Privacy policy

Privacy Policy

Last updated: 5 October 2026

1. Who we are

HeadteacherChat is run by Headteacherchat Ltd, a company registered in England and Wales under company number 14015248. Our registered office is The Enterprise Centre, University of East Anglia, Norwich, Norfolk, NR4 7TJ.

We are the controller of the personal information described in this policy. That means we decide how and why it is used, and we are responsible for looking after it.

This policy covers:

  • our website, www.headteacherchat.com
  • our community, community.headteacherchat.com, and the HeadteacherChat Community apps
  • our shop, www.schoolleaders.shop
  • our emails, events, webinars and social media

Our data protection lead is Jonathan Coy. You can contact us about anything in this policy at info@headteacherchat.com or by post at the address above. Our ICO registration number is ZC027936.

2. The information we collect

Information you give us:

  • Account and profile details: your name, email address, role, school or trust, profile photo and anything else you add to your community profile.
  • Community activity: your posts, comments, messages, event sign-ups and the spaces you join.
  • Orders: your name, email address, delivery address, phone number and order details when you buy from our shop.
  • School and trust memberships: the names and email addresses of the people named on the membership, plus billing contacts, purchase order numbers and invoice details.
  • Messages and forms: anything you send us by email, through our contact forms, as an anonymous question, a resource request or an article pitch.
  • Reviews: your name and what you write if you review a product.
  • Newsletter sign-ups: your name, email address and the emails you choose to receive.

Information collected automatically:

When you use our website, community or shop, we collect technical information such as your IP address, browser and device type, the pages you visit, the links you click and how you arrived. Some of this comes from cookies and similar tools (see section 9).

Information from other organisations:

  • Our payment providers tell us whether a payment succeeded. We never see or store your full card number.
  • Advertising platforms such as Google and Meta tell us when someone who clicked one of our adverts goes on to buy or join.
  • If your school or trust buys a membership for you, they give us your name and email address so we can invite you.

We do not ask for, and ask you not to share, special category information such as health details, or any information that could identify a pupil, a member of staff or a family.

3. How we use your information and why

  • Create and run your community account, and give you access to spaces, resources and events. Why: to provide the membership you signed up for (contract).
  • Take payments, process orders, deliver planners and downloads, and send receipts and invoices. Why: contract, and to meet our legal duties for tax and accounting.
  • Send service emails, such as renewal reminders, failed-payment notices, event joining details and changes to our terms. Why: contract, and our legitimate interest in running the service well.
  • Send newsletters, The Roundup and news about our resources and events. Why: your consent, which you can withdraw at any time. For existing customers, we may send similar news under the soft opt-in rules, always with a way to unsubscribe.
  • Read and review anonymous questions, resource requests and article pitches, and publish an anonymised version where agreed. Why: legitimate interest in sharing useful questions with school leaders, and the choices you make when you send them.
  • Moderate the community and keep it safe. Why: legitimate interest in protecting members, and our legal duties.
  • Understand how our website, community and shop are used so we can improve them. Why: legitimate interest. Where cookies are involved, your consent.
  • Show adverts and measure whether they work. Why: your consent. On our shop you choose through the cookie banner. We are introducing the same choice on our website and community (see section 9).
  • Manage our relationships with partners and schools, including invoices and contracts. Why: contract and legitimate interest.
  • Keep records for tax, accounting and legal claims. Why: legal obligation and legitimate interest.

Where we rely on legitimate interests, we have weighed our interests against your rights and expectations. You can ask us for more detail.

4. Private community discussions

The community is a private space for school leaders. We do not publish your posts or messages outside the community, use them in reports for partners, or share them with anyone else without your permission.

Our team sees community activity in order to run, moderate and support the community. We may count activity in general terms, for example how many members joined an event, without identifying anyone.

