Privacy policy
Last updated: 19 October 2026
Nurtivo is an online workspace where nurseries, early years settings and schools record children’s learning, manage classes and keep families informed. This policy explains what personal information is handled when you visit this website or use Nurtivo, why, and what your rights are. We have written it in plain English; if anything is unclear, please contact us.
1. Who is responsible for your information
Two different roles apply, and it matters which one you are dealing with:
- Your school or setting decides what children’s and families’ information goes into Nurtivo and why. For that information the school is the controller and Nurtivo is its processor: we only handle it to provide the service, on the school’s instructions. We do not use it for our own purposes, for advertising, or sell it. If you are a parent or carer and want to see, correct or delete information about your child, please ask your school first; we will help them respond.
- Nurtivo is the controller of the information we need to run the service itself: school sign-ups and account holders, billing, website enquiries, and security records (section 2, items e–g).
Nurtivo
[]
Privacy contact: support@nurtivo.co.uk
ICO registration number: []
2. The information we handle
- a) School staff (administrators and teachers): name, email address, role, assigned classes and a password, which we store only as a one-way hash. For the school: its name, address, contact details and optional logo.
- b) Parents and carers: name, email address, a password (hashed), and which children they are linked to. Parents are invited by their school.
- c) Children (entered by the school): first and last name, class or group, optional date of birth and notes, learning observations (title, notes, learning area, date), photos, assessments, and comments between families and staff. Schools decide what to record. Free-text fields can hold sensitive details, and the school is responsible for having a proper basis for anything it records.
- d) School communications: newsletters, calendar events, and notification emails sent to parents when a new observation is shared.
- e) Billing: the school’s subscription status and our records of payments. Card payments are taken by Stripe. We never see or store full card numbers; we keep Stripe’s customer and subscription references.
- f) Enquiries: your name, email address, topic and message when you use our contact form, and details a school gives when applying to join.
- g) Technical and security information: a session cookie to keep you signed in, your IP address and similar data in web-server and security logs (for example to limit repeated failed sign-ins), error logs, and a record of when photos are viewed (who, which school, which observation, when).
3. Why we use it, and our legal basis
| What we do | Legal basis (UK GDPR) |
|---|---|
| Provide Nurtivo to schools, their staff and families | Contract with the school. For children’s and families’ information, the school’s own basis applies and we act on its instructions. |
| Billing and keeping accounting records | Contract; legal obligation |
| Security, preventing abuse and fraud, fixing faults | Legitimate interests (keeping the service and children’s information safe) |
| Answering enquiries and giving support | Legitimate interests; steps before entering a contract |
| Service emails (invitations, password resets, notifications, newsletters sent by a school) | Contract; legitimate interests |
We do not use automated decision-making or profiling that affects you. We do not use children’s or parents’ details for marketing.
3a. Who can see what inside Nurtivo
- School administrators can see their own school’s information. Teachers see the children in classes assigned to them. Parents see only their own children’s journals, observations and photos.
- An observation can involve several children. Where it does, the parents of each linked child can see that observation, including its text and any photo. Schools should decide this before linking more than one child.
- Photos are private. They are shown only after Nurtivo checks that the person signed in is allowed to see them.
4. Who we share information with
We use a small number of service providers (processors) who handle information only to provide their service to us:
- Web hosting: Fasthosts
- Photo storage: a private folder on our web host that cannot be opened directly from the internet.
- Payments: Stripe, which processes card payments for school subscriptions under its own privacy policy.
- Email delivery: Fasthosts
We may also disclose information where the law requires it, or to protect a child’s safety. We do not sell personal information.
5. Transfers outside the UK
School data is stored in the UK/EEA as described above. Stripe may process payment-related information in other countries, using safeguards approved under UK data protection law.
6. How long we keep information
| Information | How long |
|---|---|
| A school’s data (children, observations, photos, comments, newsletters, accounts) | While the school’s account is active, or until the school deletes it. After the account ends we delete it within 90 days. |
| Password-reset links | Valid for 1 hour |
| Invitation links for staff and parents | Valid for 7 days |
| Billing and payment records | 6 years, for tax and accounting |
| Contact-form enquiries | 12 months after we last replied |
| Photo-access and security logs | 12 months |
7. How we protect it
- The website is served over HTTPS.
- Passwords are stored as one-way hashes, never in readable form. Password-reset and invitation links are single-use and stored only in hashed form.
- Access is limited by role and by school, and each request is checked on the server.
- Photos are served privately after a permission check, and viewing is logged.
- Forms are protected against forged requests, and repeated failed sign-ins are limited.
No online service can promise perfect security. If a personal-data breach puts people’s rights at risk, we will tell the affected school without undue delay so it can meet its own obligations, and we will report to the ICO where required.
8. Cookies
Nurtivo uses only the cookies it needs to work: a session cookie that keeps you signed in and protects forms from forgery. It is removed when you sign out or close your browser. We do not use advertising or analytics cookies. If you pay for a subscription, Stripe’s own pages may set cookies, which are covered by Stripe’s policies.
9. Your rights
You can ask to see the information held about you, to have it corrected or deleted, to restrict or object to its use, and, in some cases, to receive a copy in a portable format. For information about your child entered by a school, please contact the school; for information we hold as controller, contact support@nurtivo.co.uk. We aim to reply within one month.
If you are unhappy with how your information has been handled, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.
10. Changes to this policy
If we change this policy in a way that matters, we will update the date above and, for schools, tell the administrator by email.