Privacy policy

PagePal is operated by Greyphox Digital Ltd, a company registered in England and Wales. For staff accounts and billing, Greyphox Digital Ltd is the data controller. For pupil data, the school is the data controller and PagePal acts as a data processor, handling pupil information only on the school's instructions and for the purpose of running the service.

• Name, email address and school name, provided at sign up or when invited by an administrator.
• Account settings such as the classes a staff member can see and whether they can create classes.
• Billing records: plan, payment status and invoice history. Card details are handled by Stripe and never reach us.
• Technical records needed to run and secure the service, such as sign-in times and error logs.

• A username chosen by the teacher. We recommend first names or nicknames only, never full names.
• A password generated by the service, kept so staff can reissue it to pupils who forget it.
• The class the pupil belongs to and the website they build, including the words and pictures they add.
• Nothing else. We do not ask pupils for an email address, date of birth, phone number or location, and we do not profile or advertise to children.

Pupils can type anything into their website, so schools should tell pupils not to include surnames, addresses or contact details, and staff should check for these during review.

• Contract: to provide the service to the school and to take payment for it.
• Legitimate interests: to keep the service secure, prevent misuse, and improve how it works.
• Legal obligation: to keep financial records.
• For pupil data, the school's own lawful basis applies, usually a public task in the delivery of education.

We do not sell data or share it for advertising. We use a small number of providers who process data on our behalf: Supabase for database and authentication hosting, Lovable for application hosting and transactional email, Stripe for payments, and Google Analytics for anonymous usage statistics on our public pages, which only runs where a visitor has accepted analytics cookies. All process data under contract and within the UK, the EU or under approved safeguards.

A pupil website is private until a member of school staff approves it. Once published it is publicly visible at pagepal.school/username/site-name, but carries an instruction telling search engines not to list it. Staff can take a website offline at any time from the workspace, and we will remove a published page on request from the school.

• Pupil accounts and their websites are kept while the school's account is active, so work carries over between lessons and school years.
• Archived pupil logins are deleted permanently 30 days after archiving, along with the pupil's website and every picture they uploaded. Restoring the pupil before then cancels the deletion.
• When a school closes its account, we delete its pupil and staff data within 30 days, except billing records which we keep for six years for tax purposes.
• Backups are overwritten on a rolling basis within 30 days.

• Data is encrypted in transit and at rest.
• Access to each school's data is restricted at database level, so one school cannot see another's.
• Staff only see the classes their administrator gives them access to.
• Uploaded pictures are checked and re-encoded, and only genuine image files are accepted.
• Websites are screened for offensive language and spam before they can be published.

Individuals have the right to access their data, have it corrected or deleted, restrict or object to its use, and receive a copy of it. Requests about pupil data should go to the school in the first instance, as the school controls that data; we will support the school in responding. Staff can contact us directly at support@pagepal.school.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.

PagePal uses essential cookies, plus optional Google Analytics cookies on public pages where a visitor accepts them. See the cookie policy for details.

Data protection questions, including requests from schools for a data processing agreement, can be sent to support@pagepal.school.