Privacy Notice

1. Who we are

SENCO AI is supplied by TM Advocacy Ltd, company number 12113793, registered in England and Wales. Our registered office is Suite 9, 60 Windsor Avenue, London, SW19 2RR. Contact our privacy lead at privacy@sencoai.co.uk, or use contact@sencoai.co.uk if that address is unavailable.

2. Information handled by the service

• Customer and account information: staff names, work email addresses, roles, school association, authentication identifiers, subscription and support records.
• School information: URN, profile, staffing and SEND provision information, including information gathered from public school and government sources.
• Customer content: EHC plans, consultation correspondence, professional reports, pupil records, draft responses and evidence uploaded or created under the customer's instructions. This may include identifiers, SEND and health information, family circumstances and other sensitive content.
• Security and audit information: access events, actions taken, technical diagnostics, masked-entity counts and incident records.
• Billing information: plan, invoice and payment status. Card details are handled by Stripe rather than stored by SENCO AI.

3. Purposes and lawful bases

When acting as controller, TM Advocacy uses account and billing information to enter into and perform the customer contract; uses proportionate service-security, support and improvement information for legitimate interests; and keeps records where necessary to comply with legal obligations or establish and defend legal claims.

When SENCO AI processes pupil or consultation information for a school or local authority, that customer determines the applicable UK GDPR Article 6 lawful basis and, where relevant, the Article 9 condition for special-category information. These are recorded by the customer in its privacy information and DPIA. TM Advocacy does not replace that controller assessment.

4. Artificial intelligence and human review

SENCO AI uses Anthropic's Claude model through Amazon Bedrock to extract, compare and draft information. Customer-content inference is configured as direct, in-region processing in Amazon Web Services' London region (eu-west-2). We do not use European or global cross-region inference profiles for those calls. AWS provides the model-hosting environment and states that third-party model providers cannot access Bedrock customer prompts or completions.

Zero Data Retention is configured for this inference processing, so request and response content is not written to durable storage by AWS or shared with the model provider. This does not prevent SENCO AI from storing documents, generated drafts and approved outputs in the application's UK-hosted customer record where needed to provide the service. Data-minimisation and masking controls are also applied before provider calls, but no automated masking control should be treated as infallible. The current providers and purposes are listed in our subprocessor register.

Outputs are drafts for a competent school professional. SENCO AI does not make or send a placement decision by itself. Users must verify the source evidence, correct inaccuracies and approve any response before it is communicated externally.

5. Recipients, hosting and international processing

Primary application hosting and storage use Google Cloud's London region. Customer-content AI inference uses direct, in-region Amazon Bedrock processing in AWS's London region. These core customer-content operations are therefore configured for UK processing. Limited account, authentication, billing, support, website-delivery and security information may still be processed by other providers outside the UK.

Restricted transfers must use an applicable UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard. The customer DPA and current subprocessor register describe the relevant processing chain.

6. Retention and deletion

Customer content is retained for the active service and then returned or deleted in accordance with the customer agreement, documented instructions and the approved retention schedule, subject to narrowly defined legal or security holds. Customers can delete individual consultations in the service.

Account, billing, support, security and suppression records have separate purpose-based periods. Recoverable backups and technical logs may expire on a delayed cycle rather than immediately. Customers may request the current retention schedule and deletion evidence from our privacy contact.

7. Your rights

For pupil or consultation information, contact the relevant school or local authority first because it normally controls that information. We assist customers with access, correction, restriction, objection, portability and deletion requests as required by our DPA.

For information controlled by TM Advocacy, contact us to exercise the rights that apply to your circumstances. You may also complain to the Information Commissioner's Office at ico.org.uk.

8. Security and incidents

SENCO AI uses role-based access, tenant scoping, encryption, secure authentication, audit records and managed cloud infrastructure. Controls are reviewed according to risk. If a personal-data incident affects customer content, we notify the controller without undue delay and provide information needed for its assessment and notifications.

9. Children and service access

SENCO AI is a professional service for authorised school and local-authority staff; it is not offered directly to children. Children's information nevertheless receives enhanced protection because of its sensitivity and the potential effect of consultation decisions.

10. Browser storage

The service currently uses authentication and user-requested preference storage rather than advertising cookies. Names, purposes and durations are in our storage and cookies notice. Non-essential tracking will not be enabled without an appropriate choice mechanism.

11. Changes

We version this notice. Material changes to purposes, roles, providers or individual rights will be notified through the service or by email before they take effect where appropriate.