

3.4 Communications data

• Messages exchanged between mentors and participants within the Platform
• Email notifications sent by the Platform
• WhatsApp notification preferences and delivery status
• Support tickets and correspondence with our team

3.5 Technical and usage data

• Browser type, operating system, and device type
• Pages visited, features used, and session duration
• Error logs and crash reports
• Cookie data (essential cookies only — see Section 11)

4. Special category and sensitive data

Some features of the Platform may involve the collection of data that falls within special category classifications under UK GDPR, including:

• Health and wellbeing data (mood tracking, wellbeing logs, RAG status)
• Data relating to children (where participants are under 18)
• Data that may reveal racial or ethnic origin in demographic reporting

We process special category data only where we have a valid lawful basis, including explicit consent or where processing is necessary for the provision of social protection services. We apply enhanced security measures to all special category data. We conduct Data Protection Impact Assessments (DPIAs) before introducing new features that process special category data.

5. Legal basis for processing

We process your personal data on the following legal bases:

• Contract performance — to provide the Platform and its features as described in our Terms of Service
• Legitimate interests — to improve the Platform, prevent fraud, maintain security, and protect our legal rights. We have carried out a Legitimate Interests Assessment (LIA) and determined that our interests are not overridden by your rights and freedoms
• Legal obligation — to comply with UK law, including HMRC obligations, safeguarding duties, and responses to lawful authority requests
• Consent — for optional features including marketing communications, WhatsApp notifications, and longitudinal anonymised research. You may withdraw consent at any time without affecting the lawfulness of prior processing
• Vital interests — in emergency safeguarding situations where disclosure is necessary to protect life
• Public task — where we process data in connection with safeguarding obligations or cooperation with statutory authorities

6. How we use your data

We use your data strictly for the following purposes:

• Providing, maintaining, and improving the Platform
• Processing payments and managing subscriptions
• Generating development reports, impact reports, and outcome summaries
• Sending transactional notifications about your goals, sessions, and account
• Enforcing our Terms of Service and Acceptable Use Policy
• Investigating and responding to complaints, disputes, and legal claims
• Complying with safeguarding obligations and reporting to statutory authorities where required by law
• Conducting aggregated, anonymised research to improve human development outcomes (no individual is identified)

We will never use your data for advertising purposes or sell it to third parties. We will never use your development data to make automated decisions that have a significant effect on you without human review.

7. Data sharing and third parties

We do not sell, rent, or trade your personal data. We share data only with the following categories of trusted processors, each bound by data processing agreements (DPAs) that require them to process data only as instructed and in compliance with UK GDPR:

• Supabase Inc — database hosting and authentication (EU West region)
• Vercel Inc — platform hosting and deployment infrastructure
• Stripe Inc — payment processing (PCI-DSS Level 1 certified)
• Daily.co — video session infrastructure
• Twilio Inc — WhatsApp notification delivery (opt-in only)
• Anthropic PBC — structured co-pilot features (no personal development data is transmitted; only anonymised structural prompts are sent)

We may disclose your data to law enforcement, regulators, or statutory authorities where required by law, where necessary to protect the safety of a child or vulnerable person, or where necessary to protect our legal rights in legal proceedings. We will notify you of any such disclosure where we are legally permitted to do so.

In the event of a merger, acquisition, or sale of assets, your data may be transferred to a successor entity. We will notify you before your data is transferred and becomes subject to a different privacy policy.

8. International data transfers

Some of our third-party processors are based outside the UK. Where we transfer data internationally, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTAs), Standard Contractual Clauses (SCCs), or transfers to countries with UK adequacy decisions. Our primary database is hosted in the EU West region (Ireland), which benefits from a UK adequacy decision.

9. Children and under-18 users

We take our obligations under the Children's Code (Age Appropriate Design Code) and UK GDPR Article 8 seriously. The following additional protections apply to users under 18:

• We require verified parental or guardian consent before a participant under 18 can be added to the Platform
• We apply the principle of data minimisation with particular rigour — we collect only what is strictly necessary
• We do not use profiling or behavioural advertising in connection with any user under 18
• We do not use nudge techniques or design features intended to encourage under-18 users to provide more data than necessary
• All mentors working with under-18 participants must hold a verified Enhanced DBS certificate — enforced at the platform level
• Safeguarding concerns involving under-18 participants will be escalated to the designated Development Lead and, where required by law, to statutory authorities
• Under-18 users' data is never used in aggregated research without additional consent

