Privacy Policy v1.04

Last updated: 9 May 2026

1. Who we are

Sendpilot is operated by Sendpilot Ltd, a company registered in England and Wales.

Company number: 16777883

Registered office: 4-6 Swaby's Yard, Walkergate, Beverley, East Yorkshire, England, HU17 9BZ

ICO registration: ZC066853 (registered 16 December 2025, expires 15 December 2026)

Sendpilot is a UK-based service designed to help parents and carers better understand and improve Education, Health and Care Plans (EHCPs).

For the purposes of UK data protection law, Sendpilot Ltd is the data controller for all personal data processed through the service.

Data Protection Officer: Graeme Sewell — privacy@sendpilot.co.uk

Contact: privacy@sendpilot.co.uk

2. Who this service is for

Sendpilot is intended for adults (18+) who have parental responsibility or other lawful authority in relation to a child.

We do not knowingly provide services directly to children, and children must not create accounts.

3. What data we collect

We collect only the data necessary to provide the Sendpilot service.

a) Account data

Email address
Account credentials
Records of consent (including timestamps and accepted policy versions)

b) Uploaded documents

You may choose to upload documents such as:

Education, Health and Care Plans (EHCPs)
Professional reports (e.g. OT, SALT, EP reports)

These documents may contain:

personal data relating to a child; and
special category data, including health, disability, or educational needs information.

Sendpilot does not create independent child profiles or standalone child records. All child-related data exists only within the documents you choose to upload.

c) Derived analysis data

When you request analysis, Sendpilot generates derived data such as:

structured observations (e.g. missing sections or unclear provision)
flags and findings linked directly to the source document

All outputs:

remain directly connected to the original document;
are not stored as independent records;
are generated solely to support your understanding.

4. How we use your data

We use personal data only to:

provide access to the Sendpilot service;
analyse documents at your request;
present structured outputs to you;
maintain platform security, integrity, and reliability.

Sendpilot does not:

provide medical, legal, or educational advice;
make automated decisions about a child;
replace professional judgement;
sell or share your data with advertisers.

5. Lawful basis for processing

Under UK GDPR, we rely on:

Contract — to provide the service you request
Explicit consent — for processing child-related and special category data
Legitimate interests — for security, fraud prevention, and service reliability

You may withdraw consent at any time by deleting documents or closing your account.

6. Children's data and special category data

Sendpilot processes sensitive data relating to children only:

when you actively choose to upload it;
for the specific purpose of analysing it for you;
in line with your instructions and consent.

We recognise the sensitive nature of this data and apply appropriate technical and organisational safeguards, including encryption in transit and at rest, and access controls.

You remain in control at all times. Deleting a document removes both the document and associated analysis in line with our deletion processes.

7. Automated processing

Sendpilot uses automated systems to analyse documents.

Key principles:

analysis is performed only at your request;
outputs are traceable to the source document;
no automated decisions are made about a child;
human judgement remains essential.

Sendpilot is designed to support understanding, not determine outcomes.

8. Data storage and retention

Document and account data is stored on secure UK-based infrastructure:

AWS eu-west-2 (London region) — primary cloud infrastructure and document storage
Contabo (UK) — additional infrastructure

We retain data only while it remains in your account. Deleting documents or your account results in removal of associated data within our standard deletion processes.

We do not retain personal data unnecessarily.

9. Sharing your data

We do not sell or rent your personal data.

We share limited data with the following trusted service providers where necessary to operate the platform:

AWS — secure cloud hosting and document storage (UK region)
Contabo — infrastructure hosting (UK)
Polar — payment processing. Polar's Data Processing Addendum is incorporated into their Master Terms of Service. See polar.sh/legal for full details including their sub-processor list.

All providers are subject to appropriate contractual, confidentiality, and security obligations.

10. Your rights

Under UK GDPR, you have the right to:

access your personal data (Article 15);
correct inaccurate information (Article 16);
delete your data (Article 17);
data portability — receive your data in a structured, machine-readable format (Article 20);
withdraw consent at any time;
object to or restrict processing in certain circumstances (Articles 21-22).

To exercise any of these rights, contact us at privacy@sendpilot.co.uk.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

11. Cookies

Sendpilot uses a small number of cookies. Essential cookies (required for the service to function) are always active. Marketing and analytics cookies are only set with your consent.

For full details, see our Cookies Policy.

12. Changes to this policy

We may update this Privacy Policy as Sendpilot evolves.

If changes are significant, we will make this clear and, where appropriate, ask you to review and accept updates before continuing to use the service.

13. Contact

If you have questions or concerns about how we handle personal data:

Email: privacy@sendpilot.co.uk

Post: Sendpilot Ltd, 4-6 Swaby's Yard, Walkergate, Beverley, East Yorkshire, HU17 9BZ

You can also contact the ICO directly at ico.org.uk.