Privacy Policy

Peakly Ltd ("Peakly", "we", "us", or "our") is the data controller for personal data processed through the Peakly service. We are registered in England and Wales.

If you have questions about this policy or how we handle your data, contact us at privacy@peakly.app.

Peakly connects to your email via Google OAuth or Microsoft OAuth using your explicit permission. We request the minimum scope required:

• Google: gmail.readonly — read access to your Gmail inbox only
• Microsoft: Mail.Read — read access to your Outlook/Microsoft 365 inbox only

We use this access to scan for emails from school domains or matching school communication patterns. We do not read personal emails unrelated to school communications, and we do not store raw email text permanently — only the structured information we extract (event title, date, type, child).

You can revoke email access at any time via your Peakly settings, or directly through your Google account or Microsoft account permissions page. Revoking access will stop new emails from being processed.

Peakly processes information about your children (names, school events, associated school names) on your behalf. We treat this data with extra care:

• Children's data is used solely to organise and attribute school events within your account.
• We do not build profiles on children, use children's data for advertising, or share it with third parties for their own purposes.
• Children's data is deleted when you remove a child from your account or close your Peakly account.

If you believe any information about a child has been processed incorrectly, please contact us immediately.

We use the information we collect to:

• Provide, operate, and improve the Peakly Service
• Process and extract school events from your emails
• Send you WhatsApp notifications (only if you have enabled this feature)
• Process subscription payments and manage your billing
• Respond to your support requests
• Send important service communications (e.g. account changes, policy updates)
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not use your data for advertising, profiling for third parties, or any purpose not listed above.

Under UK GDPR, we process your personal data on the following legal bases:

• Contract performance — processing necessary to provide the Service you have subscribed to (email reading, calendar, notifications)
• Legitimate interests — improving the Service, security monitoring, fraud prevention
• Legal obligation — complying with applicable laws and regulations
• Consent — where you have explicitly opted in (e.g. WhatsApp notifications)

We do not sell your personal data. We share data only with trusted service providers who help us operate Peakly, and only to the extent necessary:

We may also disclose your data if required to do so by law, or to protect the rights, property, or safety of Peakly, our users, or others.

We retain your data for as long as your account is active. Specifically:

• Extracted calendar events are kept for 12 months by default, then automatically deleted.
• Account data is retained for the duration of your subscription plus 30 days after account closure.
• Billing records are retained for 7 years as required by UK financial regulations.
• Log data is retained for 90 days.

You can request earlier deletion of your account and associated data at any time (see Your Rights below).

We take security seriously. Our measures include:

• All data is encrypted in transit using TLS 1.2+
• OAuth tokens and sensitive credentials are encrypted at rest
• Access to production systems is restricted to authorised personnel
• Regular security reviews and dependency updates
• Refresh tokens are single-use and rotate on every session renewal

No system is completely secure. In the event of a data breach that affects your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours as required by UK GDPR.

Under UK GDPR, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — request deletion of your personal data ("right to be forgotten")
• Restriction — ask us to limit how we process your data in certain circumstances
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at privacy@peakly.app. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Peakly uses a minimal set of cookies:

• Session cookie — used to maintain your login state. This is an httpOnly, secure cookie required for the Service to function.
• No advertising cookies, no third-party tracking cookies.

We do not use Google Analytics, Meta Pixel, or similar tracking tools.

Your data is primarily stored in the EU (MongoDB Atlas, AWS EU regions). Where data is transferred outside the UK/EU (e.g. to AI processing services), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice at least 14 days before changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

For any privacy-related queries or to exercise your rights: