GrammarBound Sign in
Privacy policy

How we handle your data.

Last updated: 2 September 2026. This notice explains what GrammarBound collects, why, who else sees it and what you can do about it. You can use the map without an account. If you create one, your data is stored and processed in the United Kingdom, and you can delete all of it yourself at any time.

This privacy notice is for Joseph Spence, trading as GrammarBound, a sole trader based in the United Kingdom ("we", "us", "our"). It describes how we collect, store, use and share your personal information when you visit grammarbound.co.uk, create an account, buy a Pro plan, or contact us.

We are responsible for deciding how your personal information is processed. If you have questions or concerns, email privacy@grammarbound.co.uk. If you do not agree with this notice, please do not use the service.

Summary of key points

The short version. Each point links to the full section.

Contents

  1. What information do we collect?
  2. How do we process your information?
  3. What legal bases do we rely on?
  4. When and with whom do we share your information?
  5. Do we use cookies and other tracking technologies?
  6. Do we offer AI-based features?
  7. How do we handle signing in with Google?
  8. Is your information transferred internationally?
  9. How long do we keep your information?
  10. How do we keep your information safe?
  11. Admissions priority data
  12. What are your privacy rights?
  13. Controls for Do-Not-Track features
  14. Do we make updates to this notice?
  15. How can you contact us about this notice?
  16. How can you review, update or delete your data?

1. What information do we collect?

In short: we collect the information you choose to give us, plus limited technical information collected automatically.

Using the map without an account

Personal information you give us

Accounts, free or Pro, are provided through Supabase Auth. When you register or sign in we store:

All of this is optional beyond your email address. You choose what to save, you can edit or clear each item at any time from your account, and deleting your account removes all of it.

Calendar subscription

From your 11+ journey you can ask us for a private calendar link, so the admissions dates for the schools you track appear in your own calendar. That link is a capability URL: it carries no sign-in, so anyone holding it can see which schools you track and the dates that go with them. Share it only with people you would show the page to, and Reset this link on the same page stops the old one working everywhere it has been added. Whichever calendar service you add it to (Google, Apple, Microsoft or another) fetches the link from our servers on your behalf, so that provider sees it too.

Payment information

Payments are processed by Stripe. Card details are entered on Stripe's own hosted checkout page and are never seen or stored by GrammarBound. We pass Stripe your email address so your payment can be matched to your account, and we receive back only your subscription tier, its expiry date, subscription status, and the Stripe customer and subscription identifiers needed to manage your plan.

There are two paid options. The Pro Pass is a one-off payment of £25 giving three months' access. Pro Monthly is a recurring subscription of £10 a month that continues until you cancel it. You can manage or cancel at any time through the Stripe Customer Portal, reached from Manage subscription in your account. If you cancel, Pro access continues to the end of the current billing period.

Information collected automatically

Some information is collected automatically when you visit. It does not identify you by name.

Google APIs

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

2. How do we process your information?

In short: to provide the service you asked for, to run your account and subscription, to keep the service secure, and, with your consent, to send you email.

In short: we only process your personal information when we have a valid legal reason to do so.

Under the UK GDPR we rely on the following lawful bases.

Marketing email

We only send marketing email to people who have asked for it. Our lawful basis is your consent, and there are three things you can choose separately:

You can withdraw your consent at any time, and it is as easy to withdraw as it was to give: change any of the three under Email preferences in your account, or use the unsubscribe link in any message we send you: that link works without signing in. Withdrawing does not affect anything we sent before you did.

Service emails are separate. Password resets, payment receipts and anything else needed to run your account are sent under our contract with you, not under consent, so they are not switchable while you have an account.

4. When and with whom do we share your information?

In short: with a short list of named service providers, and with nobody else. We do not sell your personal information.

These providers process personal information on our instructions, and we put data processing agreements in place with them where they do:

The following are contacted by your browser directly rather than by us, so they see your IP address as independent providers, and we send them nothing about you:

We may also share information in one other situation: a business transfer. If GrammarBound is sold or its assets transferred, your information may pass to the buyer, who would remain bound by this notice until you are told otherwise.

5. Do we use cookies and other tracking technologies?

In short: one essential cookie, always. Advertising cookies only if you accept them.

When you sign in we set a single essential cookie, grammarbound_session: an HttpOnly cookie that keeps you signed in. It expires after seven days without a visit, or as soon as you sign out. This cookie is necessary for the service and is always set.

With your consent, we also use Google Ads cookies to measure the performance of our advertising and to show relevant ads (remarketing). These advertising cookies are off by default and are only set if you choose "Accept" on our cookie banner; choosing "Reject" means they are never set. We use Google Consent Mode, so until you accept, Google receives only aggregated, cookie-less signals.

You can change your choice at any time by clearing your browser's site data. You can also opt out of personalised advertising from Google through Google's Ads Settings, and from participating third parties at optout.aboutads.info.

Outcome tracker data and generated reports are stored in your browser's localStorage, not in cookies. Our Vercel analytics are cookie-less.

6. Do we offer AI-based features?

In short: one, it is optional, and it never sees your priority tier profile.

Pro subscribers can ask GrammarBound to write a short property-listing snippet describing the grammar schools a property falls within. This feature is powered by an AI model provided by Anthropic. It runs only when you choose to generate a snippet, if you never use it, nothing is sent.

When you do use it, we send Anthropic the property postcode you entered, together with published facts about the qualifying schools: their names, whether each is a boys', girls' or co-educational school, its Ofsted rating, its national GCSE ranking and its approximate distance from the property. We do not send your name, your email address, or anything from your priority tier profile. A sibling or staff link is about the applicant rather than the address, so it is deliberately left out.