5. Anonymous questions and other things you send us

When you send an anonymous question:

  • we keep your original question and contact details private
  • a member of our team reads every question before anything is published
  • we remove anything that could identify you, your school, colleagues, pupils or families
  • we only publish the anonymised version in the places explained when you send it

We use automated tools, including AI services, to help sort and check questions, requests and pitches before a person reviews them, for example to spot personal details that need removing. These tools do not make decisions about you. A member of our team always makes the final decision about what is published.

We keep the name, email address and private context you send with a question, request or pitch for 90 days after we have reviewed it, then delete them. We keep only the published text.

6. Who we share your information with

We do not sell your personal information.

We use trusted service providers to run HeadteacherChat. They handle personal information only on our instructions and must keep it secure. The full list is in our Sub-Processor list below. In summary:

  • Circle: hosts our community, apps, member profiles, events, community emails and membership payments
  • Stripe: processes card payments for memberships
  • Shopify, including the Shop app: runs our shop, orders and checkout
  • Judge.me: collects and shows product reviews
  • VDepot: stores and delivers our printed planners
  • Xero: our accounting, invoices and payment records
  • Cloudflare: hosts and protects our website, stores website data, sends website emails and runs some AI tools
  • Notion: stores our website content, form submissions and business records
  • Google: email and documents (Google Workspace), website statistics (Google Analytics) and advertising (Google Ads)
  • Fastmail: our business email
  • Meta: advertising on Facebook and Instagram, and measuring those adverts
  • Microsoft Clarity: shows us how visitors use our website pages, including session recordings, so we can fix problems
  • PostHog: website statistics and measuring how people use our website
  • Triple Whale: measures how well our shop and advertising perform
  • Dub: creates the short links and QR codes we use, and counts clicks on them
  • TypeSafe and Cloudflare Workers AI: help check and sort questions and submissions before our team reviews them
  • Anthropic (Claude): an AI assistant our team uses to help draft, organise and check our work
  • X: posting to our X account and showing posts on our website

We may also share information:

  • with your school or trust, if they pay for your membership. We tell them which places have been used, not what you do in the community
  • with a partner, only if you choose to, for example by signing up for a partner's offer or a partner webinar where we tell you clearly at sign-up that your details will be shared
  • with our accountants and professional advisers
  • when the law requires it, or to protect someone's safety
  • with a buyer or investor if our business, or part of it, is sold or reorganised. They would have to keep using your information in line with this policy

7. International transfers

Some of our service providers store or access information outside the UK, mainly in the European Economic Area and the United States. When this happens, we make sure your information is protected by a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified), or by contract terms approved by the Information Commissioner's Office.

8. How long we keep your information

  • Community account and profile: while your account is open. If you ask us to close it, we delete or anonymise it within 30 days, apart from what we must keep for the reasons below.
  • Your community posts: while your account is open, unless you delete them sooner.
  • Orders, payments and invoices: 6 years after the end of the financial year they relate to, as tax law requires.
  • Newsletter and marketing records: until you unsubscribe, then we keep a record of your email address so we do not contact you again.
  • Contact form and support emails: 24 months after the conversation ends.
  • Anonymous questions, requests and pitches: contact details and private context for 90 days after review (see section 5).
  • Website statistics: up to 26 months.

9. Cookies

We use cookies and similar tools on our website, community and shop. Some are needed for the sites to work, such as keeping you signed in or remembering your basket. Others help us understand how the sites are used and measure our adverts. Our shop has a cookie banner where you can make your choices. We are introducing cookie settings on our website and community too. Until then, you can block or delete cookies in your browser settings. Our Cookie Policy below lists the cookies we use and how to turn them off.

10. Your rights

You have the right to:

  • ask for a copy of the personal information we hold about you
  • ask us to correct information that is wrong or incomplete
  • ask us to delete your information
  • ask us to limit how we use your information
  • object to us using your information on the basis of legitimate interests
  • ask us to send your information to you or another organisation in a reusable format
  • withdraw your consent at any time, for example by unsubscribing from emails

To use any of these rights, email info@headteacherchat.com. We will reply within one month. There is usually no charge.

