Sendiphany — AI Co-Pilot for SENCOs

Sendiphany is currently in early beta. This policy describes how we collect, use, and protect personal data — including special category and pupil data — in line with UK GDPR and the Data Protection Act 2018. If you have questions, contact us at privacy@sendiphany.co.uk.

1. Who we are

Sendiphany Ltd ("Sendiphany", "we", "us") is a UK-based EdTech company providing software for SENCOs to manage SEND administration, including EHCP drafting and pupil record-keeping. For most personal data processed through the platform, the school using Sendiphany is the data controller and Sendiphany acts as a data processor on the school's behalf — see our Data Processing Agreement for details of that relationship.

2. What we collect

Depending on how Sendiphany is used, we process:

Account data — name, email address, role, and school affiliation for staff users.
Pupil data — name, date of birth, year group, and special educational needs information entered by school staff, including special category data under Article 9 UK GDPR (health and, where relevant, other protected characteristics) necessary to produce EHCPs and related records.
Parent/carer and third-party contributions — content submitted via secure token-based links, such as views and feedback for annual reviews.
Usage and billing data — login activity, feature usage, and subscription/payment details processed via Stripe.

3. How we use it

We use personal data to:

Provide and maintain the Sendiphany platform for schools and their staff.
Generate draft EHCP content using AI, with pupil identifiers pseudonymised before any content is sent to our AI provider, and only where a school has recorded consent for AI processing for that child.
Send deadline reminders, notifications, and service communications.
Process subscription payments and manage billing.
Maintain the security and integrity of the platform, including audit logging.

4. Retention

Pupil and school records are retained for as long as the school's account is active, and thereafter in line with the school's own record-retention policy and instructions, or as required by law. Account data for staff users is retained for the duration of their access plus a limited period for legitimate administrative and security purposes. We will delete or anonymise personal data on request from the relevant school, subject to any legal retention requirements.

5. Your rights

Under UK GDPR you have rights to access, rectify, erase, restrict, or port your personal data, and to object to certain processing. Because schools are typically the data controller for pupil records, requests relating to pupil data should usually be directed to the child's school in the first instance. For account-level requests, or if you are unsure who to contact, email privacy@sendiphany.co.ukand we will help direct your request. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

6. Contact us

Sendiphany Ltd — privacy@sendiphany.co.uk