Privacy Policy

Last updated: 13 October 2026

Who we are

ActivityOS is a studio management platform for independent UK activity schools, accessible at activityos.co.uk and app.activityos.co.uk. It is operated by Stephen Butterworth, a sole trader trading as ActivityOS, c/o North Wales Accounting, Apartment 31, St. Trillo's Court, Rhos Promenade, Rhos on Sea, Conwy, LL28 4PY. When we say "we", "us" or "ActivityOS" in this policy, we mean Stephen Butterworth trading as ActivityOS. We are registered with the Information Commissioner's Office (ICO) under registration number ZC271550.

For questions about your data, contact us at hello@activityos.co.uk.

Our role: controller or processor

It depends on whose data it is.

• School owners and teachers (account holders). For the details you give us to create and run your account, such as your name, email address and billing details, we are the data controller.
• Pupils, parents and guardians. The school decides why and how this data is used, so the school is the data controller and we are its data processor. We only process it on the school's instructions, under our Data Processing Agreement. If you are a parent and want to see, correct or delete your child's data, the school is usually the right place to start, and we will help the school respond.

What data we collect

We collect only what's needed to run the service. This includes:

• School owner and teacher names and email addresses (for account creation and login)
• School name, contact details and term dates (to set up your school)
• Student names, dates of birth or ages, class enrolments and term fees (entered by the school)
• Parent and guardian names, email addresses and phone numbers (entered by the school)
• Health information about students, such as allergies, medical conditions and emergency action, where the school or parent chooses to record it (for example on a trial request or registration form). This is special category data, which UK GDPR treats with extra care
• Staff DBS check details, where the school records them (for example to remind you when a check is due to be renewed)
• Invoice and payment status records
• Festival and competition entries and results (entered by the school)
• Push notification tokens (if you choose to enable notifications)
• Questions you type into the in-app help assistant that it cannot answer, stored with your user account and school so we can improve the help articles. Please do not type personal details about children into it
• A record of when you accepted our terms, including the version, date and time, and technical details such as your IP address and browser
• For family registration forms, a one-way scrambled (hashed) version of the IP address, used only to prevent abuse

For term invoices, payments are typically arranged directly between schools and parents (for example, by bank transfer). For uniform orders, party bookings and any card payments the school turns on, payments are processed through Stripe. Where a school turns on direct debit, payments are collected through GoCardless. In every case, we do not collect or store your full payment card details or bank account number.

How we use your data, and our legal basis

We use the data collected to:

• Provide the ActivityOS service to schools and parents (to carry out our contract with the school)
• Send invoices and payment reminders by email on behalf of schools (on the school's instructions)
• Send push notifications about events, results and invoices (only if you switch them on)
• Allow parents to log in to their portal and view their information
• Keep the service secure, fix problems and prevent misuse (our legitimate interests)
• Keep records we are legally required to keep, such as invoices (legal obligation)
• Improve the service over time (our legitimate interests)

Health information is used only so the school can look after students safely. The school is responsible for having a lawful basis and, where needed, consent for recording it.

We do not sell your data to third parties. We do not use your data for advertising.

Cookies and local storage

ActivityOS uses a session token stored in your browser (via cookie or local storage) to keep you logged in. This is strictly necessary for the service to work and does not require your consent under UK GDPR.

We do not use advertising cookies, tracking pixels, or any third-party analytics that identify you personally.

This website uses Cloudflare Web Analytics to count page views and visits. It does not use cookies, does not track individual visitors, and does not collect personal data beyond what is needed to produce aggregate statistics.

