Privacy policy.

OctoSwim provides booking and management software for swim schools in the United Kingdom. For your account data, OctoSwim is the data controller. For the data a swim school holds about its families and swimmers, the school is the controller and OctoSwim acts as its processor.

This policy explains what we collect, why, and the rights you have over it, in accordance with UK GDPR and the Data Protection Act 2018.

We collect only what the service needs to function:

• Account details - name, email address, and password hash for anyone who signs in.
• School data - classes, venues, schedules, bookings, attendance, and payment records for schools using the platform.
• Swimmer details - names, dates of birth, progress records, and, where a parent provides them, medical and SEND information needed to teach safely.
• Payment metadata - amounts, dates, and Stripe references. Card numbers go directly to Stripe and never touch our servers.
• Technical data - logs, device and browser information used for security and debugging.

Health information about swimmers is special category data. It is collected only when a parent chooses to provide it, is used solely to teach the swimmer safely and appropriately, and is visible only to the school staff who need it - typically the teacher poolside and the school's administrators.

We process it on the basis of the parent's explicit consent, which can be withdrawn at any time from the swimmer's profile.

We use personal data to:

• Provide the service - bookings, registers, payments, progress tracking, and notifications.
• Send transactional messages such as booking confirmations, receipts, and lesson reminders.
• Keep the platform secure, prevent fraud, and debug problems.
• Improve the product using aggregated, de-identified usage patterns.

We never sell personal data. We share it only with the sub-processors needed to run the service - Supabase (database and authentication hosting), Stripe (payments), and our email delivery provider - each bound by their own data processing agreements, and with authorities where the law requires it.

Account and school data is kept while the account is active. When a school closes its account, its data remains exportable for 90 days and is then deleted, except for financial records we must retain for up to six years under UK tax law.

Under UK GDPR you can ask us to access, correct, export, restrict, or delete your personal data, and you can object to processing. Email privacy@octoswim.co.uk and we will respond within one month.

If you are unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk).

If we make material changes we will email account holders and note the new effective date at the top of this page. Minor clarifications may be made without notice.