Privacy Notice

1. Who we are

SENCO AI is supplied by TM Advocacy Ltd, company number 12113793, registered in England and Wales. Our registered office is Suite 9, Dalton House, 60 Windsor Avenue, SW19 2RR. Contact our privacy lead at privacy@sencoai.co.uk, or use contact@sencoai.co.uk if that address is unavailable.

2. Information handled by the service

• Customer and account information: staff names, work email addresses, roles, school association, authentication identifiers, subscription and support records.
• School information: URN, profile, staffing and SEND provision information, including information gathered from public school and government sources.
• Customer content: EHC plans, consultation correspondence, professional reports, pupil records, draft responses and evidence uploaded or created under the customer's instructions. This may include identifiers, SEND and health information, family circumstances and other sensitive content.
• Security and audit information: access events, actions taken, technical diagnostics, masked-entity counts and incident records.
• Billing information: plan, invoice and payment status. Card details are handled by Stripe rather than stored by SENCO AI.

3. Purposes and lawful bases

When acting as controller, TM Advocacy uses account and billing information to enter into and perform the customer contract; uses proportionate service-security, support and improvement information for legitimate interests; and keeps records where necessary to comply with legal obligations or establish and defend legal claims.

When SENCO AI processes pupil or consultation information for a school or local authority, that customer determines the applicable UK GDPR Article 6 lawful basis and, where relevant, the Article 9 condition for special-category information. These are recorded by the customer in its privacy information and DPIA. TM Advocacy does not replace that controller assessment.

3A. Contacting schools about SENCO AI

TM Advocacy Ltd occasionally emails staff at state-funded schools in England to introduce SENCO AI. We are the controller for this information.

What we use. We use the name, job role (for example SENCO or headteacher) and work email address of a member of staff, together with the name and details of their school.

Where it comes from. We take this information from the school's own public website. We identify schools, and their published websites, from the Department for Education's public register of schools (Get Information about Schools). We do not buy contact lists. We do not use personal email addresses.

Why, and our lawful basis. We rely on our legitimate interests (UK GDPR Article 6(1)(f)). Our interest is making schools aware of a service that supports their statutory special educational needs duties. We have assessed that interest against the interests of the staff we contact, and we limit what we do accordingly:

• we email only staff in the relevant role;
• we send no more than two emails to any address in any twelve months;
• we stop immediately if asked.

How we process it.

• We use automated tools to read school web pages and pick out the relevant role holder's published contact details.
• Before emailing, we check with the school's mail server that the address exists. No message is delivered when we do this.
• Nothing about this processing produces a decision with legal or similarly significant effects for anyone.

Who receives it. Our service providers process the information on our behalf:

• Microsoft, which sends our email;
• Google Cloud, which hosts our systems in London;
• Amazon Web Services, which runs the AI model that reads web pages, in its London region;
• OVH, which hosts the address check in its UK data centre.

Each provider acts under a written contract.

How long we keep it.

Your right to object. You can object at any time to our use of your details for these emails. When you do, we will stop and delete your contact details, keeping only what we need to make sure you are not contacted again. You can object by:

• using the unsubscribe link in any of our emails;
• replying to one of our emails; or
• writing to privacy@sencoai.co.uk.

If the headteacher or SENCO objects, we will not contact anyone at that school again.

Your other rights. You can also ask to see, correct or delete the information we hold about you, or ask us to restrict our use of it.

Complaints.

• If you are unhappy with how we have handled your information, please complain to us first at privacy@sencoai.co.uk. We will acknowledge your complaint within 30 days and tell you the outcome.
• You can also complain to the Information Commissioner's Office at ico.org.uk.

4. Artificial intelligence and human review

SENCO AI uses Anthropic's Claude model through Amazon Bedrock to extract, compare and draft information. Customer-content inference is configured as direct, in-region processing in Amazon Web Services' London region (eu-west-2). We do not use European or global cross-region inference profiles for those calls. AWS provides the model-hosting environment and states that third-party model providers cannot access Bedrock customer prompts or completions.

Zero Data Retention is configured for this inference processing, so request and response content is not written to durable storage by AWS or shared with the model provider. This does not prevent SENCO AI from storing documents, generated drafts and approved outputs in the application's UK-hosted customer record where needed to provide the service. Data-minimisation and masking controls are also applied before provider calls, but no automated masking control should be treated as infallible. The current providers and purposes are listed in our subprocessor register.

Outputs are drafts for a competent school professional. SENCO AI does not make or send a placement decision by itself. Users must verify the source evidence, correct inaccuracies and approve any response before it is communicated externally.

5. Recipients, hosting and international processing

Primary application hosting and storage use Google Cloud's London region. Customer-content AI inference uses direct, in-region Amazon Bedrock processing in AWS's London region. These core customer-content operations are therefore configured for UK processing. Limited account, authentication, billing, support, website-delivery and security information may still be processed by other providers outside the UK.

Restricted transfers must use an applicable UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard. The customer DPA and current subprocessor register describe the relevant processing chain.

The providers we use when contacting schools about SENCO AI are listed in section 3A.

6. Retention and deletion

Customer content is retained for the active service and then returned or deleted in accordance with the customer agreement, documented instructions and the approved retention schedule, subject to narrowly defined legal or security holds. Customers can delete individual consultations in the service.

Account, billing, support, security and suppression records have separate purpose-based periods. Recoverable backups and technical logs may expire on a delayed cycle rather than immediately. Customers may request the current retention schedule and deletion evidence from our privacy contact.

7. Your rights

For pupil or consultation information, contact the relevant school or local authority first because it normally controls that information. We assist customers with access, correction, restriction, objection, portability and deletion requests as required by our DPA.

For information controlled by TM Advocacy, contact us to exercise the rights that apply to your circumstances. If you are unhappy with how we have handled your information, please complain to us first at privacy@sencoai.co.uk. We will acknowledge your complaint within 30 days and tell you the outcome. You may also complain to the Information Commissioner's Office at ico.org.uk.

8. Security and incidents

SENCO AI uses role-based access, tenant scoping, encryption, secure authentication, audit records and managed cloud infrastructure. Controls are reviewed according to risk. If a personal-data incident affects customer content, we notify the controller without undue delay and provide information needed for its assessment and notifications.

9. Children and service access

SENCO AI is a professional service for authorised school and local-authority staff; it is not offered directly to children. Children's information nevertheless receives enhanced protection because of its sensitivity and the potential effect of consultation decisions.

10. Browser storage

The service currently uses authentication and user-requested preference storage rather than advertising cookies. Names, purposes and durations are in our storage and cookies notice. Non-essential tracking will not be enabled without an appropriate choice mechanism.

11. Changes

We version this notice. Material changes to purposes, roles, providers or individual rights will be notified through the service or by email before they take effect where appropriate.