Privacy Policy

Effective date: 3 October 2026

This privacy policy explains how Epic Schools collects, uses, shares and protects personal data when you use the Epic Schools mobile app (on Android and iOS) and the epicschools.app website. It also explains your rights and how to use them.

1. Who We Are

Epic Schools is operated by Surjit Investments Limited, trading as Epic Schools (“we”, “us”, “our”).

Company number: 08473909
Registered office: 7 Tudor Hill, Sutton Coldfield, Birmingham, B73 6BD
ICO registration number: ZC263199
Privacy contact: privacy@epicschools.app

2. Our Role: School Data and Our Own Data

Epic Schools is a management app used by UK supplementary schools, such as weekend, faith and community schools. Who is responsible for your data depends on what the data is.

Data held for your school. Pupil records, attendance, assessments, medical and safeguarding information, forms, messages and attachments are held on behalf of the school that uses Epic Schools. For this data, your school is the controller and decides what is collected and why. We act as the school’s processor: we store and process the data only on the school’s instructions and under a written agreement with the school. Your school’s own privacy notice explains how it uses this data, and questions about it should go to your school first. If you contact us about school data, we will pass your request to the school and help it respond.

Data we control. We are the controller for data we need to run our own business, including: school customer accounts and billing; app accounts, sign-in and security records; website enquiries and forms; account deletion and data rights requests; and communications with school administrators.

3. Who Uses the App

The app is used by school staff and parents or guardians. Children do not have their own accounts and are not intended to sign in to or use the app. Information about children is entered by school staff or by their parents or guardians.

4. The Personal Data Involved

Account and contact information

• Name, email address, phone number and role (for example, administrator, teacher or parent).
• The school or schools your account is linked to.
• Sign-in details. Your password is stored only as a one-way hash (using bcrypt), so we cannot see or recover it.

Pupil and school records (held for the school)

• Pupil names, dates of birth, class or group, and the parents or guardians linked to them.
• Attendance registers, assessments, marks and progress reports.
• Medical information (such as allergies or conditions) and safeguarding information. This is special category data, which receives extra protection under UK data protection law.
• Photos, uploaded documents, forms, consent records and messages between the school and families.
• Registration records and fee records.

Payment information

• Payment amounts, dates, status and related references.
• Card and bank payments are processed by Stripe. We do not see or store your full card number.

Technical and device information

• Device type, operating system and app version.
• Push notification tokens, if you allow notifications.
• Private calendar subscription links, if you choose to add school events to another calendar app.
• Security and audit logs, such as sign-in times and changes made to records.

Website information

• Information you submit through forms on epicschools.app, such as enquiries and account deletion requests.
• Information collected by cookies needed for the website to work.
• Device and usage information collected by Google reCAPTCHA when you use a form on the website, to check that the form is being completed by a person rather than an automated program.

We do not collect your precise location, your contacts, or advertising identifiers. We do not show advertising in the app, and we do not sell personal data.

5. How We Use Personal Data and Our Lawful Bases

For data we control, we rely on the following lawful bases under the UK GDPR:

• Providing the app and our service to schools (accounts, sign-in, support, billing): performance of our contract with the school, and our legitimate interests in operating the service for its users.
• Keeping the service and website secure (audit logs, spam protection on website forms, fraud and abuse prevention, troubleshooting): our legitimate interests in protecting the service, its users and their data.
• Sending service messages (account, security and policy updates): our legitimate interests, or our contract with the school.
• Keeping financial records and responding to data rights requests: legal obligation.
• Optional marketing emails to school contacts: consent or legitimate interests, as permitted by law. You can opt out at any time.

For data held for a school, the school decides the lawful basis, including the additional condition required for medical and safeguarding information. We process that data only to provide the service to the school.

You need to provide your name, email address and school to have an account, because the app cannot work without them. Other information is optional unless your school requires it.

6. Who We Share Data With

We share personal data only as needed to run the service, and never for advertising.

