Privacy Policy

This privacy policy explains how we collect, use, store and protect your personal data when you use Digital Shields as a parent, guardian or carer, or visit our website. It is written in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations. Schools using our Schools Portal should read our schools privacy notice instead.

2. Information We Collect

2.1 Your account

• Your name and email address
• Your password, stored only as a bcrypt hash (we never store the password itself)
• Your plan, trial dates and, for paid plans, the Stripe customer and subscription ids that link your account to Stripe
• Your choices: agreement to our terms and, if you tick it, to marketing emails (with when you chose), which notification emails you want, and which alert topics interest you
• Two-step verification secrets and hashed backup codes, if you turn two-step verification on
• When you last used the portal, notes our support team makes when helping you, and any suspension of the account
• Family seats: the email address of anyone you invite to share your plan

2.2 Child profiles

You can add a profile for each child. For each, we keep:

• A first name or nickname (one or two words, letters only; never a surname)
• Age and school year
• The devices and apps they use, a colour for the profile, and the concerns you pick from our list

We never ask for children's surnames, photographs, school names, addresses or dates of birth. See section 5.

2.3 What you do in the portal

• Family Safety Audit answers and course progress
• Community forum posts, replies and reactions, and any content reports you make
• Shield AI: on Fortress, the AI memory you choose to save; a count of the messages you send (for your monthly allowance). We don't keep your conversations on our servers (section 6).
• Usage events: which features you use (for example that a guide was opened), linked to your account, with your IP address and browser type
• Some progress and preferences are kept only in your browser (see our Cookie Policy)

2.4 Payments

All payments are handled by Stripe. We never see or store your card number, expiry date or security code. We keep only the Stripe ids above and any refunds our team records.

2.5 Security records

• Failed sign-ins: the email address typed, the reason and the IP address
• Temporary rate-limit counters, by IP address, held in memory
• A record of actions our team takes on your account

2.6 Visitors to our website

If you accept analytics in our cookie banner, Google Analytics measures visits to our public pages, and we keep our own anonymous usage counts with a random id (ds_anon). If you don't accept, neither runs. See section 13.

3. How We Use Your Information

• Provide the service: your account, the portal, audits, courses, Shield AI, community and family seats
• Personalise guidance: tailor advice to your children's ages, devices, apps and concerns
• Take payments and manage your subscription, through Stripe
• Send service emails: verifying your email, password resets, payment and trial notices, security notices
• Send the emails you choose: threat alerts, digests, weekly reports and the daily tip
• Send marketing emails, only if you agreed to them
• Keep the community safe: moderation and content reports
• Keep the service secure: detect and block abuse, fraud and attacks on accounts
• Improve the service: count which features and guides are used
• Comply with the law: tax records, and valid requests from the authorities

We do not use your Shield AI conversations, or anything else you tell us, to train AI models.

4. Our Lawful Basis for Each Use

Where we rely on legitimate interests, we have weighed them against your rights; ask us for a summary at dpo@digitalshields.co. You can object at any time (section 10).

5. Children's Data and the Children's Code

Digital Shields is for parents and guardians aged 18 and over.

• Children cannot create accounts. Only adults may register.
• Child profile data comes from parents, never from children directly.
• Lawful basis: legitimate interests: the parent's interest in protecting their child online. Given how little we keep (a first name, age, school year, devices, apps and concerns from a fixed list), the protective purpose, and the parent's full control over profiles, we have concluded the parent's interest isn't overridden by the child's rights.
• Minimal data only: the portal accepts only a first name or nickname (one or two words), and concerns from our list, not free text.
• Parental control: you can view, edit and delete profiles at any time.
• No profiling of children, no nudge techniques directed at children, and no tracking of children's location.
• The Children's Code: our service is directed at parents, not children, and we have designed it to keep children's data to the minimum.
• If we learn that a child has given us personal data directly (for example by creating an account), we delete it and close the account.

6. Shield AI

Shield AI is provided using Anthropic's Claude, through Anthropic's commercial API. Anthropic acts as our processor.

• What we send: when you ask Shield AI something, we send Anthropic the conversation as you typed it (your last 20 messages and Shield AI's replies, up to 4,000 characters each), with our instructions, and, on Fortress, the AI memory you've saved (up to 2,000 characters). For a conversation script, we send the topic, your child's age, your child's first name if you pick one of your child profiles, and any context you add. "Ask Shield AI" on a child profile fills in a question with the child's age, apps and concerns (not their name), which you can change before sending.
• Please don't include anything Shield AI doesn't need, such as surnames, schools or addresses. It is not anonymous: anything you type is sent.
• We don't keep your conversations on our servers. Your latest conversation and conversation script stay in your browser until you sign out or start a new chat. We record only that a message was sent, to count your monthly allowance.
• Anthropic deletes what we send within 30 days (or keeps it for up to 2 years if its automated systems flag it for a breach of its usage policy), and under its commercial terms does not use it to train its models. It is in the United States; see section 8.
• Shield AI gives general guidance, not professional advice, and makes no decisions about you (section 11).

