Data protection for schools
Last updated: 7 November 2026
This page answers the questions schools usually ask before buying software. The full detail is in our privacy notice. If your school has its own questionnaire, email hello@cuecurve.co.uk and we'll complete it.
The short version
- No pupil records. CueCurve is for teachers, and accounts are for adult school staff only: classes see diagrams on their teacher's screen. We don't ask schools for any pupil information. If a teacher shares a free diagram's link or QR code, whoever opens it leaves only the short-lived technical traces every website does (server logs and cookie-free visit counts), described in our privacy notice.
- Minimal staff data: a teacher's email address – usually their school address – which school they belong to, and whether they're a lead teacher.
- Stored in the UK: our database is in London.
- No passwords: teachers sign in with a one-time code sent to their email address, or with their Microsoft or Google account.
- No advertising and no tracking. We never sell data, and we don't use schools' data to train AI.
What we hold
| About | What | Why |
|---|---|---|
| Teachers | Email address – usually a school address; if they sign in with Microsoft or Google, the name, email address and account ID that provider sends us; membership of the school and lead teacher role; when the account was created and last signed in. Sign-in records, including IP addresses and browser details, are described in our privacy notice. | To let the school's teachers sign in and use the licence |
| The school | Name, postcode and official school reference number (from the public lists of schools in England and Wales) | To identify the licence (one per school) |
| The licence | Dates, price, how it was paid, invoice status | To provide and renew the licence, and for financial records |
| Finance contact (invoices only) | Name and email address. Where the order needs the lead teacher's confirmation, CueCurve keeps the request until its link expires after 28 days if it isn't confirmed, or for 90 days from the day it was placed if it is; on confirmation the details are also sent to Stripe to issue the invoice. | To send the invoice |
| Free access | Which school used a free access link and who claimed it | To provide free access and invite the school to buy |
| How the school heard about CueCurve | If the lead teacher chooses to answer, the answers they tick and anything they type (both kept for 2 years) | To see which ways of reaching teachers work |
| Changes at the school | Who added or removed a teacher, or changed the lead teacher, and when | Security and investigating problems |
| Usage | How many times each paid diagram is opened at the school, and which paid diagram files are downloaded, per day. Not which teacher. | To show value, decide what to improve and protect CueCurve from copying |
| Quotes | The school, and the name and email address of whoever asked for the quote | To honour the quote and follow it up |
We don't ask for or hold pupil records – names, classes, work or marks. Accounts are for adult school staff. Anyone who opens a free diagram leaves only the short-lived technical information described in our privacy notice.
Who's responsible
CueCurve LTD is the data controller for the information above, not your school's processor: we decide why and how it's used – to run each school's access, manage purchases, send our own emails and keep the service secure – and we keep our own financial records. Whether a data processing agreement is needed depends on that, not on how much information is involved; here it isn't the right document, so schools don't need to sign one with us before buying.
Your school is a controller too, for deciding which staff to add. It should tell them, under its own staff privacy notice, that it shares their details with us. We also email each teacher when they're added, with a link to our privacy notice. Because we're independent controllers, a data processing agreement isn't the right document; this page and the signed statement are.
If your school's policy asks for something in writing, email hello@cuecurve.co.uk and we'll send a short signed statement confirming the points on this page: that we're the controller, what we hold and why, where it's stored, who processes it for us, how long we keep it and how we'd handle an incident.
You may still want to record CueCurve in your school's data protection records, or include it in a data protection impact assessment. This page and the privacy notice give you what you need for that. We're happy to answer further questions.
Where it's stored and who processes it
| Supplier | What it does | Where |
|---|---|---|
| Supabase | Database and sign-in | London, UK |
| Vercel | Hosting the website and its server | Server in London, UK; website pages delivered from a worldwide network |
| Resend | Sending sign-in codes and licence emails | Sent from Ireland (EU); Resend keeps the emails it sends, and its records of them, in the United States |
| Stripe | Card payments and invoices | UK and EU, with some processing in the US |
| Cloudflare | Domain names | Worldwide network |
| Our support inbox (Google Workspace) | Worldwide, under Google's Cloud Data Processing Addendum |
Our business suppliers work under data protection terms with us, with the safeguards UK law requires for any transfer outside the UK. Stripe also acts as a controller in its own right for fraud prevention and financial regulation, as our privacy notice explains. If we add or change a supplier that handles schools' information, we'll update this page and the privacy notice first.