10. Data retention

We retain your personal data for the following periods:

• Active account data — retained for the duration of your account
• Financial records — 7 years from the date of transaction (HMRC legal requirement)
• Safeguarding records — retained in accordance with statutory guidance, which may require retention for up to 75 years in the case of records relating to children
• Session and development data — retained for the lifetime of the account, then anonymised within 30 days of account deletion
• Backup copies — purged within 90 days of account deletion
• Aggregated anonymised data — retained indefinitely for research and platform improvement purposes

When you request account deletion, all personal data that is not subject to a legal retention requirement is anonymised immediately and permanently deleted within 30 days.

11. Cookies

We use strictly necessary cookies only. These are required for the Platform to function and cannot be disabled. They include:

• Authentication session cookies — to keep you signed in securely
• Security cookies — to protect against CSRF attacks and session hijacking
• Preference cookies — to remember your language and display settings

We do not use tracking cookies, advertising cookies, analytics cookies that identify you personally, or any third-party cookies for marketing purposes. We do not use Google Analytics or any similar behavioural tracking service.

12. Security

We implement industry-standard technical and organisational security measures including:

• Encryption of all data in transit using TLS 1.2 or higher
• Encryption of sensitive data at rest
• Row-level security (RLS) enforced at the database level — each user can only access their own data
• Bcrypt password hashing — plaintext passwords are never stored
• Regular security reviews and penetration testing
• Principle of least privilege applied to all staff and system access
• Incident response procedures in place for data breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware and will notify affected individuals without undue delay.

13. Your rights under UK GDPR

You have the following rights. To exercise any of them, contact us at privacy@iprotocolimpact.com. We will respond within 30 days and will not charge a fee for reasonable requests:

• Right of access (Article 15) — request a copy of all personal data we hold about you
• Right to rectification (Article 16) — correct inaccurate or incomplete data
• Right to erasure (Article 17) — request deletion of your data where there is no overriding legal reason to retain it
• Right to restriction (Article 18) — request that we restrict processing of your data in certain circumstances
• Right to data portability (Article 20) — receive your data in a structured, machine-readable format (JSON)
• Right to object (Article 21) — object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making (Article 22) — request human review of any automated decisions that significantly affect you
• Right to withdraw consent — where we rely on consent, you may withdraw it at any time without affecting prior processing

If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

14. Limitation of liability

To the fullest extent permitted by applicable law, iProtocol Impact Ltd shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including loss of data, loss of profits, or loss of business, arising out of or in connection with your use of the Platform, even if we have been advised of the possibility of such damages.

Our total aggregate liability to you for any claims arising under or in connection with this policy or the Platform shall not exceed the greater of (a) the total fees paid by you to iProtocol Impact in the 12 months preceding the event giving rise to the claim, or (b) £100.

Nothing in this policy limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be excluded by law.

15. Indemnity

You agree to indemnify, defend, and hold harmless iProtocol Impact Ltd and its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising out of or in connection with: (a) your use of the Platform in violation of our Terms of Service or Acceptable Use Policy; (b) your violation of any applicable law or regulation; (c) any data you submit to the Platform that infringes the rights of any third party; or (d) your provision of inaccurate or misleading information in connection with parental consent for under-18 participants.

16. Governing law and jurisdiction

This policy and any disputes arising out of or in connection with it shall be governed by and construed in accordance with the laws of England and Wales. You agree that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this policy or the Platform.

17. Acceptable use and prohibited conduct

You must not use the Platform to process personal data in a way that is unlawful, discriminatory, or in breach of any applicable data protection legislation. You must not upload to the Platform any data relating to another individual without that individual's knowledge and consent. You must not use the Platform to process data relating to children without first obtaining verified parental consent. Breach of these obligations may result in immediate suspension of your account and may be reported to the relevant authorities.

18. Changes to this policy

We reserve the right to update this policy at any time. Where changes are material, we will notify you by email at least 30 days before the changes take effect and will display a prominent notice on the Platform. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree to the updated policy, you must stop using the Platform and may request deletion of your account.

19. Contact

For all privacy-related enquiries, data subject requests, or complaints:

This privacy policy does not constitute legal advice. iProtocol Impact recommends that organisations using the Platform for the processing of special category data or children's data seek independent legal advice to ensure their own compliance obligations are met.