Privacy Policy
Last updated: August 2026
This Privacy Policy explains what personal data Indigo ("we", "us") collects when you use the platform as a parent, teacher, or school administrator, why we collect it, and what rights you have over it. It's written for the individuals using Indigo day to day — if you're a school administrator wanting the fuller, more formal terms of how we process data on your school's behalf, see our Terms & Conditions and Data Processing Agreement instead.
1. Who we are
Indigo UK is the service provided to your school. Indigo is operated by Carlos Moreno, trading as Indigo UK. For any privacy question, see the contact section at the end of this page.
2. What we collect, and why
| Data | Why we collect it |
|---|---|
| Name and email address | To create your account, identify you within your school, and let people contact you about a cover request |
| Role (parent, teacher/staff, or admin) | To determine what you can see and do within your school |
| School you belong to | To keep your data separate from every other school on Indigo |
| Cover requests you post or accept (date, time, address, postcode, notes) | So the right people can see what's needed and where, and accept it |
| Messages sent through Indigo | To let you coordinate with whoever accepted (or posted) a request |
| Phone number (school admin only, at sign-up) | To verify your school's enquiry is genuine before we set up an account |
| Enquiry form details (name, school or nursery, postcode, phone, email, message) | If you contact us through the form on our website, so we can answer you and check the enquiry is genuine |
| Technical log data (IP address, browser type, times of access) | Recorded automatically by our hosting providers to keep the service running, keep it secure, and detect abuse |
We do not knowingly collect information about children directly — Indigo accounts are for parents and staff, not children. Please don't include your child's name or other identifying details about a child in any message or notes field.
3. Our lawful basis for using your data
We process your data because it's necessary to provide the service your school has signed up for (performance of a contract), and because your school, as the data controller, has instructed us to process it on their behalf under our Data Processing Agreement. Where we ask for optional information, we rely on your consent, which you can withdraw at any time.
4. Who we share it with
We don't sell your data, and we don't share it with anyone for marketing purposes. We do use a small number of other companies to run Indigo, each of whom only processes your data to provide their specific service to us:
- Supabase — hosts our database and handles account log-in
- Netlify — hosts the website and app, and receives enquiries sent through our website contact form
- Resend — sends the emails Indigo needs to send you (e.g. approval links, notifications)
- Stripe — processes your school's payment; Stripe does not receive access to your school's request or messaging data
- Cloudflare — provides the "confirm you're human" check on our sign-up and password-reset forms
- Akismet (Automattic) — filters spam from enquiries sent through our website contact form
We may also disclose data where we're required to by law.
5. How long we keep it
We keep your data for as long as your school's account is active. If your school's account closes (through cancellation or non-renewal), we keep data for 90 days afterwards — in case you want it back, or the closure was a mistake — and then delete or anonymise it. Full detail is in our Data Processing Agreement.
6. Where your data is held
Your school's data — accounts, cover requests and messages — is stored in our database, hosted in London, United Kingdom.
Some of our providers process data outside the UK. Resend, which sends the emails Indigo needs to send you, is a United States company and stores email metadata and delivery logs there. Netlify and Akismet, which between them host our website and filter spam from our contact form, are also United States based. In each case the transfer is covered by Standard Contractual Clauses (with the UK Addendum) in our agreement with the provider. No cover request content or message content is sent to any of them.
7. Cookies and local storage
Indigo doesn't use advertising or analytics cookies, and we don't track you across other websites. The only thing stored in your browser is what's needed to keep you logged in, which is strictly necessary for the service to work and doesn't require your consent under UK cookie law.
8. Your rights
Under UK data protection law, you have the right to:
- Ask what personal data we hold about you, and get a copy of it
- Ask us to correct inaccurate data
- Ask us to delete your data (subject to what your school needs to keep for its own records)
- Object to, or ask us to restrict, certain processing
- Ask for your data in a portable format
Because your school is the data controller, some of these requests may need to go through your school's administrator, who can also change or remove your account directly. You're welcome to contact us directly too, and we'll help or point you the right way.
9. Complaints
If you're unhappy with how your data has been handled, we'd like the chance to put it right — please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.
10. Changes to this policy
We may update this policy from time to time. We'll change the date at the top of this page when we do.
11. Contact
Questions about this policy, or about your data, can be sent via the contact form on this site, or to help@indigoschools.co.uk.