How we keep it safe
- Encrypted in transit (HTTPS) and at rest (by our database provider).
- Sign-in by one-time code sent to the teacher's email address, or with the teacher's Microsoft or Google account. There are no CueCurve passwords to leak or reuse.
-
Each teacher sees only their own school:
- Access rules in the database, and checks on our server, mean nobody at one school can see another school's teachers or account details. (The purchase form's school search shows whether a school already has a CueCurve licence, so a school isn't sold a second one.)
- Only the school's lead teachers can change its list.
-
Limited access to schools' details:
- Only named people at CueCurve LTD can see schools' details.
- We record every time a school's page is opened.
- Backups: daily backups of the database, kept for 7 days.
- Payments: card details go straight to Stripe and never reach CueCurve.
- No AI training: we don't use schools' or teachers' information to train AI, and a person reads and answers every support email.
How long we keep it
- While the licence is current: teachers' accounts are kept.
- After the licence ends: accounts are kept for 12 months after the 14-day grace period ends (for free access, 12 months after it ends), so a late renewal restores everyone straight away. Then they're deleted, unless the teacher belongs to another school with CueCurve.
- Removed teachers: an account is deleted 30 days after the teacher is removed from the school's list, unless they belong to another school.
- Financial records (orders and invoices) are kept for 6 years after the end of the financial year they belong to, as the law requires.
- Orders that never went through: an unfinished card payment, or an invoice order the lead teacher didn't confirm, is deleted after 28 days; a failed or cancelled order after 90 days.
- Records of changes at the school are kept for 2 years, diagram-opening counts for 2 years, and records of paid diagram files downloaded for 1 year.
- Emails to and from us are deleted 2 years after the conversation ends, at our next six-monthly clear-out (so up to about 2 years and 6 months).
The privacy notice lists every kind of information and how long it's kept.
Emails we send
Teachers get the emails the service needs: sign-in codes, "you've been added to your school", and for lead teachers the welcome email, a request to confirm an invoice order someone else at the school placed, renewal reminders, notices about unpaid invoices and notices about free access we've given. Some emails invite a school to buy: a reminder about a quote someone asked for, and two emails to a school on free access as it ends, which go only to lead teachers who ask for them; each says how to stop them. We don't send any other marketing.
If something goes wrong
- Telling schools and people: if a security incident affects a school's information, we'll tell the school's lead teachers without undue delay and explain what happened and what we're doing. Where a breach is likely to put individuals at high risk, we'll also tell those people directly.
- Telling the ICO: where the law requires it, we'll report within 72 hours of becoming aware.
Staff leaving and data requests
- A member of staff leaves: remove them from the school's list on the Your school page. Their account is then deleted after 30 days, unless they belong to another school.
- A teacher wants their account deleted: they can do it themselves with Delete my account, at the foot of Your school in the account menu. While a school has a current licence, its only lead teacher needs to make another teacher a lead teacher first, or email us. The account is deleted straight away. Deleting it doesn't erase every record that identifies the person: an order keeps the lead teacher's email address, and a quote or invoice request they were named on keeps their details for its own period in our privacy notice; the school's log of changes keeps the account's internal number, not its address, for two years. Copies of deleted database information may remain in Supabase's daily backups for up to seven days.
- A teacher wants a copy of their data: they can email hello@cuecurve.co.uk, and we'll reply within one month.
Company details
CueCurve LTD is registered in England and Wales, company number 17542571. Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. ICO registration number: C2073447.
Contact: hello@cuecurve.co.uk
The school search uses public information from the Department for Education's Get Information about Schools and the Welsh Government's address list of schools, licensed under the Open Government Licence v3.0.