Privacy Policy

Last updated: June 2026

Who we are

ActivityOS is a studio management platform for independent UK activity schools, accessible at activityos.co.uk and app.activityos.co.uk. When we say "we", "us" or "ActivityOS" in this policy, we mean the operator of this service.

For questions about your data, contact us at hello@activityos.co.uk.

What data we collect

We collect only what's needed to run the service. This includes:

• School owner and teacher names and email addresses (for account creation and login)
• School name, contact details and term dates (to set up your school)
• Student names, class enrolments and term fees (entered by the school)
• Parent names, email addresses and phone numbers (entered by the school)
• Invoice and payment status records
• Festival and competition entries and results (entered by the school)
• Push notification tokens (if you choose to enable notifications)

We do not collect payment card details — payments are handled directly between schools and parents via bank transfer.

How we use your data

We use the data collected to:

• Provide the ActivityOS service to schools and parents
• Send invoices and payment reminders by email on behalf of schools
• Send push notifications about events, results and invoices
• Allow parents to log in to their portal and view their information
• Improve the service over time

We do not sell your data to third parties. We do not use your data for advertising.

Cookies and local storage

ActivityOS uses a session token stored in your browser (via cookie or local storage) to keep you logged in. This is strictly necessary for the service to work and does not require your consent under UK GDPR.

We do not use advertising cookies, tracking pixels, or any third-party analytics that identify you personally.

Who we share data with

We use a small number of trusted third-party services to run ActivityOS:

• Supabase — our database and authentication provider. Data is stored on Supabase's infrastructure. Supabase is SOC 2 compliant. Supabase privacy policy →
• Resend — used to send invoice and reminder emails on behalf of schools. Only the email address, school name and invoice details necessary to send the email are passed to Resend. Resend privacy policy →
• Cloudflare — our hosting and edge network provider. Cloudflare processes requests to our service. Cloudflare privacy policy →
• Firebase (Google) — used to deliver push notifications to devices. Push notification tokens are stored securely and used only to send notifications. Firebase privacy policy →

No other third parties have access to your data.

Data transfers outside the UK

Some of our third-party providers (Supabase, Resend, Cloudflare, Firebase) operate infrastructure in the United States and other countries. Where data is transferred outside the UK, it is protected by appropriate safeguards including Standard Contractual Clauses or equivalent mechanisms as required under UK GDPR.

How long we keep your data

• Active school accounts — data is retained for as long as the account is active
• Deleted accounts — data is deleted within 30 days of account closure
• Parent portal accounts — parents can request deletion at any time from within their portal or by emailing us
• Email logs — retained by Resend for up to 90 days for delivery tracking

Children's data

ActivityOS stores student names and class information entered by school owners. Students are not users of the platform — they do not have accounts and cannot log in. Student data is entered and managed solely by the school, which is responsible for obtaining any necessary consent from parents or guardians in line with their own data protection obligations.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict how we process your data
• Receive a copy of your data in a portable format

To exercise any of these rights, email hello@activityos.co.uk. We will respond within 30 days.

Parents using the portal can request data deletion directly from within the portal settings.

Security

All data is transmitted over HTTPS. Access to the database is controlled by row-level security policies — schools can only access their own data, and parents can only access data relating to their own children. We review our security practices regularly.

Changes to this policy

If we make significant changes to this policy we will update the date at the top of this page and, where appropriate, notify active users by email.

Contact

For any questions about this privacy policy or how we handle your data, contact us at hello@activityos.co.uk.