To unsubscribe from our emails, use the link at the bottom of any email or change your notification settings in the community.

11. Keeping your information safe

We use services with strong security, encrypted connections and two-step sign-in for our team accounts. Only people who need access to your information for their work can see it. If something goes wrong that puts your information at risk, we will deal with it quickly and tell you and the Information Commissioner's Office where the law requires.

12. Children

Our services are for adults working in schools. We do not knowingly collect information about anyone under 18. If we find we have, we will delete it.

13. Changes to this policy

We will update this policy when the way we use personal information changes. We will show the date of the latest version at the top. If we make an important change, we will tell members by email or in the community.

14. Complaints

If you are unhappy with how we have handled your information, please contact us first at info@headteacherchat.com and we will try to put it right.

You also have the right to complain to the Information Commissioner's Office:

  • Website: ico.org.uk
  • Phone: 0303 123 1113

Cookie Policy

Last updated: 4 October 2026

1. About this policy

This Cookie Policy explains how Headteacherchat Ltd ("we", "us", "our") uses cookies and similar technologies on:

  • Website: www.headteacherchat.com
  • Community: community.headteacherchat.com and the HeadteacherChat Community apps
  • Shop: www.schoolleaders.shop

Please read it alongside our Privacy Policy above, which explains how we handle personal information.

2. What cookies are

Cookies are small text files saved on your phone, tablet or computer when you visit a website. Similar technologies, such as pixels, tags and local storage, work in a similar way. In this policy we call them all "cookies".

Some cookies are set by us. Others are set by the services we use, such as Google or Meta.

3. The types of cookies we use

Strictly necessary cookies keep the sites working and secure. They keep you signed in, remember your basket and protect the sites from attacks. The sites cannot work properly without them, so they cannot be switched off.

Statistics cookies tell us how people use our sites, such as which pages are visited and where visitors came from. We use this to fix problems and improve the sites. Microsoft Clarity can also record how a visitor moves around a page, such as clicks and scrolling, so we can see where pages are hard to use.

Advertising cookies help us show our adverts to people who may be interested and measure whether those adverts work, for example whether someone who clicked an advert went on to buy a planner or join the community.

4. Cookies we use

Cookie names and how long they last are set by each provider and can change. If you would like the current full list, email info@headteacherchat.com.

Strictly necessary:

  • Cloudflare (website): __cf_bm, cf_clearance. Security and protection from bots. 30 minutes to 1 year.
  • HeadteacherChat (website): website sign-in cookie. Keeps you signed in to member-only pages on headteacherchat.com. Up to 14 days.
  • Circle (community): Circle session and security cookies. Signs you in and keeps the community secure. Until you sign out, or as set by Circle.
  • Shopify (shop): cart, _tracking_consent and similar. Remembers your basket, runs checkout and records your cookie choices. Up to 1 year.

Statistics:

  • Google Analytics (website and shop): _ga, _ga_*. Counts visits and shows how the sites are used. Up to 2 years.
  • PostHog (website): ph_*_posthog. Shows how people use the website so we can improve it. Up to 1 year.
  • Microsoft Clarity (website): _clck, _clsk. Shows how visitors use our pages, including session recordings. Up to 1 year.
  • Shopify (shop): _shopify_y, _shopify_s. Shows how the shop is used. Up to 1 year.
  • Triple Whale (shop): Triple Whale tracking cookies. Measures how the shop and our adverts perform. As set by Triple Whale.

Advertising:

  • Google Ads (website, community and shop): _gcl_au and similar. Measures whether our Google adverts lead to sign-ups or orders. Up to 90 days.
  • Meta, Facebook and Instagram (website, community and shop): _fbp and similar. Measures whether our Facebook and Instagram adverts work, and helps show them to relevant people. Up to 90 days.