Who we share data with

We use a small number of trusted third-party services (sub-processors) to run ActivityOS:

• Supabase — our database and authentication provider. Data is stored in Germany (Frankfurt). Supabase privacy policy →
• Cloudflare — our hosting and edge network provider. Cloudflare processes requests to our service, provides cookie-free, aggregate website analytics, and does not store your data in its own databases. Cloudflare privacy policy →
• Resend — used to send invoice, reminder and account emails on behalf of schools. Only the email address, school name and message details necessary to send the email are passed to Resend. Resend privacy policy →
• Stripe — used to process card payments and subscription billing. Stripe handles all card details directly; we never receive or store your card information. Stripe is also an independent controller for fraud prevention and its own legal obligations. Stripe privacy policy →
• GoCardless — used to collect direct debits, only where a school has turned this on. GoCardless privacy policy →
• Google Drive — used to store our weekly database backups. Backups are encrypted before they are uploaded, and Google does not hold the key. Google privacy policy →
• Browser push services (Google Firebase Cloud Messaging, Apple and Mozilla) — used to deliver push notifications, depending on your browser. Notifications may include a student's name. Firebase privacy policy →

Password check. When you create or change a password, your browser checks it against the free Have I Been Pwned list of breached passwords. Only the first five characters of a one-way hash of the password are sent, never the password itself, and the service can see your IP address, as any website you connect to can. If the check cannot run, the password is accepted. No account details are sent.

The same list, with what each provider does with the data, is in Schedule 2 of our Data Processing Agreement. We may also share data if the law requires it. No other third parties have access to your data.

Data transfers outside the UK

Our database is in Germany, which the UK recognises as providing adequate protection. Some of our other providers (such as Resend, Stripe, Cloudflare and Google) process data in the United States and other countries. Where data is transferred outside the UK, it is protected by an approved mechanism: the UK-US Data Bridge for certified providers, or standard contractual clauses with the UK Addendum, as required under UK GDPR.

How long we keep your data

• Active school accounts — data is retained for as long as the account is active
• Expired free trials — the account is read-only for 30 days after the trial ends, and is then treated as a closed account (below) unless the school subscribes
• Closed accounts — the school can export its data for 30 days, and we then delete it from live systems within a further 30 days
• Students, classes, festivals and events that a school deletes — permanently removed after 30 days
• Invoices and payment records — kept for 6 years to meet tax and accounting rules
• Declined family registrations — deleted after 90 days
• Unanswered help assistant questions — deleted after 90 days
• Parent portal accounts — removed when the last linked child is removed, and parents can request deletion at any time from within their portal or by emailing us
• Encrypted backups — replaced on a weekly cycle, and gone no later than six weeks after the live data is deleted
• Email logs — retained by Resend for up to 90 days for delivery tracking

Data Processing Agreement

If you're a school using ActivityOS, we act as a data processor on your behalf for the personal data you enter into the platform (students, parents/guardians, staff). Our terms for this are set out in our Data Processing Agreement, which forms part of our terms and is agreed when you create a school account. It covers what data we process, our sub-processors (listed above), security measures, and your rights as the data controller.

Children's data

ActivityOS stores student names, class information and, where the school records it, health and emergency information. Students under 18 do not have accounts and cannot log in. A school can mark a student as an adult, and an adult student can then sign in to the parent portal to see and manage their own record, in the same way a parent would. Student data is entered and managed by the school, which is responsible for being open with parents or guardians (or the adult student) about how it is used and for obtaining any necessary consent, in line with its own data protection obligations. We process it only on the school's instructions.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict how we process your data
• Receive a copy of your data in a portable format

To exercise any of these rights, email hello@activityos.co.uk. We will respond within one month. If your request is about data a school holds about a pupil or parent, we will pass it to the school, as it decides what happens to that data.

Parents using the portal can request data deletion directly from within the portal settings.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We'd appreciate the chance to put things right first, so please contact us.

Security

All data is transmitted over HTTPS. Access to the database is controlled by row-level security policies — schools can only access their own data, and parents can only access data relating to their own children (or, for an adult student, their own record). Backups are encrypted before they are stored. We review our security practices regularly. If a personal data breach affects school data, we will tell the school without undue delay, and within 48 hours of becoming aware of it.

Changes to this policy

If we make significant changes to this policy we will update the date at the top of this page and, where appropriate, notify active users by email.

Contact

For any questions about this privacy policy or how we handle your data, contact us at hello@activityos.co.uk.