Privacy Policy

Effective: 29 August 2026. Version: privacy-gb-2026-08-29. DRAFT FOR COUNSEL REVIEW — NOT LEGAL ADVICE. Ticket: GUY-175.

This notice is for United Kingdom use of Ashby Care (England first). It is not the US Privacy Policy. We do not claim COPPA or FERPA for a UK child.

1. Who we are

Viva Longer LLC, doing business as Ashby Care 548 Market St PMB 649504 San Francisco, CA 94104-5401 United States privacy@ashbycare.com

We provide software to Ofsted-registered (and similarly licensed) childcare settings in England. The Setting is the controller. Ashby is a processor.

2. UK representative

Ashby is not established in the UK. UK GDPR requires a UK representative. Buy the mandate (do not enroll the cheap EU “small company” SKU for production): DataRep UK Basic, Sensitive Data Included — ticket GUY-178.

Until the mandate is signed, this block stays a placeholder. Do not process production UK child data until the name and address below are replaced with DataRep’s notice paragraph.

• Representative name: [DATAREP UK — paste legal name from the signed mandate]
• Address: [DATAREP UK — paste London contact address from the mandate]
• Email: contact@datarep.com

The ICO and people in the UK may contact the representative as well as Ashby.

3. Information we process

Staff and owner accounts; guardian contact details because the Setting invited them; children’s records the Setting enters (name, date of birth, attendance, care notes, photos if a guardian opted in). We do not collect child biometrics for recognition, live camera streams, or government IDs in this pack.

4. Purposes

Operate the Setting’s roster, attendance, ratios, parent communication, and (when billing ships in GBP) private fees. Improve the product using T0 telemetry only (no child or adult personal information).

5. Lawful basis (Setting as controller)

The Setting determines lawful basis (typically contract / legitimate interests / legal obligation for licensing records, and consent where the ICO Children’s Code expects it — including photos, which stay off until a guardian opts in).

6. Transfers

Primary hosting is Google Cloud us-west1 (United States). See the UK DPA for the transfer tool.

7. Retention

Children’s information is kept only as long as reasonably necessary and not indefinitely. Clocks follow the GB-ENG ruleset (EYFS / Ofsted floors where they apply). Hard-delete from primary storage when the clock expires or the Setting instructs deletion; backups expire on a defined cycle.

8. Your choices

Ask the Setting to access, correct, or delete family records, or to revoke a consent. You may also contact Ashby or the UK representative. You may complain to the Information Commissioner’s Office.

9. Changes

Material changes get a new version. Accounts re-accept when the clickwrap version bumps.