Privacy Policy

Who this is

This IT Assessment Tool is operated by Redsquid Education Ltd, Studio, 2 Elstree Way, Borehamwood, WD6 1JH, United Kingdom. If you have questions about this policy or your data, contact ben.obrien@redsquideducation.co.uk.

What we collect

• Account information: name, email address, and role (Admin, Assessor, Cyber Assessor, or Client Viewer).
• Assessment data: information entered by assessors about a school or trust's IT estate — device inventories, cyber security posture, DfE compliance ratings, budgets, contracts, and related notes. This is organisational data about IT infrastructure, not information about pupils.
• Optional uploads: school/trust logos, and — only where an assessor chooses to use it and confirms the document contains no personal data — technical network documentation for a school.

Signing in with Google or Microsoft

If you choose to sign in with a Google or Microsoft account, we receive your verified email address and display name from that provider, used only to match you to an account an administrator has already created for you here — we don't create new accounts automatically from a sign-in attempt, and we don't request or receive access to your email, files, calendar, or anything else in your Google or Microsoft account beyond that basic identity information. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

How we use it

Solely to provide the assessment tool itself: authenticating you, showing you the schools/trusts you're permitted to see, and generating the dashboards and reports the tool is built around. We don't sell this data, and we don't use it for advertising or profiling.

Who else sees it

• Our hosting provider (Vercel) and database provider, who store and run the application on our behalf.
• Google or Microsoft, only if you choose to sign in that way — as above, purely to verify your identity, not to share your assessment data with them.
• Anthropic, but only for a specific, currently disabled feature (AI-assisted extraction from an uploaded technical network document) — this stays off until we've completed a data-protection review of that feature.

We don't share your data with anyone else, and we don't sell it.

Cookies

We use a single, first-party session cookie to keep you signed in. It's required for the tool to work and isn't used for tracking or advertising. We don't currently use any analytics or third-party tracking cookies.

How long we keep it

Account information is kept for as long as your account remains active, plus a short period afterwards in case it needs reinstating. Assessment data is kept as an ongoing organisational record for the school or trust it belongs to, for as long as we continue providing the service to them.

Your rights

Under UK data protection law, you have rights to access, correct, or request deletion of your personal data, and to object to how it's processed. Contact ben.obrien@redsquideducation.co.uk to exercise these, or to raise a concern. You can also complain to the UK's data protection regulator, the Information Commissioner's Office (ico.org.uk), though we'd appreciate the chance to address it directly first.