Ravenclerk / Privacy

Privacy and data protection

How Ravenclerk handles personal data, for this website and for the schools we work with.

Draft. This page describes how Ravenclerk is designed to handle data. It is not yet a final legal privacy notice and should be reviewed before launch. [placeholder: data controller details, ICO registration and contact for privacy queries]

This website

The demo request form on this site asks for your name, school, role, work email and an optional message. At present the form does not send or store anything; it only shows a confirmation on your screen. When we connect it to a service, we will use these details only to respond to your request, and we will update this page to say how they are stored and for how long.

Please do not include information about pupils in the form.

The Ravenclerk service for schools

When a school uses Ravenclerk, the school is the data controller and Ravenclerk acts as a data processor on the school's instructions. Our approach:

  • Your tenant. Ravenclerk connects to the school's own Microsoft 365 tenant through Microsoft Graph, using permissions approved by the school's administrator and limited to the chosen mailbox.
  • UK hosting. The Ravenclerk service is hosted in the UK.
  • AI providers. We use AI services on terms where email content is not retained by the provider or used to train models.
  • Data minimisation. We process only what is needed to decide where an email should go.
  • Short retention. Working data is kept for a short, defined period. [placeholder: retention periods]
  • Audit log. Routing decisions are logged so the school can see what happened to each email.
  • Paperwork. Schools receive a DPIA template and a Data Processing Agreement for their DPO to review.

Your rights

Under UK GDPR you have rights including access, correction and erasure of your personal data. For data processed on behalf of a school, please contact the school first. For anything else, contact us at [placeholder: privacy contact email].