Privacy Policy

Last updated: August 2026 · Applies to every school using SafeRecess

In one paragraph: SafeRecess exists to verify who is picking up and dropping off a child, and to keep the school informed and its records straight. We collect only what's needed to do that — names, phone numbers, and pickup-authorization details for guardians, students, delegates, staff, and visitors. We never collect photographs or biometric data, we never sell or share data with advertisers, and every school's records are kept in their own separate, isolated database.

1.Who this policy covers

This policy explains how SafeRecess — a guardian verification, attendance, and school-safety platform operated by The Frontrow IT Solutions Limited — handles personal data on behalf of the schools that use it. It applies to guardians, students, temporary pickup delegates (nannies, drivers, relatives), staff/employees, and visitors of any school running SafeRecess.

2.Who is responsible for your data

Your school is the data controller: it decides to use SafeRecess, owns the relationship with its guardians and students, and is responsible for the accuracy of the information entered into the system. The Frontrow IT Solutions Limited is the data processor: we build and operate the software, host the data, and process it strictly on the school's instructions and for the purposes described below — we do not use it for our own purposes.

For questions about a specific record, start with your school's administrator — they can see and correct what's on file for your family directly. For questions about how SafeRecess itself works, you can reach us at thefrontrowbusiness@gmail.com.

3.What we collect

Guardians	Full name, phone number, optional email address, a PIN (stored only as a one-way security hash — never in plain text or visible to anyone, including us), and relationship to each linked student.
Students	Full name, class/level, admission number, and an optional ID reference number. No photographs, fingerprints, or other biometric data are collected.
Pickup delegates	Name, phone number, relationship to the student, an optional ID reference, and the date range they're authorized to collect a specific child (for example, a nanny or driver covering school pickup for a term).
Staff/employees	Name, role, and phone number, for clock-in/clock-out records.
Visitors & contractors	Name, purpose of visit, the staff member they're visiting, and the time window of their visit.
Activity records	Arrival/departure timestamps, who authorized each pickup or drop-off, and how it was verified (typed code, QR scan, or a staff override).
Notification history	A copy of every alert we've sent a guardian (arrival, pickup, late-pickup reminder, new pickup authorization, incident broadcast), so it can be looked up in-app if a push notification is missed or never arrives.
Technical data	A push-notification subscription reference (so your browser can receive alerts) and basic request metadata used only for rate-limiting and security auditing.

We never ask for payment card details through a guardian or student account — billing for the service is arranged directly between the school and The Frontrow IT Solutions Limited.

4.Why we collect it

To verify that the person collecting a child is actually authorized to do so.
To keep an accurate, auditable pickup and attendance record in support of the school's own safeguarding duties.
To notify a guardian or the school automatically if a child hasn't been collected by the agreed cutoff time.
To reach every guardian quickly in a lockdown, early dismissal, or other emergency.
To track staff clock-in/out, separately from student records.
To let the gate continue verifying pickups even if the internet connection at the school drops.

We do not use your data for advertising, do not build marketing profiles, and do not use it to train any external product.

5.How long we keep it

Each school sets its own retention period for core records (student, guardian, and attendance data), defaulting to 365 days (one school year). Records for pickup delegates and visitors — people who aren't part of the school community long-term — have their name, phone number, and ID reference automatically redacted after a shorter period (default 180 days) once they're no longer operationally relevant; the underlying attendance entry (that someone collected a child at a given time) is kept for the full retention period, but who that delegate was is no longer retained past that point.

If a school needs its own records for longer than that — for its own archives, a regulator, or any other reason — an administrator can export students, guardians, staff, visitors, and the full attendance log as plain-text CSV files at any time, directly from the admin panel. That export is the school's own copy to keep for as long as the school needs; we don't hold onto it on their behalf past the retention period above.

6.Who we share it with

Your school's own authorized staff — gate staff, teachers with clock-in duties, and school administrators — see only what their role requires.
SMS delivery (only if your school enables it): late-pickup and emergency alerts may be sent by text through Twilio, but only as a fallback when a guardian hasn't enabled push notifications, and only for those two alert types — never for routine notifications.
Push notifications are delivered through your own browser or device's push service (for example, infrastructure run by Google, Mozilla, or Apple, depending on your browser). That service only ever sees an anonymous delivery address — the actual message content is encrypted and only readable once it reaches your device.
Email is used only for account recovery (password resets) for school administrators, sent through the school's configured mail provider.

We do not sell, rent, or otherwise share personal data with advertisers, data brokers, or any party outside of what's needed to run the service — ever.

7.How we protect it

PINs are stored as salted, one-way security hashes — never as plain text, and never visible to school staff or to us.
Each school's records live in their own separate, isolated database file. A login session created on one school's address is destroyed if it's ever presented to a different school's address.
Login and gate-verification attempts are rate-limited, with an escalating lockout after repeated failed attempts.
Every action an administrator takes in the system is written to an internal audit log.
A guardian can set a separate, silent duress PIN — logging in with it looks identical to a normal login but quietly alerts the school, as a safety measure against a coerced pickup.
Data in transit is encrypted (HTTPS) once the school's SafeRecess instance is deployed to production.

8.Children's data

SafeRecess necessarily handles data belonging to children. We treat this as a heightened responsibility, not a routine one: student data is used only to run the pickup-verification and attendance service the school has asked for, is never used for profiling or advertising, and a parent or guardian's rights below apply on behalf of their child.

9.Your rights

Subject to the school's own safeguarding and record-keeping obligations, you can ask your school (or us, on the school's behalf) to:

See what information is held about you or your child.
Correct information that's inaccurate or out of date.
Ask questions about why particular data is collected or how long it's kept.
Raise a concern about how your data has been handled.

Start with your school's administrator for anything specific to your family's record, since they control that data. For anything about SafeRecess itself, contact us at thefrontrowbusiness@gmail.com.

10.Changes to this policy

If this policy changes in a way that materially affects how your data is handled, we'll update the date at the top of this page and notify partner schools directly.

11.Contact

Questions about this policy, or about The Frontrow IT Solutions Limited's role as SafeRecess's operator, can be sent to thefrontrowbusiness@gmail.com.