Privacy Policy
Last updated: November 2026
SchoolBoard is a product of Eduraa Ltd ("we", "us", "our"). We are committed to protecting the privacy of schools, their staff, and their students. This policy explains what data we collect, how we use it, and your rights under UK data protection law.
1. Who we are
SchoolBoard is provided by Eduraa Ltd, a company registered in England and Wales (Companies House number: 16442434). Our registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
We are registered with the Information Commissioner's Office (ICO). ICO registration number: ZC165595
SchoolBoard provides animated house points leaderboards for UK schools. Schools connect their Management Information System (MIS) data via Google Sheets, and SchoolBoard reads this data to generate live dashboard displays.
2. What data we collect
Account data (stored): When a school administrator signs in via Google, we store their email address, display name, and account creation date in our database (Google Firebase). This is necessary to manage their dashboard configuration.
Dashboard configuration (stored): House names, colours, house icon choices (one of our 101 built-in icons, or an uploaded image), theme preferences, Google Sheet ID, column mappings, and display settings. This is stored in Firebase Firestore.
School branding (stored): A school logo or crest and custom house icon images, if the school uploads them. They are stored in Firebase Storage in a folder tied to the uploading account, which only that account can write to. Uploads must be images under 2 MB, and large photos are resized in the browser before upload. Because they are shown on the school's display, anyone with the display link can see them, so images should not show or identify pupils.
Contact form submissions (stored): Name, email, school name, role, and message content submitted via the website contact form.
3. House points data — how it flows
This is the most important section. SchoolBoard reads house points data from a Google Sheet that the school maintains. The data flow is:
School's MIS (Bromcom, Arbor, etc.) → Google Sheet (school-owned) → SchoolBoard reads via API → displayed in browser
| Data type | Stored by SchoolBoard? | Notes |
|---|---|---|
| House names & totals | No — read on each refresh | Aggregated from sheet data |
| Student names | No — not read | SchoolBoard does not currently read or display pupil names. |
| Individual point values | No — never stored | Aggregated per house in memory, then discarded |
| Dates | No — never stored | Used for time window filtering only |
| MIS credentials | Never | Schools manage their own MIS-to-Sheet pipeline |
SchoolBoard never stores or logs data read from the school's Google Sheet. The mapped columns are read via the Google Sheets API and processed in server memory to calculate house totals, which are sent to the browser for display. To limit load on Google's service, the mapped columns may be held in server memory for up to 60 seconds, and the resulting house totals (no individual pupil data) may be cached by our hosting provider for a few minutes. Nothing from the sheet is written to any database, file, or log.
4. Student data
SchoolBoard currently shows house-level totals only. It does not read, process or display pupil names, even if a school's Google Sheet contains them: only the mapped house, points and date columns are requested from Google. If we reintroduce an optional feature that shows individual pupils, we will update this policy before it is available.
5. Our role under UK GDPR
Because SchoolBoard currently processes house-level data only, we do not expect to process pupils' personal data on a school's behalf. The personal data involved is the administrator's account. Where a school's sheet data could identify individuals, SchoolBoard (operated by Eduraa Ltd) acts as a data processor on behalf of the school (the data controller). A Data Processing Agreement (DPA) is available for schools that require one — view our standard DPA or contact us to request a signed copy.
Our lawful basis (for the personal data we control): we process administrator account data on the basis of contract (Article 6(1)(b) UK GDPR) — it is necessary to provide the Service you sign up for. We process contact-form submissions on the basis of our legitimate interests (Article 6(1)(f)) in responding to enquiries about SchoolBoard. Where we act as processor for student data, the school is responsible for establishing its own lawful basis.
6. How we protect your data
- All data in transit is encrypted via HTTPS/TLS
- Firebase services use encryption at rest
- Google Sheets access uses a read-only service account — we cannot modify your data
- SchoolBoard never has access to your MIS credentials
- Administrator authentication uses Google's OAuth 2.0 (we never see or store passwords)
- Access to production systems is restricted to authorised personnel
7. Sub-processors
| Service | Purpose | Data location |
|---|---|---|
| Google Firebase (Auth, Firestore, Storage) | Authentication, configuration storage, file storage | europe-west2 (London) |
| Vercel | Website and API hosting | London (lhr1) |
| Google Sheets API | Reading house points data | Google Cloud (school's region) |
| Resend | Sending contact-form notification emails | USA (safeguarded by Standard Contractual Clauses) |
| Google reCAPTCHA | Abuse/bot protection (Firebase App Check) | USA (safeguarded by Standard Contractual Clauses) |
8. Data retention
Account data: Retained while the school has an active subscription. Deleted within 30 days of account closure on request.
Dashboard configuration and branding images: Retained while the account is active, and for 90 days after a trial or subscription ends so a returning school can pick up where it left off. Deleted with the account.
House points data: Never retained — read transiently on each refresh.
Contact form data: Retained for up to 12 months, then deleted.
9. Your rights
Under the UK GDPR, you have the right to access, rectify, erase, restrict processing, port, and object to processing of your personal data. To exercise any of these rights, contact us at the address below.
For student data that passes through SchoolBoard transiently: since we do not store this data, deletion and access requests should be directed to the school (the data controller) who manages the source data in their MIS and Google Sheet.
If you are unhappy with how we have handled your personal data, you also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO) — ico.org.uk — though we would ask that you contact us first so we can try to resolve it.
10. Cookies and third-party resources
SchoolBoard uses only essential cookies required for authentication (Firebase Auth session). We do not use analytics cookies, advertising cookies, or behavioural tracking.
We serve our fonts and other assets from our own infrastructure, so your browser does not make requests to third-party font or content-delivery networks (such as Google Fonts) when you use SchoolBoard.
To protect the platform from bots and abuse, we use Google reCAPTCHA (via Firebase App Check). This means Google receives some device and usage information from your browser to assess whether a request is genuine. Its use is governed by Google's Privacy Policy and Terms of Service.
11. Children's data
SchoolBoard is designed for use by school staff, not by students directly. Students do not create accounts, log in, or interact with the platform.
Published dashboards show house names and totals only — no pupil names. A dashboard is reached via a long, unguessable link (not listed or searchable), and the school controls who that link is shared with. The link is not password-protected, so anyone who has it can view the display; if a link is shared somewhere it shouldn't be, the school can replace it from the admin panel, and the old link stops working.
12. Changes to this policy
We may update this policy from time to time. Material changes will be communicated to active subscribers via email. The "last updated" date at the top of this page will always reflect the current version.
13. Contact
For any questions about this privacy policy, to request a Data Processing Agreement, or to exercise your data protection rights, contact us at:
Eduraa Ltd
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
Email: privacy@eduraa.co.uk
← Back to SchoolBoard Terms of Service Data Processing Agreement