7. Who We Share Your Data With

We share your data only with these service providers, each under a written data processing agreement and only for the purpose shown:

• Railway: hosting our servers and database (United States (Railway, US West))
• GitHub: our source code, automated jobs, and our daily database backups, encrypted before upload and kept 30 days (United States)
• Stripe (Stripe Payments Europe, Limited, Ireland, with Stripe, LLC, United States): payments. Stripe is also a controller in its own right for fraud prevention and its legal duties, under its privacy policy
• Anthropic: Shield AI and conversation scripts, as in section 6 (United States)
• Resend: sending our emails: your email address and name (United States)
• Cloudflare: DNS, content delivery and security for our website, and the bot check on sign-up (Turnstile) (United States and global network)
• Google: Google Analytics on our public pages, only if you accept analytics; never in the portal (United States)
• IX Suite, our own customer relationship system (not another company): only if you have verified your email and agreed to marketing emails, your name, email address, the date you signed up and your trial end date, to send you marketing emails about Digital Shields. When you unsubscribe or delete your account, IX Suite is told through a one-way code made from your email address (never the address itself), and suppresses or deletes your contact.
• HighLevel (GoHighLevel): only for business contacts, as in section 16 (United States)

Other parents see what you post in the community forum, with the name you post under.

We never sell your personal data, and we never share it with advertisers or data brokers.

8. Where Your Data Is

Our servers and database are hosted by Railway in the United States (Railway, US West). Several of the providers in section 7 are in the United States. Each transfer outside the UK is protected as Chapter V of the UK GDPR requires:

• the ICO's UK International Data Transfer Addendum to the EU Standard Contractual Clauses, in our agreement with each provider, or
• the UK Extension to the EU-US Data Privacy Framework, where the provider is certified under it (Stripe relies on this first), and
• for the EU (Stripe's Irish company), the UK's adequacy regulations,

together with technical measures: encryption in transit and at rest, encrypted backups, and sending each provider only what it needs. If we move our hosting, we will update this policy before the move.

9. How Long We Keep It

An automated job that runs every night enforces these periods:

• Your account and everything in it (child profiles, progress, AI memory, alert topics, invites you sent): until you delete your account, or we do. Deletion is immediate; copies in our encrypted backups are gone within 30 days.
• Accounts never verified: if you never confirm your email address, the account is deleted 30 days after sign-up (unless it has a paid plan or a family seat).
• Community posts: kept for the conversation's sake; when you delete your account, your name, picture and details are removed from them and they are shown as from a former member.
• Content reports: deleted 24 months after they are resolved.
• Usage events: the IP address and browser type are removed after 30 days, and the events deleted after 12 months.
• Failed sign-ins: 90 days.
• Family invitations not answered: 90 days.
• Shield AI conversations: not kept by us (section 6). Anthropic deletes them within 30 days.
• The record of our team's actions on your account: 6 years; when you delete your account, your name and email are removed from it.
• A record that an account was deleted, or that marketing consent was withdrawn: a one-way code made from the email address (not the address), and the date, kept 6 years so that we, and IX Suite, can honour it.
• Payment records: kept by Stripe and in our accounts for 6 years after the end of the financial year, as UK tax law requires.
• Server logs: carry account ids only (never names, email addresses or passwords) and are kept by our hosting provider for its standard log period.
• In your browser: what the portal keeps on your device is removed when you sign out, except your display and cookie choices (see our Cookie Policy).
• Business contacts: see section 16.

10. Your Rights

• Access (Article 15): a copy of the personal data we hold about you. In Settings, Download my data gives you everything in one file: your account, child profiles, progress, posts, AI memory, alert topics, invites, usage events (with their IP addresses), content reports, failed sign-ins, refunds and the actions our team took on your account. Or email us.
• Rectification (Article 16): correct your details in Settings, or ask us.
• Erasure (Article 17): In Settings, Delete my account deletes your data straight away (section 9 says what remains and why), or ask us.
• Portability (Article 20): the download is a structured, machine-readable file (JSON).
• Restriction (Article 18) in certain circumstances, for example while we check the accuracy of your data.
• Object (Article 21): to processing based on legitimate interests; we will stop unless we have compelling grounds. Your right to object to direct marketing is absolute: we stop immediately.
• Withdraw consent at any time: notification emails and marketing in Settings or from any email, analytics in the cookie banner or on our Cookie Policy page, AI memory in Settings. This doesn't affect what we did before.
• Automated decisions (Article 22): we don't make any (section 11).

How to ask: use Settings in the portal, or email dpo@digitalshields.co. We may need to confirm it's you. We reply within one month; if a request is complex, or you send several, we may extend this by up to two further months, and we will tell you why within the first month. If we need more information to find what you asked for, the time starts when we receive it. Our searches are reasonable and proportionate. It's free, unless a request is manifestly unfounded or excessive.