5. Your choices

On our shop, you can choose which cookies we use through the cookie banner. We are introducing cookie settings on our website and community so you can choose whether statistics and advertising cookies are used there too. Until they are in place, you can control cookies in these ways:

  • Your browser: you can block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the sites, such as signing in or checkout, may not work.
  • Google Analytics: use Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout).
  • Google adverts: change your Google ad settings (adssettings.google.com).
  • Facebook and Instagram adverts: change your Meta ad preferences (facebook.com/adpreferences).

6. Changes to this policy

We will update this policy when the cookies we use change, and show the date of the latest version at the top.

7. Contact us

Headteacherchat Ltd
The Enterprise Centre, University of East Anglia, Norwich, Norfolk, NR4 7TJ
Email: info@headteacherchat.com
Website: www.headteacherchat.com

Sub-Processor List

Last updated: 4 October 2026

1. About this list

This list shows the service providers that handle personal information for Headteacherchat Ltd when we run our website (www.headteacherchat.com), our community (community.headteacherchat.com) and our shop (www.schoolleaders.shop). We are the controller of that information. These providers handle it only on our instructions.

Our Privacy Policy above explains what information we collect and why.

2. Our service providers

  • Circle Internet Services Inc.: hosts our community and apps, member profiles, events, community emails and membership payments. Information: name, email, profile, posts and messages, event sign-ups, membership and payment records.
  • Stripe: processes card payments for memberships. Information: name, email, billing details, payment records.
  • Shopify, including the Shop app: runs our shop, orders and checkout. Information: name, email, delivery address, phone number, order and payment records.
  • Judge.me: collects and shows product reviews. Information: name, email, review text.
  • VDepot Limited: stores and delivers our printed planners. Information: name, delivery address, phone number, order details.
  • Xero: accounting, invoices and payment records. Information: names and contact details of customers, schools and partners, invoice and payment records.
  • Cloudflare: hosts and protects our website, stores website data, sends website emails and runs some AI tools. Information: IP address, usage data, website sign-in details, form submissions.
  • Notion: stores our website content, form submissions and business records. Information: names, emails and messages sent through our forms, business contact details.
  • Google: email and documents (Google Workspace), website statistics (Google Analytics) and advertising (Google Ads). Information: emails and documents, IP address, usage and advertising data.
  • Fastmail: our business email. Information: emails and contact details.
  • Meta: advertising on Facebook and Instagram, and measuring those adverts. Information: advertising and usage data.
  • Microsoft (Clarity): shows us how visitors use our website pages, including session recordings. Information: IP address, usage data, session recordings.
  • PostHog: website statistics and measuring how people use our website. Information: IP address, usage data.
  • Triple Whale: measures how well our shop and advertising perform. Information: order, usage and advertising data.
  • Dub: creates our short links and QR codes, and counts clicks on them. Information: click data, IP address, device and location information.
  • TypeSafe: helps check and sort questions and submissions before our team reviews them. Information: text of questions and submissions.
  • Anthropic (Claude): an AI assistant our team uses to help draft, organise and check our work. Information: information our team works with, such as emails, community activity and business records.
  • X: posting to our X account and showing posts on our website. Information: usage data when you view X content on our website.

3. International transfers

Some of these providers store or access information outside the UK, mainly in the European Economic Area and the United States. When this happens, your information is protected by a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or by contract terms approved by the Information Commissioner's Office.

4. How we choose and review providers

We check a provider's security and data protection terms before it handles personal information for us, and we use their data processing agreements. We review this list at least once a year and whenever we add or stop using a service.

5. Changes to this list

We update this list when we add or remove a provider, and show the date of the latest version at the top.

6. Contact us

Headteacherchat Ltd
The Enterprise Centre, University of East Anglia, Norwich, Norfolk, NR4 7TJ
Email: info@headteacherchat.com
ICO registration number: ZC027936