1. Who we are
Policy & Play is a trading name of POLICYANDPLAY LTD, a company registered in England and Wales, company number 17253846. Our registered office is 7 Cosford Drive, Shortstown, Bedford MK42 0DQ, United Kingdom. We are the data controller for the personal data described here. Our ICO registration number is ZC165321.
Contact for anything to do with your data: [email protected]
2. What we collect and why
| Data | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|
| Account: name, email address, password (stored hashed by our sign-in provider) | Create and run your account and membership | Contract | While your account is open, then deleted within 30 days of closure |
| Orders and billing: plan, price, dates, Stripe customer and subscription IDs, payment status. Card details go straight to Stripe and we never see or store them | Take payment, manage renewals and cancellations, handle refunds, keep tax records | Contract; legal obligation | 6 years from the end of the tax year, for HMRC |
| Your setting details and saved work: setting name, manager's name, address, postcode, local authority, Ofsted and ICO numbers, phone, email, brand colour and logo, policies you have ticked as reviewed, saved week plans | So your documents fill themselves in and your work follows you between devices; to email each day's activity if you switch reminders on | Contract | While your account is open, then deleted within 30 days of closure |
| Service emails: receipts, sign-in links, trial and renewal reminders, changes to these terms, safety or security notices. We keep a log of each one sent (address, type, whether it was delivered) | Run your membership and make sure you get the messages you need. These are not marketing | Contract (messages needed to provide the service); legitimate interests (keeping a record that they were sent) | Email log: 12 months |
| Usage data: pages visited, downloads, features used, subscription activity, IP address and device details in server logs | Keep the site secure, stop abuse, fix faults, see which features are used and improve them | Legitimate interests | Server logs: 30 days. Usage and download records: 12 months |
| Free Polly chat boxes on public pages: the first 500 characters of your question, a topic label, any rating you give, your IP address | Improve answers, spot misuse and limit free questions | Legitimate interests | 12 months |
| Messages you send us (contact form, email) | Reply and keep a record of what we said | Legitimate interests; contract if you are a member | 2 years after we last wrote to you |
| Newsletter and marketing emails: email address, consent record, what you were sent | Send the emails you asked for | Consent (or the soft opt-in for existing customers) | Until you unsubscribe. We then keep your address on a suppression list so we do not email you again |
| Advertising and measurement cookies (Meta Pixel, Google Ads, Google AdSense) | Measure and show ads | Consent | Only if you accept. See our Cookie Policy for each cookie's lifetime |
We do not use your data to make decisions about you by automated means that have legal or similarly significant effects.
What stays on your device
What you type into forms, policies, Smart Setup and the planning and record tools stays on your own device unless you send or download it, apart from the items in the table above.
AI tools
Ask Polly, the Observation Writer, the week planner's theme box and the free Try Polly chat send what you type to an AI service (OpenRouter, which passes it to a model provider such as Anthropic) to write the reply. We do not keep the text of your requests in the signed-in tools. The AI providers handle it under their own terms, and we use settings and agreements that stop them training their models on it where the provider offers this. For Try Polly we hold your IP address only in the memory of our server, not in a database, to limit how many free questions one visitor can ask. The free Polly chat boxes on public pages are different: see the table above. Please do not put children's names, dates of birth, addresses or health details into any AI tool.
Postcode lookup
Smart Setup sends the postcode you enter to postcodes.io, a public postcode service in the UK, to find your local authority and town.
Documents sent for signature
When you send a document to a parent to sign, it passes through our email provider (Resend). We do not keep a copy of the signed document. You are the controller of the parent's and child's data in it.
3. Marketing emails
We only send newsletters and offers if you have opted in, or if you are an existing customer and we are promoting similar services (the "soft opt-in"). Every marketing email has an unsubscribe link. You can also email [email protected] at any time. Service emails (receipts, sign-in links, renewal notices) are not marketing and still reach you.
4. Who we share it with
We never sell your personal data. We share it only with providers that help us run the service, under contracts that limit what they can do with it:
- Stripe (payments, US) — takes your payment and holds your card details.
- Netlify (website hosting and serverless functions, US).
- Supabase (database and sign-in).
- Resend (sending our emails, US).
- Cloudflare (Turnstile spam protection on forms, US).
- OpenRouter and Anthropic (AI services that write replies in the AI tools, US). They receive the text you type into those tools.
- postcodes.io (postcode lookup, UK). It receives the postcode you enter.
- Telegram (private alerts to us about new sales and faults, which can include a customer email address).
- Google Fonts (font delivery, US). Your IP address may be logged by Google when a page loads.
- Meta (Facebook Pixel) and Google (Google Ads and AdSense), both US — advertising and measurement, only if you accept advertising cookies.
We may also share data where the law requires it, or to protect our rights, or with a professional adviser or a buyer of the business under a duty of confidence.
5. International transfers
Some of these providers are in the United States or process data there (Stripe, Netlify, Resend, Cloudflare, OpenRouter, Anthropic, Telegram, Google, Meta, and possibly Supabase). Where we send personal data outside the UK, we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified. Where it is not, we rely on the ICO's International Data Transfer Agreement or the ICO's Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards for a given provider.
6. How long we keep it
The table in section 2 gives the period for each type of data. In short: account and saved work until you delete your account plus 30 days; orders and billing records for 6 years for tax; server logs for 30 days; email logs, usage records and free-chat logs for 12 months. You can delete your account and saved data yourself at any time from your dashboard ("Delete my account"). We may keep a record of an order for 6 years even after the account is gone, because the law requires it.
7. Your rights
You have the right to:
- see the personal data we hold about you (access)
- have inaccurate data corrected
- have your data erased (you can do this yourself via "Delete my account")
- restrict how we use it
- receive it in a portable format
- object to how we use it, including to direct marketing at any time
- withdraw consent at any time (use "Cookie settings" in the footer, or the unsubscribe link in an email)
- ask for a person to look again at any decision made by automated means
Email [email protected] to use any of these. We reply within one month.
8. Complaints
If you're unhappy with how we've handled your data, email [email protected] with "Data protection complaint" in the subject. We'll acknowledge within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
9. Cookies
We use essential cookies and similar storage to run the site and keep you signed in. Advertising cookies (Meta Pixel, Google Ads, Google AdSense) are off unless you accept them. Nothing optional loads before you choose. You can change your mind at any time with "Cookie settings" in the footer. Full details and a table of every cookie are in our Cookie Policy.
10. Children
Policy & Play is for childcare professionals and is not aimed at anyone under 18. We do not knowingly collect data from children. If you are a childminder or nursery, keep children's personal data out of our AI tools and chat boxes.
11. Changes to this policy
We will update this page when what we do changes, and change the date at the top. If a change is significant, we will email members before it takes effect.