11. Automated Decisions and Profiling

• Safety Score: worked out in your browser from your audit answers. It doesn't affect your account, plan or features.
• Shield AI gives general guidance only. It doesn't produce legal or similarly significant effects.
• We make no decisions based solely on automated processing that have legal or similarly significant effects on you, and we don't profile you for marketing.

We have assessed the risks of Shield AI and child profiles to the people involved, and review that assessment when we change how we process their data.

12. Data Security

• Passwords hashed with bcrypt (12 rounds); never stored as typed
• Encryption in transit (HTTPS/TLS, with HSTS preload) and at rest (by our hosting provider), and daily backups encrypted before they leave our build server
• CSRF protection (double-submit cookie) and rate limiting on sign-in and across the service
• Sessions in HttpOnly cookies, checked on every request, and ended everywhere when you change your password
• Two-step verification (TOTP), with single-use backup codes: required for our team and for school admins, and available on every parent and staff account
• Least privilege: our team's access to accounts is limited by role, protected by two-step verification, and recorded
• Cyber Essentials certified: issued by the IASME Consortium (the NCSC-appointed certification body). Certificate number 455d8005-7a64-4e20-99e2-1ae94d37d797, certified 3 June 2026, valid until 3 June 2027.
• NCSC Early Warning: enrolled in the National Cyber Security Centre's Early Warning service, which alerts us to threats against our public infrastructure

13. Cookies and Local Storage

We use cookies that are strictly necessary to keep you signed in and protect forms, and local storage to remember your choices and some progress on your device. Optional analytics (Google Analytics on our public pages, and our own anonymous usage id) run only if you accept them in our cookie banner, and never in the portal. We use no advertising cookies. Full details are in our Cookie Policy.

14. Data Breaches

• The ICO: where a personal data breach is likely to result in a risk to people's rights and freedoms, we report it to the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it.
• You: where a breach is likely to result in a high risk to you, we tell you without undue delay, with what happened and the steps you can take.

15. Changes to This Policy

• For significant changes, we will tell you by email and show a notice in the portal before they take effect.
• The "Last updated" date at the top of this page shows the latest revision.
• Earlier versions are available from support@digitalshields.co.

16. Business Contacts and Outbound Marketing

This section applies only to people we contact in a professional capacity — typically designated safeguarding leads, headteachers and senior staff at schools and organisations. It does not apply to account holders, whose data is covered by the sections above.

What we hold. Your name, job title, work email address, the name of your school or organisation, and a short note of why we approached you.

Where it came from. If you did not give us these details yourself, they came from one of the following, and our first email to you says which:

• Contact details your school or organisation publishes on its own website, or that appear in a public register or professional directory
• A form you or a colleague completed on one of our websites
• A business contact data provider, named in that first email

Why we use it, and our lawful basis. Our basis is legitimate interests (Article 6(1)(f)): our interest in offering online safety services to those responsible for safeguarding, and your interest in knowing such services exist. We have carried out and documented a balancing test weighing that interest against your rights, and you can ask us for a summary of it at dpo@digitalshields.co.

Where you asked to hear from us — because you completed a form — our basis is your consent instead, and you can withdraw it at any time using the unsubscribe link in any email.

How long we keep it. If we contacted you and you never replied, we delete your details 30 days after the final email in the sequence. There is no business reason to keep them beyond that, so we do not.

If you unsubscribe, object, or your message bounces, we keep your email address and the date on a suppression list indefinitely. That record exists for one purpose: so that we never contact you again. It is not used to market to you, and it is the only thing we retain about you.

If we go on to work together, your details are retained for the duration of that relationship and afterwards for as long as the law requires us to keep business records.

Your right to object. You have an absolute right to object to direct marketing under Article 21(2) of the UK GDPR. If you tell us to stop, we stop — no reasons needed, no balancing test, no questions asked. Use the unsubscribe link in any email, or reply and say so.

If your school or organisation does not accept unsolicited approaches from suppliers, tell us and we will add you to the suppression list.

Who we share it with. Nobody, for marketing purposes. We do not sell, rent or pass on your details. We keep them in IX Suite, our own customer relationship system, and our outbound email is sent through GoHighLevel (HighLevel Inc.), which processes it on our instructions in order to deliver the message, under the transfer safeguards described in section 8.

17. Complaints and Contact

For privacy questions, requests or complaints, contact our data protection contact:

Infinity X Investments Ltd (trading as Digital Shields)
Email: dpo@digitalshields.co
Post: Floor 2, Lakeside Tower, Lakeside Business Park, Walkmill Way, Cannock, Staffordshire, WS11 0XE
Company number 16998775, registered in England and Wales. ICO registration ZC142619.

How we handle a complaint. Tell us by email or post what you're unhappy about. We acknowledge it within 5 working days, look into it properly, and give you our answer within 30 days. If it needs longer, we tell you why and when to expect our answer (at most 3 months from when you complained).

If you're not satisfied with our answer, or we haven't replied, you can complain to the Information Commissioner's Office (ICO):

Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF