Privacy notice

1. Who this is for

This notice explains what a Holly device measures, what information reaches Classroom Sounds Ltd, how long we keep it and what rights people have. It is written for anyone: teachers, head teachers, governors, parents, data protection officers and trusts.

Your school decides to use Holly and decides what happens with the information. In data protection terms, the school is the controller and Classroom Sounds Ltd is the processor. Our obligations to the school are set out in a signed Data Processing Agreement.

2. What Holly does

Holly is a small mains-powered unit fixed in a classroom. It has a microphone, a ring of coloured lights, a small speaker, environmental sensors and a button.

Holly says this out loud, in the room, the first time it is switched on.

Nothing is sent when the room is empty, outside the school day, when a teacher has paused it, during a reward, or when it knows it is not measuring properly. A new Holly spends about seven school days learning what normal sounds like in its room, and shows no colour judgement until then.

3. What information reaches us

About rooms (not personal data)

Sound and environmental readings with a room identifier and time; room name, year group, class size and floor-plan position; school name, address and trust; and device serial number, firmware and self-test results.

About staff

This is the only personal data the system holds. It exists so named people can sign in, receive alerts and be accountable for raising them.

Account

Name, work email, role and permission level.

Phones and PINs

Mobile numbers of staff the school nominates for alert texts, and school landlines registered for raising alerts. Alert PINs are stored only as a hash.

Sign-in security

The secret for your authenticator app (used on the school portal), and any browser you choose to trust, held as a hash. For each phone you sign in on with the app, a hashed random identifier for that copy of the app and a label such as the phone's model, so we can email you if your account is signed in on a phone we have not seen before. Never your phone number or an identifier of the phone itself.

Signing in with Microsoft or Google

If you choose to sign in with your school's Microsoft 365 or Google account instead of a password: which of the two, the identifier it gives your account, the email address it confirms, and the name and picture link it shares by default. The picture is not used. Never your password, emails, files, calendar or contacts.

Action record

Every change, with who made it and when.

During an alert

That someone pressed the button in a room, and your own "I'm safe" answer if you give one. Only you can give it, and nothing marks anyone safe automatically.

Phones and computers

Whether your phone can show and sound an alert, its model and app version. For connected computers, a label and when it last checked in. Never a location, and nothing else on the device.

Calls for help

Your name, the time and where you are: a room, or a few words you type. The app takes one reading of your phone's location only when you choose it (“Not sure? Send my location”, or “Add my location” with a room), and it is kept with the record of that call. It never tracks you. If a colleague answers, their name and when they said they were on their way are kept with the call, and when they arrived if they press “I'm here”. If you press “Send more people”, the time is kept and your school's lockdown contacts are told straight away. A call you cancel during the countdown sends nothing and records nothing.

Availability and lone working

If you set yourself as unavailable, or start a lone-working check-in, the place, times and check-ins are recorded. A missed check-in raises a call for help. Location is read only if you tick “Share my location”: once when you start and at each check-in, only the latest kept, shown only if you miss one, and deleted when you finish.

Bulletins to staff phones

If you answer a question in a bulletin, your answer is kept and the sender and your school’s site admins can see it with your name. If you press Got it, only you can see that. Hiding an item stays on your phone. Your school may put you in staff groups by job (such as Teachers or Office staff) so a message can go to some staff; a message sent to groups or named people is seen only by them, the sender and your school’s admins, and the Ledger records who it went to. If a bulletin is marked important or asks a question and you have not opened or answered it about 15 minutes after it was sent, we send you one email saying who sent it and that it is waiting in the app. The email never contains the bulletin’s words, and you are not emailed while you are marked away.

Supply and visiting staff

With a day code: the first name they type and browser details for delivering alerts, until the code expires at the end of that school day.

Trusts

Staff a trust names can see live alerts, open calls for help, phone readiness and last practices across its schools. They cannot raise or stand down an alert in another school.

Room updates

If a classroom is linked to you as its teacher, the app may send you a school-day morning note when the room is too cold, warm, dry or humid, and a Friday summary of how calm its lessons were against the week before. Only you see them, and they are never used to assess or rank anyone. You or your school can switch either off.

Feedback

Anything you choose to send us.

About pupils

None. No pupil names, identifiers, attendance, behaviour records or special category data. If a school compares Holly data with its own records, it does so inside its own systems, and no pupil-level data is ever sent to us.

4. Why we can hold it

The school sets the lawful basis as controller and should confirm it in its own records. Normally:

• Room measurements are not personal data.
• Staff accounts, sign-in (including a Microsoft or Google link), devices and day codes: public task, or legitimate interests in running the school safely.
• Alerts, safety replies, calls for help and lone working: public task, and vital interests when someone may be at risk.
• Room updates: legitimate interests in helping a teacher keep their classroom comfortable and calm.
• Audit records: legal obligation and legitimate interests in security.
• Feedback: consent, which can be withdrawn at any time.

5. How long we keep it

Individual readings

At least 90 days. Deleted a calendar month at a time, so often a little longer.

Hourly summaries

400 days.

Daily room summaries

Kept indefinitely. They contain no individual measurement.

Incidents, drills and safety replies

7 years, frozen at the time.

Calls for help and lone working

Life of the contract.

Staff accounts, sign-in links, phones and computers

Life of the contract, then 6 months.

Availability setting

Until it lapses or you change it.

Room updates

90 days.

Supply and visitor day codes

30 days.

Audit log

7 years.

Feedback

Life of the contract, then 12 months. May be anonymised and kept longer.

When a contract ends, the school can ask for its data back or deleted. Otherwise we delete it within 90 days, except the audit log and frozen incident records, which are kept for the periods above.

6. Who else is involved

We use these organisations to run the service. Each is under written contract and acts only on our instructions. We do not sell data, and there is no advertising, tracking or analytics on the school portal.

Supabase · UK (London)

Database, sign-in, live updates and file storage.

Netcup · Germany

Server connecting Holly devices, and holding an encrypted standby copy of the alert list so alerts still go out if our main database cannot be reached.

Vercel · US

Hosting for the school portal.

Twilio · US

Alert texts and calls to named staff, and the alert-raising phone number.

Resend · US

Emails such as invitations, alert escalations and reports.

Anthropic · US

Writes the weekly plain-English summary from room figures only. No staff or pupil data.

ElevenLabs · US

Generates the voice Holly uses on the phone, and turns announcements that staff choose to send into speech. It receives only the words of the announcement.

Apple, Google and Microsoft · US

Deliver alert notifications and room updates to the Classroom Sounds app and browser extensions. They are never told the school, what happened, the room or who you are.

OpenStreetMap · UK

Draws the small map under a shared location. It never receives a name, the school or the call.

GitHub · US

Source code and firmware builds.

All school and staff information is held in the UK. US services receive only what they need, such as a name and email to send an email, or a mobile number to send a text. Transfers are covered by the UK International Data Transfer Addendum.

Signing in with Microsoft or Google is not one of these. If you choose it, Microsoft or Google confirms who you are under your school's own agreement with them, as it does for your school email. We only ask them to sign you in, and receive only the details listed in section 3.

7. Keeping it safe

• Two-factor sign-in is on for every school portal account and cannot be turned off. The phone app asks for your password, then opens with your phone's own fingerprint, face or lock, and locks itself after a minute away. We email you if your account is signed in on a phone we have not seen before. During a live incident, nobody already signed in is asked for a code or locked out.
• Raising or standing down an alert always needs your alert PIN, or the fingerprint or face check on a phone set up for it. A password on its own can do neither.
• Raising an alert by phone needs a number the school has registered, so a school can raise an alert even if nobody can sign in. A staff mobile also needs that person's PIN. A school landline registered for alerts works without a PIN, so it should be one in a staff-only area.
• Signing in with Microsoft or Google works only for the exact address your school invited, so nobody can join a school this way without an invitation, and on the portal the authenticator code is still asked for. When someone leaves, the school should remove them in Holly too: a phone or computer already signed in stays signed in until it does.
• Every school's data is fenced off inside the database itself, so one school cannot read another's records.
• Every change is checked and logged. Browsers never write to the database directly.
• All traffic is encrypted, and every device has its own credentials.
• A standby copy of the alert list (names, work emails, registered phone numbers, phone push addresses, who may raise an alert, and PINs as a hash only) is kept encrypted on our server in Germany, replaced every five minutes, and used only if our main database cannot be reached.
• The portal signs you out after ten minutes of inactivity, except during a live incident.

8. Your rights

Because the school is the controller, please make requests to your school first. It will ask us for whatever it needs, and we will respond without undue delay.

Staff can ask for a copy of their data, have it corrected, have it erased when no longer needed, restrict or object to its use, and withdraw consent where consent was the basis. No pupil data rights arise, because no pupil data is held.

If you are unhappy with how your information has been handled, you can complain to your school, to us, or to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

9. Contact

Email hello@classroomsounds.com or call 01905 905415.