Privacy Policy

Who we are

needl (operated by Needl Stack, "we", "us") provides a family activity and school communications platform based in the United Kingdom, covering school class communications, club and activity bookings, and related family organisation tools. This policy explains what personal data we collect, why, and what rights you have over it. If you have any questions, contact us at hello@needlstack.co.uk.

Information we collect

We collect information in the following categories:

• Account information: your name, email address, and password (or Google account identifier if you sign in with Google).
• Family and child information you add to your household: a child's name, date of birth, school, year group and class, and, where you choose to provide it, medical notes, dietary requirements, allergies, and emergency contact details. You provide this information as the parent or guardian managing your household's profile – we do not collect it directly from children.
• Booking and payment information: details of club activities and sessions you book, and payment information processed securely by our payment provider, Stripe (we do not store your full card details ourselves).
• Progress videos: some clubs may post short video clips of children taking part in activities. This only happens where the club has confirmed photo/video consent is on file for that child and activity, and videos are only visible to that child's own household.
• Communications: messages, posts, and notifications sent within class groups or clubs you're a member of.
• Technical information: device and push notification identifiers, so we can send you booking confirmations and updates.

How we use your information

We use your information to:

• Provide and operate the class communication, booking, and payment features you use.
• Process payments for club activities via Stripe.
• Send booking confirmations, reminders, and service notifications.
• Allow club owners and school class administrators to communicate with members.
• Keep the platform secure and investigate misuse.
• Improve the service based on how it's used.

Children's data

needl is used by parents and guardians to manage activities on behalf of their children; it is not directed at children themselves and children do not create their own accounts. Where medical, dietary, or emergency contact information is provided for a child, it is used solely to support that child's safe participation in the class or club activities you've booked, and is only visible to the relevant school class or club administrators, not to other families.

Who we share information with

We share information with the following categories of service providers, solely to operate the platform:

• Stripe – payment processing.
• Google – if you choose to sign in with Google.
• Cloud hosting and storage providers – to run the app and store uploaded content (such as club documents and progress videos) securely.
• Email delivery providers – to send account and booking emails.
• Anthropic – to power needl's AI features (such as answering your questions and drafting school notices). Only the information needed to answer is sent, and Anthropic does not use it to train its models.
• PostHog (EU hosted) – product analytics, only if you accept analytics cookies.
• Cloudflare Turnstile – to check that sign-ups and contact messages come from a person, not a bot.

We do not sell your personal data, or your child's data, to third parties.

Messages you send us

If you contact us through our contact form or by email, we keep your name, email address and message so we can reply and keep a record of what was asked. We delete these messages when they're no longer needed.

Cookies

We use essential cookies to keep you signed in, and analytics cookies only if you accept them. See our cookie policy.

Where your data is stored

Our infrastructure is hosted in the EU. Some of our service providers (including Stripe and Google) may process data outside the UK/EEA; where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses.

How long we keep your data

We keep your account and household data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we're required to retain records (for example, payment records) for legal or accounting purposes.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you and your household.
• Ask us to correct inaccurate data.
• Ask us to delete your data, subject to legal retention requirements.
• Ask us to export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent at any time where we rely on consent (for example, photo/video consent).

To exercise any of these rights, contact hello@needlstack.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Security

We use industry-standard measures, including encryption in transit, to protect your data. No system is completely secure, but we work to keep your information safe and to respond quickly if anything goes wrong.

When we look at your account to help you

To sort out a problem, a member of the needl team may ask to view your account as you see it. We email you first with the reason, and can only look once you approve it, signed in as you. Access lasts 24 hours and you can stop it any time in Settings. It is view only: nothing can be changed. Finance, messages, the class chat, anything you've pasted or forwarded, and personal details such as medical notes, allergies, emergency contacts, phone numbers and notes are hidden from us. Each time we do this is logged.

Changes to this policy

We may update this policy from time to time. If we make material changes, we'll update the date at the top of this page and, where appropriate, notify you directly.