The snippet is written from those facts alone. Anthropic processes this outside the UK under appropriate safeguards.

7. How do we handle signing in with Google?

In short: Google is the only sign-in provider we offer, and it tells us a little more than we use.

You may register or sign in using your Google account. If you do, Google tells us the Google account identifier, your email address and whether it is verified, your name, your profile picture address and your language setting. We use the identifier and the email address to create and recognise your account; we do not display your name or picture anywhere.

We use this information only as described in this notice. We do not control, and are not responsible for, Google's own use of your information. See Google's privacy policy. We offer no other social login.

8. Is your information transferred internationally?

In short: your account data stays in the UK. Some of our providers process data elsewhere.

Your account data and priority tier profile are both stored and processed in the United Kingdom, held in Supabase's London region, and handled by server-side functions that also run in London.

Some of the providers in section 4 process data outside the UK, including in the United States (Stripe, Google, Anthropic) and Germany (OpenRouteService). Where personal information leaves the UK we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses together with the UK's International Data Transfer Addendum, or the UK's International Data Transfer Agreement. Further details are available on request.

9. How long do we keep your information?

In short: account data lasts as long as your account. Everything else has a short, fixed life.

We keep your account data: your email address, tracked schools, saved addresses, commute preferences, priority tier profile and email preferences, for as long as your account is open. If you delete your account, your record and saved details are removed from our database and your authentication record is deleted, along with the record of your email-preference choices.

Other things we hold have shorter, fixed lives:

Stripe retains payment and invoice records for as long as the law requires, typically six years. When we no longer have a reason to hold your information, we delete it or anonymise it.

10. How do we keep your information safe?

In short: with technical and organisational measures, though no system can be guaranteed secure.

Passwords are hashed, never stored in readable form. The session cookie is HttpOnly and expires. Access to our database is restricted, and the tables holding email preferences, security counters and payment events cannot be read by any client, only by our server.

To slow down automated attempts to guess passwords or to discover which email addresses have accounts, we count requests to our sign-in, password-reset and account-lookup endpoints against short time windows. A counter is keyed either to the IP address the request came from or, where the limit protects a single account, to that account. Each record holds nothing but a count and an expiry time, they last no longer than 24 hours, and expired records are deleted automatically. We do not use them to build a profile of you.

Despite these measures, no transmission over the internet and no storage system can be guaranteed to be completely secure, and we cannot promise that our safeguards will never be defeated. If a breach affects your rights, we will notify the Information Commissioner's Office and, where required, you.

11. Admissions priority data

In short: we store the facts that decide which priority tier an application falls into, and none of the sensitive ones.

GrammarBound accounts are for adults: by creating one you confirm you are 18 or over. The service is designed for parents, carers and guardians researching school admissions, and we do not knowingly collect personal information directly from anyone under 18.

Grammar schools allocate places in priority tiers, and which tier an application falls into depends on a handful of facts about the household. The optional priority tier profile records the non-sensitive ones: a home postcode, service-family (service premium) status, links to schools where there is a sibling or a parent on the staff, and an optional label so you can tell one application from another, so that the eligibility and tier indications you see reflect your circumstances rather than a generic case. Providing it is optional, every field can be left blank or cleared, and it is never used for advertising and never shared with third parties. We do not collect names, dates of birth or test scores.

Sensitive circumstances are not stored. The more sensitive admissions criteria: Pupil Premium eligibility, looked-after or previously-looked-after status, an Education, Health and Care Plan (EHCP), and exceptional medical or social need, are entered as on/off toggles under Tier analysis on the map. These are held only in your browser for the current session, they clear when you close the tab or sign out, and they are never sent to or stored on our servers. You can delete the saved profile, or your whole account, at any time.

If you believe we hold something we should not, email privacy@grammarbound.co.uk and we will delete it.

12. What are your privacy rights?

In short: you can see, correct, export or delete your information, and object to how we use it.

Under the UK GDPR you have the right to:

To exercise any of these, email privacy@grammarbound.co.uk. We answer within one month.

If you are unhappy with how we have handled your personal information, please tell us first. We will acknowledge your complaint, look into it without undue delay, and explain the outcome. You also have the right to complain to the UK's Information Commissioner's Office (ICO), whose helpline is 0303 123 1113.

13. Controls for Do-Not-Track features

Most browsers include a Do-Not-Track ("DNT") setting. No uniform standard for recognising DNT signals has been agreed, so we do not currently respond to them. We do, however, set no advertising cookies at all unless you accept them. See section 5. If a standard is adopted that we must follow, we will say so here.

14. Do we make updates to this notice?

Yes. We will update this notice as the service changes and to stay compliant with the law. The date at the top shows when it was last revised. If we make material changes, for example, if we begin collecting something new or share data with a new provider: we will make that clear on the site, and where the change requires it we will ask for your consent again. We encourage you to check this page from time to time.

15. How can you contact us about this notice?

Privacy enquiries: privacy@grammarbound.co.uk

General enquiries: hello@grammarbound.co.uk

Data controller: Joseph Spence, trading as GrammarBound, United Kingdom.

16. How can you review, update or delete your data?

You can review and change most of what we hold yourself, from your account: your saved addresses, tracked schools, commute preferences, priority tier profile and email preferences. Delete account in the same place removes your record, your authentication details and your consent history immediately.

For anything else: a copy of your data, a correction you cannot make yourself, or a question about what we hold. Email privacy@grammarbound.co.uk.