Privacy Policy

1. Who this covers

This policy describes how Lesson Rotate (“the Service”) handles personal data — both your own account data as a teacher, and the student/parent data you enter to use the Service.

2. Two different roles under GDPR

For your own account data (your name, email, login activity), we are the data controller. For the student and parent data you enter (names, contact details, lesson details, and any notes you add), you are the data controller and we act as your data processor — we store and process it on your behalf, under your instructions, and don't use it for any purpose beyond providing the Service to you.

3. What we collect

• Account: your name, email address, and sign-in method (magic link or an OAuth provider).
• Content you enter: student names, parent/guardian contact details, school information, lesson schedules, and any notes you choose to add (including sensitive notes, e.g. SEN considerations, if you enter them).
• Usage data: basic technical logs needed to run and secure the Service.
• Cookies: a session cookie (keeps you signed in) and, if you followed a referral link, a short-lived cookie recording which referral it was.

4. Why we collect it

Solely to provide the Service — building your timetables, letting you contact parents, and keeping your account secure. We don't sell personal data, and we don't use your students' or parents' data for advertising.

5. Where it's stored

Data is hosted with Supabase (our database and authentication provider). We don't share it with any other third party beyond what's needed to run the Service itself.

6. Your rights

You can access, correct, or delete your account data at any time. As the data controller for your students' data, you're responsible for handling their access/deletion requests — the Service gives you the tools to do that (editing or removing student records directly).

7. Contact

Questions about this policy or your data? Get in touch at the contact details on our website.