• Your school. School staff with the right permissions can see the records held for that school. Parents and guardians can see information the school shares with them about their own children.
• Replit. Hosts our servers, database and file storage.
• Google reCAPTCHA. Protects the forms on our website, including the contact and account deletion forms, from spam and abuse. Google receives information such as your IP address, browser and device details, and how you interact with the page, and uses it under the Google Privacy Policy and Terms of Service.
• Stripe. Payment processing. Stripe also acts as a separate controller for some payment data, such as fraud prevention, under its own privacy policy.
• Google and Apple. Deliver push notifications to your device. We send notifications through Google’s Firebase Cloud Messaging, which delivers them to iPhones and iPads through the Apple Push Notification service. Only your device token and the notification itself are sent to them.
• Brevo. Sends our emails, such as account invitations, password resets and account notices. If your school connects its own email account, invitations from your school may be sent through that account instead.
• Your calendar provider. If you subscribe to school events from another calendar app, such as Google Calendar, Apple Calendar or Outlook, that app’s provider fetches the event details from us using your private link. Its own privacy policy then applies to that copy.
• Professional advisers and authorities. Our accountants, lawyers and insurers where necessary, and the police, regulators or courts where the law requires it or to protect someone from harm.
• A buyer or successor. If our business is sold or restructured, data may transfer to the new owner, who must protect it in line with this policy.

Our service providers may use personal data only to provide services to us, under written contracts that require them to protect it to the standard described in this policy.

7. International Transfers

Our hosting provider (Replit), our push notification providers (Google and Apple) and our website spam protection provider (Google) are based in the United States, so personal data is processed outside the UK. Our email provider (Brevo) is based in the European Union, which the UK recognises as providing adequate protection. Where this happens, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the International Data Transfer Agreement or Addendum issued by the ICO.

8. How We Protect Data

• Data is encrypted in transit and at rest.
• Passwords are stored only as one-way bcrypt hashes.
• Access within each school is limited by role, so users see only what their role allows.
• Access by our own staff is limited to what is needed to provide and support the service.
• We keep audit logs of sign-ins and changes to records.

If a personal data breach occurs, we will inform affected schools without undue delay, and the ICO and affected individuals where the law requires it.

9. How Long We Keep Data

• App accounts: while the account is active. Once a deletion request has been completed, we delete or anonymise the account’s personal data within 30 days, except where it forms part of a school record or we need to keep it for a reason below.
• School records: for as long as the school instructs. When a school stops using Epic Schools, we return or delete its data as set out in our agreement with the school.
• Financial and billing records: six years from the end of the financial year they relate to, to meet UK tax and accounting requirements.
• Security and audit logs: 12 months, unless needed for longer to investigate a specific incident or resolve a dispute.
• Account deletion and data rights requests: 2 years after the request is closed, so we can show it was handled properly.
• Backups: deleted data may remain in encrypted backups until they are overwritten, which happens within 30 days. Backups are used only to restore the service.

How long school records are kept depends on the school’s legal and safeguarding obligations, any statutory retention requirements, and whether a record is needed for an ongoing matter.

10. Deleting Your Account

You can request deletion of your account and associated personal data:

• In the app: go to Profile and select Delete my account.
• Without the app: use the form on our Request Account Deletion page, or email privacy@epicschools.app.

We will respond within one month of receiving your request. Deleting your account does not automatically delete records your school holds about you or your children; we will pass that part of your request to the school. The Request Account Deletion page explains the process in full.

11. Your Rights

Under UK data protection law, you have the right to:

• access the personal data held about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict how your data is used;
• object to processing based on legitimate interests, including direct marketing;
• receive your data in a portable format; and
• withdraw consent at any time, where we rely on consent.

Some rights apply only in certain circumstances. To use any of these rights, email privacy@epicschools.app. We will respond within one month, which may be extended by up to two further months for complex requests; if so, we will tell you within the first month. We may need to confirm your identity before acting on a request. For records held by your school, we will pass your request to the school and support its response.

12. Children’s Data

Children do not use the app directly. Their information is entered by their school or by their parents or guardians, and it is visible only to authorised school staff and to the parents or guardians linked to them. We do not use children’s data for advertising, profiling or marketing. Parents and guardians can exercise rights on their child’s behalf by contacting the school or us.

13. Automated Decisions

We do not make decisions about you using solely automated processing that have legal or similarly significant effects.

14. Cookies on Our Website

The epicschools.app website uses cookies that are needed for the site and its forms to work. Our forms use Google reCAPTCHA, which sets cookies and collects device and usage information to protect the forms from spam and abuse; we rely on our legitimate interests in keeping the forms secure. We do not use cookies on the website for advertising. The app itself does not use advertising trackers.

15. Changes to This Policy

We may update this policy from time to time. The effective date at the top shows when it was last changed. If we make significant changes, we will let schools and app users know through the app or by email.

16. Contact and Complaints

For questions about this policy or your personal data, email privacy@epicschools.app or write to Surjit Investments Limited, 7 Tudor Hill, Sutton Coldfield, Birmingham, B73 6BD.

If you are unhappy with how we have handled your personal data, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We would appreciate the chance to resolve your concern first.