Short version: We collect your email address to create your account, and payment details are handled entirely by Stripe — we never see your card number. We use your data to run the service and nothing else. You can ask us to delete your account at any time.
1. Who we are
Nanasays ("we", "us", "our") operates nanasays.school, a UK independent schools research platform. For GDPR purposes we are the data controller. Contact: [email protected].
2. What data we collect
- Account data: your email address, collected when you sign up or log in via magic link.
- Onboarding preferences: optional details you provide about your child (age range, boarding preference, sports interest) — used only to personalise Nana's responses.
- Purchase data: whether you have made a purchase and the date. We store only a Stripe customer ID — your payment card details are processed and stored by Stripe, never by us.
- Usage data: questions you ask Nana, schools you shortlist, visit notes you write, and which report pages you view. Stored in our database linked to your account.
- Cookies: a session cookie set by Supabase to keep you logged in. An analytics cookie (Google Analytics 4) set only after you accept cookies.
3. Why we collect it (lawful basis)
- Contract performance: account data and purchase records are necessary to deliver the service you paid for.
- Legitimate interests: usage data helps us improve the product. We balance this against your right to privacy — we do not share or sell usage data.
- Consent: analytics cookies are only set after you accept. You can withdraw consent by clearing cookies or using the "Manage cookies" link in the footer.
4. Who we share data with
We use the following sub-processors. We have data processing agreements with each:
- Supabase (database and authentication) — EU-hosted, SOC 2 Type II certified.
- Stripe (payment processing) — PCI DSS Level 1 certified. Stripe processes and stores all payment card data.
- Resend (transactional email) — used to send sign-in links and purchase confirmations.
- Google Analytics 4 (analytics) — only active after consent. IP anonymisation enabled.
- Vercel (hosting) — processes request logs. Logs retained for 30 days.
We do not sell, rent, or trade your personal data with any third party for marketing purposes.
5. How long we keep your data
- Account and purchase records: retained for 3 years after your last login, or until you request deletion.
- Usage data (Nana conversations, visit notes): retained for 3 years, or until deletion request.
- Analytics data: retained per Google's default 26-month rolling window.
6. Your rights
Under UK GDPR you have the right to: access the data we hold about you, correct inaccurate data, request deletion ("right to be forgotten"), object to processing, and request a portable copy of your data.
To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk.
7. Cookies
- sb-auth-token — Supabase session cookie. Essential for login. Duration: session / 1 week.
- nanasays-consent — stores your cookie consent choice. Duration: 1 year.
- _ga, _ga_* — Google Analytics. Set only after consent. Duration: 26 months.
8. Children
Nanasays is a service for parents and is not directed at children under 13. We do not knowingly collect data from children.
9. Changes to this policy
We may update this policy as the service evolves. Material changes will be notified by email to registered users. The "Last updated" date at the top of this page always reflects the current version.
10. Contact
Questions about this policy: [email protected]. Postal address available on request.
See also: Terms of Service