Privacy policy

1. Who is responsible

Varcombe Ventures Limited (company no. 17394715, registered office 82a James Carter Road, Mildenhall, Bury St Edmunds IP28 7DE) is the controller of personal data collected through SchoolFacts. We are registered with the Information Commissioner's Office (ICO), registration reference ZC221769. For any privacy question, or to exercise your rights, contact info@schoolfacts.uk.

2. What we collect

We keep the amount of personal data to a minimum:

• Account details: your email address, which we receive from our payment provider when you buy a pass, and a password if you choose to set one. A password is stored only as a secure hash by our authentication provider, never as plain text.
• Purchase status: whether you hold an active pass, its expiry, and a customer reference from our payment provider. We never see or store your card details.
• Information you enter into tools: any postcode you type, whether into the odds tool, the address check, the shortlist or the map's search box, is sent to a postcode-lookup service to find its approximate location. We do not store it. Notes you add to a shortlist stay in your browser and never reach us.
• A device marker for the free check: the first time you use the free postcode check, your browser keeps a random identifier so the one-a-month allowance is counted per device, not per shared internet connection. It identifies nothing about you and is sent only with a free check. A free check also sends the straight-line distance between your postcode and the school, which your browser works out itself; your postcode is never sent to us.
• Technical data: standard server and security logs (such as IP address and request details) generated when you use the site.
• On-device data: your shortlist and some preferences are stored in your browser's local storage and stay on your device; we do not receive them.

3. Why we use it, and our lawful basis

• To provide your account and premium features, and to take payment: performance of our contract with you.
• To keep the service secure, working and improving: our legitimate interests in running a safe, reliable service.
• Where we ask for your consent (for example for any non-essential cookies), we rely on that consent, which you can withdraw at any time.

4. Who processes it for us

We use a small number of trusted providers who process data on our behalf under contract:

• Supabase: account, authentication and database hosting (EU / London region).
• Stripe: payment processing. Stripe collects your card details directly; we receive only a confirmation and a customer reference.
• Netlify: website hosting and delivery.
• postcodes.io: turning a postcode you enter into an approximate location.
• OpenFreeMap: supplying the map tiles shown on the map page.
• Plausible Analytics: privacy-friendly, cookieless visitor statistics (EU-hosted). It does not use cookies, does not collect personal data, and does not store your IP address.
• Resend (with Amazon Web Services, EU region): sends account emails such as confirmation links and password resets, from noreply@varcombeventures.com.
• OpenFreeMap is the only other site your browser contacts on its own: the map tiles. Typefaces and the mapping and sign-in libraries are served from schoolfacts.uk itself, so no font or code library service sees your visit.

Some providers may process data outside the UK; where they do, appropriate safeguards (such as UK or EU approved transfer mechanisms) apply. We do not sell your personal data, and we do not use it for third-party advertising.

5. Cookies, local storage and analytics

SchoolFacts does not use advertising or cross-site tracking cookies. We use only strictly necessary storage to keep you signed in and to remember functional preferences and your shortlist (held in your browser).

For visitor statistics we use Plausible Analytics, a privacy-friendly tool that counts page views and aggregate usage without cookies and without collecting personal data or storing IP addresses. Because it holds nothing that identifies you, there is no consent banner and nothing to withdraw; if you prefer, you can still block it with any browser content blocker.

6. How long we keep it

We keep account and purchase records while you have an account and for a reasonable period afterwards to meet legal, accounting and fraud-prevention obligations, then delete or anonymise them. Server logs are kept for a short period. You can ask us to close your account at any time.

The free postcode check counts what you have used against a one-way hash of your device marker and your internet address, never the address or the marker itself. A count is meaningless once the period it belongs to has passed, so we delete it within 40 days: the allowance runs for a calendar month, and the abuse limit that sits beside it runs for a day.

7. Your rights

You have the right to access the personal data we hold about you, to have it corrected or erased, to object to or restrict certain processing, and to receive it in a portable form. To exercise any of these, email info@schoolfacts.uk. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk), though we would appreciate the chance to put things right first.

8. Children

SchoolFacts is aimed at parents, carers and other adults researching schools. It is not directed at children, and we do not knowingly collect personal data from children.

9. Changes

We may update this policy; the "last updated" date above shows when. Significant changes will be highlighted on the site.