Privacy & the rules
What we hold, and what we refuse to do with it
Most sites put this at the bottom of the page in grey. A record that follows a child for twenty years is only worth having if the rules around it hold, so it is here instead.
The rules
The four that decide who the record is for
The first six are about what it may say about a child. These four are about who holds it.
-
A child's account is created by an adult responsible for them
Under-13s cannot consent to this service, so the consent is their parent's. There is no child self-signup, no email address on a child record, and no reset that reaches a child directly.
-
Control shifts to the young person as they grow
The record is written about them from five. They gain rights over it at thirteen and full control at eighteen. Every feature has to be designed so that handover is possible rather than bolted on when somebody's birthday forces it.
-
The record outlives the school
It belongs to the family and follows the child across every phase boundary. A school's access ends when the relationship does; the record does not.
-
Deleting a child deletes everything
Profile, assessments, homework, observations, findings, holiday packs, and anything the model wrote about them. Every table that holds something about a child is wired to disappear with the child. A soft delete would be a retention policy nobody agreed to.
Built in, not remembered
Decisions that hold whether or not anybody is paying attention
A rule that lives in somebody's memory lasts until the week they are busy. These are written into the shape of the thing.
A child is not an account
Children are not rows in the users table. That table is what every email, invitation, marketing list and password reset in a system reads from, so keeping children out of it means there is no address to send to — not hidden, not suppressed. The column does not exist. A child signs in with a handle and a passcode their parent sets, and no contact detail of any kind is stored against them.
Only what the purpose needs
A first name and a date of birth opens a record. We ask for pronouns rather than a gender category, because what the product needs is to refer to a child correctly in something it writes about them — and a category would collect more than that and still not answer the question. There are no photographs of children anywhere in the product.
Nothing is inferred from another child
No cohort model, no percentile, no ranking, no “children like yours”. A teacher's access to their own class is exactly that — an access grant — and it never becomes an input to what the system says about one individual. Not for your child, and not for anybody else's.
No advertising, ever
There will be no advertising in this product, nothing about a child sold or shared for marketing, and no profile of a child built for anybody's commercial purpose. A record of what a seven-year-old finds difficult is not an audience segment, and a business that needs it to be one is the wrong business.
Before any real child
A DPIA comes first, and it is not done yet
Profiling children is named as high risk under the ICO's Age Appropriate Design Code, and EleMate profiles children by design — that is what it is for. So a data protection impact assessment is required before one real child's data goes in, and that assessment has not been written yet.
Everything visible in the prototype today is invented data about an invented family. No real child's record is in it.
What is on this page is a plain statement of how the product is built and what it refuses to do. A formal privacy notice, the lawful basis for each thing we hold, and the impact assessment behind them come before the doors open, not after.
This website
What the page you are reading collects
If you fill in the interest form
We store the name and email address you type, and the date you typed it. That is the whole record. It is used for one thing: to write to you when there is something real to look at.
It is not a marketing list, it is not sold, and it is not shared. Every message we send will carry a way to be taken off it, and asking once is enough — we delete the row rather than flagging it as unsubscribed.
Everything else
There is no analytics script on this site, no advertising pixel, and no third-party JavaScript at all. The only thing kept in your browser is whether you chose the light or dark theme, and that never leaves the device.
Typefaces are served by Google Fonts, which means your browser fetches them from Google. If that matters to you, blocking it leaves this site perfectly readable in the fallback faces.