Loading page…
Last updated: August 2026
Classpot ("we", "our", "us") operates the website classpot.co.uk. We are a school comparison platform helping families find the right school in England.
Trading name: Classpot
Registered in: England and Wales
Email: hello [at] classpot.co.uk
Email address if you create an account, submit a school suggestion, write a review, buy a report, or contact us. If you use the Parent Cabinet, we store the optional child nickname or display label you choose, admission phase, Nursery start month or Primary/Secondary entry year, postcode (not a full address), search radius, up to three priorities, plan title, and the providers you save. Private provider data may include notes, manual order, decision, visit and application or enquiry state, timestamps, and tasks or reminders with their title, details, kind, due date, completion state and optional provider link. We also store report entitlements attached to your account. A child label is optional and does not need to be a legal name.
The Parent Cabinet does not request a child's exact date of birth, full address, faith or religion, SEND or EHCP information, health information, or documents.
If you use the School Portal, we store the school or provider and URN you claim, your account email and verified-email state, your stated professional role, the claim status and verification route, the relevant imported school-email or website domain used as evidence, and claim and review timestamps. Manual review may also record a decision and review note. After verification, we store your OWNER or EDITOR membership, how it was established, its status and revocation history, plus limited school-level security and audit events.
The School Portal stores draft and historical versions of school-provided content: a short description, website, public and admissions contacts, and structured open-day information. It also stores requests to correct official information, including the current official value, proposed value, explanation, status and review outcome. Only the current published school-provided version is public, only while the school authority remains verified, and it is labelled as provided by the school with its publication date. The free verified badge and its school-authority verification date are also public while that authority remains verified. We do not publish the login identity, claim email, claimant role, verification evidence, membership, draft, manual-review, correction or audit records. Parent Cabinet, child, plan, purchase and private-report data never crosses into the School Portal or its public projection. A login email becomes public only if an authorised school member separately enters it as a published school contact.
If you start or complete a school-report purchase, we collect your email address and optional postcode. A private checkout intent temporarily stores an emailed continuation credential, the rendered continuation-email content, and the frozen Stripe request needed for crash-safe, duplicate-charge-resistant replay. If payment completes, the purchase record keeps the email address and order reference so we can deliver the report and maintain the transaction record. Payment card details are processed exclusively by Stripe, Inc. and are never transmitted to or stored on our servers.
Before sign-in, Save can keep up to three provider identifiers and their admission phase in local browser storage. Public favourites and comparison selections (including comparison phase) are also stored on that device. These entries contain provider identifiers, not child or account details. A successful cabinet import removes only the exact pending saves that were reconciled; favourites and comparisons are not erased. You can remove this data with the product controls or by clearing site data in your browser.
After sign-in, if no compatible admission plan exists, one provider identifier and phase may be held in a private server-side handoff tied to the current sign-in session. It is usable for up to 15 minutes and is removed immediately after an exact successful save or discard. An expired record is no longer usable and is physically removed by exact-session cleanup or the next bounded hourly housekeeping run (normally within about 75 minutes of creation, subject to backlog or an outage); deleting the session also removes it.
Under UK GDPR (Article 6), we rely on the following lawful bases for processing your personal data:
| Processing Activity | Lawful Basis | Details |
|---|---|---|
| Providing the school comparison service | Legitimate interest | Necessary for the core purpose of the platform |
| Providing an account, private school plan or School Portal workspace | Contract | Necessary to save and return the private service you request across devices |
| Geolocation to show nearby schools | Consent | Browser permission prompt; revocable at any time |
| Error monitoring (Sentry) | Legitimate interest | Necessary to maintain service reliability and diagnose technical issues |
| Cookieless public product measurement (PostHog, if enabled) | Legitimate interest | Public pageview, Claim School demand, report purchase funnel and comparison measurement; it is never required for the service and does not set cookies or persistent browser identifiers |
| Public website analytics | Consent where required for non-essential cookies | See section 8 for the current collection behavior and browser controls |
| Processing school submissions, provider claims, corrections and attributed school information | Legitimate interest | To prevent unauthorised school control and maintain accurate, attributable directory information |
| Responding to enquiries | Legitimate interest / Contract | Necessary to respond to your request |
| Processing paid report purchases | Contract | Necessary to fulfil a purchase you have made |
We use the personal data we collect for the following purposes:
We do not use your personal data for email marketing purposes.
