How Fullscoped uses personal information

About this notice

Website: www.fullscoped.co.uk | Application: app.fullscoped.co.uk | Privacy contact: privacy@fullscoped.co.uk

Service infrastructure

Fullscoped uses contracted cloud providers to deliver the service. The main application database and authentication service are hosted in London, United Kingdom. Frontend content, public website services, email delivery and business correspondence use the suppliers identified below.

Principal database region: Amazon Web Services eu-west-2, London, United Kingdom, through Supabase.

We review this notice whenever the service, suppliers or ways we use personal information change.

1 Who we are

Fullscoped Ltd (company number 17473090) provides a subscription-based self-evaluation, review and improvement-planning platform for schools and education organisations. In this notice, “Fullscoped”, “we”, “us” and “our” refer to Fullscoped Ltd.

For account administration, enquiries, billing, security and our own business operations, Fullscoped Ltd is the controller of personal information.

For information entered into a school workspace by or for a customer, the school or education organisation normally decides why and how that information is used and is the controller. Fullscoped processes that information on the customer’s documented instructions as its processor. Questions about information in a school workspace should usually be directed to the relevant school first.

2 Scope of this notice

This notice applies to visitors to Fullscoped websites, invited and registered users, customer contacts, prospective customers, suppliers and people who contact us. It does not replace a school’s own privacy notice for information the school controls within its workspace.

3 Information we collect

Account and organisation information

• name, work email address, job title and school or organisation;

• account identifier, role and access permissions;

• authentication events and limited security information needed to protect the account;

• subscription, billing and transaction records, where applicable; and

• communications, support requests and feedback.

Technical and service information

• IP address, browser and device information;

• dates and times of access, session and audit information;

• diagnostic, error and performance information; and

• basic website or product usage information needed to operate, secure and improve the service.

School workspace content

Authorised users may enter self-evaluation responses, evidence references, review dates, improvement priorities and generated or edited narrative. Fullscoped is designed for organisational review, not for storing pupil records.

Users must not enter pupil names, safeguarding case details, medical information or other identifiable sensitive personal data. Where evidence concerns an individual pupil or sensitive record, users should refer to the school’s secure systems instead of reproducing that information in Fullscoped.

4 How and why we use personal information

When Fullscoped acts as a processor, the customer is responsible for identifying its lawful basis and providing any required privacy information. Fullscoped does not determine the customer’s lawful basis for workspace content.

5 Where information comes from

We receive information directly from users, from the school or organisation that invites them, automatically through use of the service, and from service providers supporting authentication, hosting, email delivery and payments. A school may create or request creation of an account for an authorised member of staff.

6 Who we share information with

We share personal information only where necessary with contracted suppliers supporting the service, professional advisers, payment providers if used, and regulators or law-enforcement bodies where legally required. Suppliers may only use information for the agreed service and must protect it appropriately.

OpenAI (optional AI only): API inference for selected school-level text, with processing outside the UK as explained in section 16 and the AI arrangements.

An up-to-date subprocessor list will be made available to customers. We do not sell personal information.

7 International transfers

Our primary database and authentication service are configured in London. Vercel and Cloudflare may deliver content or process limited technical information through global networks. Resend may process transactional email information in the United States, and Zoho Mail uses its European data centre service. Other supplier support or operational processing may also occur outside the United Kingdom.

Where a restricted transfer occurs, we use an applicable lawful safeguard. Depending on the supplier and transfer, this may include UK adequacy regulations, participation in an applicable UK extension to an approved data privacy framework, the UK International Data Transfer Agreement, or the UK Addendum to approved standard contractual clauses. We assess supplementary protections where required.

8 How long we keep information

We may retain limited information for longer where required by law, necessary to establish or defend legal claims, or needed to investigate security incidents. Information is securely deleted or anonymised when no longer required.

9 Security

We use proportionate technical and organisational measures designed to protect personal information. These include role-based access controls, authenticated accounts, encryption in transit, supplier controls, access logging, secure development practices and documented procedures for incidents and recovery. No online service can guarantee absolute security.

10 Your data protection rights

Depending on the circumstances and lawful basis, individuals may have rights to access, correct or erase information; restrict or object to processing; receive certain information in a portable format; and withdraw consent where consent is used. These rights are subject to legal conditions and exemptions.

If your request concerns information in a school workspace, contact the school because it normally controls that information. We will assist the school as required. For information controlled by Fullscoped, contact us using the details below. We may need to verify identity before acting on a request.

Your right to object

You have the right to object to processing based on our legitimate interests. You also have an absolute right to object to direct marketing. Contact us to exercise this right.

11 Children

Fullscoped accounts are intended for authorised adult staff and organisation representatives, not pupils. The service is not intended for direct use by children. Customers must not use Fullscoped as a pupil record system or enter identifiable pupil information contrary to the service instructions.

12 Cookies and similar technologies

We may use strictly necessary technologies to provide authentication, security and core service functions. If we introduce non-essential analytics or marketing cookies, we will provide appropriate information and obtain consent where required before setting them.

13 Complaints

Please contact us first so we can try to resolve your concern. You may also complain to the Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113. If you are outside the UK, you may also have the right to contact your local data protection authority.

14 Contact details

Fullscoped Ltd
Company number 17473090
Registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Incorporated in England and Wales on 22 September 2026

Website www.fullscoped.co.uk
Email privacy@fullscoped.co.uk

15 Changes to this notice

We may update this notice when our service, suppliers or legal obligations change. We will publish the current version and highlight material changes where appropriate.

16 Optional AI processing

AI is optional and is not activated solely by holding a Fullscoped account. When authorised and enabled for a school, an administrator or editor may send an update and selected school-level review extracts to the OpenAI API to draft SEF/SDP changes, suggest planning improvements or prepare a governor comparison. Outputs require human review; no decisions about individual pupils or staff are made automatically.

OpenAI OpCo, LLC (United States) is an optional subprocessor. The school controls the purposes of processing its review content; Fullscoped processes it on the school's instructions. Fullscoped separately uses the representative's name, role, acceptance time and document version/fingerprint, together with school/user identifiers, task status, token counts and cost estimates, for account administration, contractual evidence, legitimate security interests and legal obligations where applicable. The usage ledger does not retain submitted evidence text, prompts or generated school wording.

Selected text may contain incidental personal data. Dedicated owner fields, links and attachments are omitted, but free text is not guaranteed anonymous. Users must not send identifiable pupil information, safeguarding cases, medical information or other identifiable sensitive data. The school must identify a lawful basis and provide required privacy information; a representative's acceptance is not data-subject consent.

OpenAI API data is not used for training by default. Fullscoped uses store=false, but standard abuse-monitoring retention may still include inputs and outputs for up to 30 days, with legal and safety exceptions. Temporary model prompt caching may also apply. Processing may occur outside the UK, including in the United States. Fullscoped must verify the applicable OpenAI DPA, UK transfer safeguards and required assessments before activation. No UK-only AI processing or Zero Data Retention is promised. See the AI arrangements for supplier details, retention, usage and how to stop future AI processing. Existing school content is retained under the normal DPA when AI is disabled.