# Privacy What Nalda holds, why, who else can see it, and how a family gets it back or gets it deleted. Last updated 29 July 2026. > Not ready to sign. This document is still missing: > - a registered address > - an address for privacy questions > - a review by a qualified lawyer ## The short version Nalda answers families on behalf of a school, from that school's own published content. The school decides what the assistant knows and what it is allowed to say. Nalda holds what a family typed and what a family volunteered, and nothing else. Nalda holds no student records. Not grades, not attendance, not discipline, not health, not application files, not anything from a school information system. There is no integration that brings them in and no field that stores them. ## Who is responsible for what The school decides why family data is collected and what happens to it. In data protection language the school is the controller and Nalda is the processor. Nalda acts on the school's instructions, which are the settings the school chooses in the product and the agreement it signs. That means a family asking for a copy of their data, or asking for it to be deleted, asks the school. The school can do both from inside Nalda, without contacting us, on the same day. ## What we hold - Content a school already publishes. Its website, its handbooks, its calendars, its own answers. This is the material the assistant answers from. - What a family typed. The questions asked in the widget, on the school's assistant page, or in an email sent to the school's Nalda address, and the replies the assistant gave. - Contact details a family volunteered. A name, an email address, sometimes a phone number, sometimes a child's year group. Given by the family, in the conversation, so the school can write back. - Bookings. The tour or call a family chose, and the time. - Staff accounts. The name, work email and permission role of the people at the school who use the product. ## What we do not hold Student records of any kind. Nalda has no connection to a student information system and no field for a grade, a mark, an attendance record or a health note. Payment details of families. Nalda takes no money from families. The school's own subscription is paid through Stripe, which holds those card details, not us. Tracking cookies. The widget sets no cookie at all. See the section on cookies below. ## How long we keep it Conversations, and everything that is part of a conversation, are kept for a period the school chooses and then deleted automatically. The default is 24 months. A school can set anything from one month to ten years, and the setting is visible to its staff on the privacy page inside the product. The family record itself, meaning the contact details a family volunteered, is kept until the school deletes it or a family asks for it to be deleted. It is the school's own record of somebody who got in touch, and a clock is the wrong thing to decide when a school stops holding it. The purge runs on a schedule, it records every run, and the school can see when it last ran. ## Getting a copy, and getting it deleted A family asks the school. Any member of staff with admin permission can produce a complete copy of everything Nalda holds about that household, as a readable file, in one click. The same page has a delete button. Delete means delete. The family record, every conversation, every message in both directions, every draft written for staff, every email, every queued reminder, every announcement sent to them and every booking are removed from the database. They are not marked hidden and they are not moved to an archive. ## The one thing deletion does not remove, and why Two records are append-only by design and are not rewritten when a family is deleted: the ledger, which records that a first contact happened, that an answer was given, that a tour was booked and that a student eventually enrolled, and the staff audit log, which records which member of staff did what. Those two records never contained a family's words or their contact details in the first place. They hold identifiers, timestamps and outcomes. The identifier is a random reference number that pointed at the family record. Once that record is deleted the reference points at nothing, and nothing can reconstruct it. This is deliberate and it is the honest answer to the question. A record that can be edited after the fact is not a record. If a school could rewrite its own audit log, the audit log would be worth nothing on the day it actually mattered. So the row stays, the identifier goes dead, and Nalda writes a marker next to it saying that the household behind it was erased, when, and by whom. After every deletion Nalda goes back and searches the database for the family's own address, phone number and names, including in those append-only records. If it finds anything, the deletion is reported as incomplete and says exactly where, rather than reporting success. ## Cookies The widget that runs on a school's website sets no cookies. None, first party or third party. It remembers a conversation using a random token in the browser's own local storage on the school's own domain, so a family who reloads the page does not have to start again. That token is not shared with any other site, is not used for advertising, and can be cleared by clearing site data. The staff application does use a cookie, for one purpose: keeping a signed-in member of staff signed in. There is no advertising or analytics cookie anywhere in the product. ## Who else sees it The companies listed on the subprocessor page, each for a stated purpose. That list is generated from the product's own configuration rather than maintained by hand, so it cannot quietly fall out of date. Nobody else. Nalda does not sell data, does not share it between schools, and does not use one school's families to train anything. ## Google Workspace data, and the limits on it A school may connect its own Google account so the assistant can offer a real time for a visit and read a folder the school chooses. Connecting is optional, a member of staff does it themselves on Google's own consent screen, and the product works without it. Four permissions are requested and no others: reading when a calendar is busy, reading a named calendar, creating and updating the events Nalda books, and read-only access to Drive. Nalda does not request permission to read a school's email, and it does not have it. What that access is used for, and nothing else: showing a family times that are genuinely free, writing the visit onto the calendar once a person has confirmed it, and reading documents from a chosen Drive folder into the school's own answer library so the assistant can cite them. Drive access is read-only, so nothing in a school's Drive is ever changed or deleted by Nalda. Nalda's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Workspace data is never sold, never used for advertising, never used to train any model, and never shared between schools. It is not used for any purpose other than the ones named above. The credential that grants this access is encrypted before it is stored, under a key held outside the database, so a copy of the database on its own does not grant anybody access to a school's calendar or Drive. A school can disconnect at any time from its own settings, or revoke Nalda directly in its Google account, and either one ends the access immediately. ## Model providers The assistant drafts answers using language models run by the providers named on the subprocessor page. What is sent to them is the question a family asked and the passages of the school's own published content retrieved to answer it. Contact details are not placed in a prompt. Nalda does not use school or family content to train models. The providers are used through their business terms. ## Where it is In the United States. The application runs in a United States region and the database and every provider named on the subprocessor page are United States based. ## Changes When this page changes materially, schools using Nalda are told before the change takes effect. The date at the top is the last change.