We do not sell your personal data. We use the following third-party services, each of which may process data on our behalf or as an independent controller:
| Service | Purpose | Data Processed |
|---|---|---|
| Vercel | Website hosting and Web Analytics | Hosting logs; public page visits and browser/device information |
| Sentry | Error monitoring and diagnostics | Browser type, device info, error context, IP address |
| PostHog (optional, cookieless) | Public pageviews, Claim School demand, report purchase funnel and comparison usage | Reviewed event names, coarse product dimensions and random report-attempt identifier; no email, school identity, URL/query, postcode, account/session, form values or payment amounts |
| Google Analytics | Public website analytics | Page path without query strings, referrer, navigation or interaction events, browser/device information, IP address and browser identifiers; advertising features and Google Signals are disabled, and no form values, postcodes, search text, private reports or account areas are sent |
| Microsoft Clarity | Heatmaps and session recordings | Public page URLs, interactions, masked page content and browser/device information; cookie-dependent features follow Microsoft consent requirements |
| Resend | Transactional sign-in and report emails | Email address and email delivery metadata |
| Google Identity (optional) | Account sign-in when you choose Google | Google account identifier, verified email, name and profile image provided by Google |
| Stripe, Inc. | Payment processing for paid reports | Email address, payment card details, billing information. Stripe acts as an independent data controller. See stripe.com/gb/privacy |
Each of these providers acts under their own privacy policies. We recommend reviewing them for detailed information.
Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites and encourage you to review their privacy policies independently.
Some of the third-party services we use (including Vercel, Sentry, Resend, Google Identity, Stripe and, Google Analytics and Microsoft Clarity) may process data outside the United Kingdom. This means your personal data may be transferred to, and processed in, countries outside the United Kingdom.
Where such transfers occur, we ensure that appropriate safeguards are in place, including:
If you would like further information about the specific safeguards applied to international transfers of your data, please contact us at hello [at] classpot.co.uk.
School reports are digital products delivered immediately upon purchase. Under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, you ordinarily have a 14-day right to cancel a distance purchase. However, by completing your purchase and accessing the report, you expressly consent to immediate delivery and acknowledge that your right to cancel is lost at that point.
If you experience a technical issue preventing delivery, or if the report contains a material error, please contact us at hello [at] classpot.co.uk and we will assess your request on a case-by-case basis.
Cookies are small text files stored on your device when you visit our website.
| Category | Purpose | Provider | Consent Required |
|---|---|---|---|
| Strictly Necessary | Essential site functionality | Classpot | No (exempt under UK PECR) |
| Analytics | Public page, navigation and interaction measurement | Google Analytics and Microsoft Clarity | Yes |
Google Analytics, Microsoft Clarity and Vercel Web Analytics start on public pages without a popup. Google Analytics uses analytics cookies. Clarity applies its regional consent rules; without a consent signal, cookie-dependent session and returning-visitor reports may be limited. Vercel Web Analytics does not use cookies. Yandex Metrica, Vercel Speed Insights and Google AdSense are disabled. You can turn analytics off below without losing access to the service. Previously saved refusals are respected. Your choice is stored in this browser; clearing site data clears that choice.
We retain personal data only for as long as necessary for the purposes set out in this policy:
| Data Type | Retention Period |
|---|---|
| Review submissions and school suggestions | For as long as they remain published and relevant |
| Contact enquiries (email) | Up to 12 months after resolution |
| Completed paid-report purchase records (email address, order reference) | 7 years (UK tax and accounting obligations) |
| Abandoned or unresolved paid-report checkout intents | An unused pre-provider intent is usable for 30 minutes and is normally deleted by the next bounded hourly run (within about 90 minutes of creation, subject to backlog or an outage). Crash replay is allowed for less than 23 hours. An unresolved provider call then fails closed for manual review: postcode, continuation credential and email HTML, and frozen provider payload are redacted within 72 hours of the first provider call, and the intent email is removed within 30 days. A pseudonymous duplicate-charge tombstone remains until reviewed. A reviewed no-session audit is deleted within 30 further days. Provider-confirmed expired and unpaid attempts and their PENDING rows are deleted in intent-first order; completed purchases follow the separate seven-year row above. |
| Account and school-plan data | Until you ask us to delete the account, subject to legal and security backup retention |
| School Portal account identity and claim email | Until the related account is deleted or a rights request requires earlier action. Account deletion atomically withdraws pending claims, revokes memberships and removes direct User IDs and the claim-email snapshot from retained School Portal history. |
| School-level claim, membership, revision, correction and audit history | Retained while needed to preserve publication provenance, prevent unauthorised control and maintain the integrity of the school record. After account deletion, its dedicated User foreign keys are detached and SchoolClaim.claimantEmail is cleared. Independently entered contacts, correction text or other retained information may still identify a person; it continues to be treated as personal data and remains subject to applicable rights and retention review. |
| Guest saves, favourites and comparisons stored in your browser | Until you remove them, clear site data, or exact pending saves are successfully imported |
| Sign-in sessions | Up to 30 days unless you sign out or the session is revoked sooner |
| Signed-in provider handoff | Usable for up to 15 minutes; exact save/discard removes it immediately, while expired rows are normally physically removed within about 75 minutes of creation by bounded hourly housekeeping (subject to backlog/outage) or with session deletion |
| Stripe transaction data | Per Stripe's retention policy (stripe.com/gb/privacy) |
| Sentry error data | 90 days (Sentry default) |
| Optional PostHog public pageviews and demand events | Retained only for the configured PostHog project retention period; before enabling, the operator must set and record that period and ensure it is no longer than necessary for the stated product review |
| Consent-based Google Analytics data | Retained for the configured Google Analytics property retention period; the operator must keep that period no longer than necessary for product measurement |
| Public website analytics | Retained for the configured provider retention periods; the operator must keep that period no longer than necessary for product measurement |
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted connections (HTTPS), restricted access to personal data, and the use of reputable third-party infrastructure providers. However, no method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, as described under Article 22 of the UK GDPR. Parent Cabinet next actions are selected by deterministic, explainable rules; Classpot does not generate an admissions probability or opaque fit score.
Under the UK General Data Protection Regulation, you have the following rights in relation to your personal data:
To exercise any of these rights, please contact us at hello [at] classpot.co.uk. We will respond within one calendar month. If we require additional time (up to two further months), we will inform you and explain the reason.
When an authenticated account-erasure request is accepted and the account is deleted, pending School Portal claims are withdrawn and active memberships are revoked in the same database operation. If that account is the last active OWNER, the school authority is suspended first, so its verified state and school-provided content stop appearing publicly. If another active OWNER remains, the authority and independently owned school content may remain active. The deleted User ID, claim email and User actor references are detached from retained School Portal history; free-text claim review notes are cleared. The canonical public School record is not account data and is not deleted. You may separately ask us to correct or remove personal information contained in school-provided contact details or other retained material.
If you are not satisfied with how we handle your personal data or your rights request, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Our service is designed for parents, guardians, and educators. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected data from a child, please contact us immediately at hello [at] classpot.co.uk, and we will take steps to delete such data without undue delay.
We are aware that younger users may visit the site. Non-essential behavioural advertising is disabled. Public analytics and its browser controls are described in section 8.
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Any material changes will be posted on this page with an updated "Last updated" date. Where changes are significant, we will make reasonable efforts to notify you (for example, via a prominent notice on our website).
If you have any questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how your data is handled, please contact us:
Email: hello [at] classpot.co.uk