Privacy Policy — Bookflicks

1. Who we are

Bookflicks is operated by Grant Wardle ("we", "us"). We are the data controller for personal data processed through this website. Bookflicks is designed to keep pupil data to an absolute minimum.

2. What we collect

Teachers: name, email address, school name, and account activity.

Pupils: first name (or nickname), an avatar emoji and colour, and a record of which books have been checked out and returned. We do not collect pupil surnames, dates of birth, addresses, photos, or contact details.

Technical: standard server logs (IP, browser, timestamps) for security and reliability.

3. How we use it

To provide the virtual book-corner to your class.
To authenticate teacher accounts and protect class data.
To send essential service emails (sign-in links, account changes, co-teacher invites).
To improve reliability and prevent abuse.

We do not sell personal data and we do not use it for advertising.

4. Lawful basis (UK GDPR)

Our lawful basis for processing teacher data is performance of a contract (providing the Service you signed up for) and legitimate interests (security and reliability). For pupil data, the lawful basis is the legitimate interest of the school in running its classroom library, supported by the data-minimisation choices above.

5. Sub-processors

We use trusted infrastructure providers to host the Service and deliver email. They process data on our instructions only and are bound by contractual confidentiality.

6. Retention

Teacher accounts and class data are kept for as long as the account is active. When you delete a class or account, the related data is removed from our active systems. Backups are rotated on a routine schedule.

7. Your rights

Under UK GDPR you have the right to access, correct, delete, or object to processing of your personal data, and to lodge a complaint with the Information Commissioner's Office (ico.org.uk). Contact us via the site to exercise these rights.

8. Cookies

We use a small number of strictly-necessary cookies/local storage entries to keep you signed in. We do not use advertising or third-party tracking cookies.

9. Children

Bookflicks is operated by teachers on behalf of their school. Pupils interact with the Service through their teacher's class, which is why we deliberately avoid collecting identifying personal data about pupils.

10. Security & compliance

This section is maintained by Bookflicks to answer common security and privacy questions. It describes controls we have enabled today and is not an independent certification.

Controls in place:

Encryption in transit (HTTPS/TLS) across the site and API.
Encryption at rest for the database and file storage, provided by our hosting platform.
Row-level security on all classroom, pupil, and account tables so teachers only see their own data.
Role-based access control separating pupils, teachers, co-teachers, and superadmins.
Passwordless magic-link and password-based sign-in with session tokens; pupil access uses short class codes or class QR codes rather than personal accounts.
Audit logging of administrative actions (ownership changes, role changes, deletions).
Least-privilege database functions and revoked public access on sensitive tables.
Routine platform-managed backups.

Platform & certifications:

Bookflicks is hosted on infrastructure operated by Lovable, Supabase, and AWS. Those upstream providers publish their own SOC 2 and ISO 27001 reports covering their platforms. Bookflicks itself is not independently SOC 2 or ISO 27001 certified, and inclusion here is not a claim of certification for our application.

Shared responsibility:

Lovable / Supabase / AWS secure the underlying platform, network, and physical infrastructure.
Bookflicks configures access controls, data minimisation, audit logging, and application-level security.
Schools and teachers are responsible for safeguarding their sign-in credentials, printed class codes, and QR posters, and for following their school's own safeguarding policies.

To report a security issue, please contact us via the site.

11. Changes

We may update this policy from time to time. The "last updated" date above will reflect any changes.