Privacy Policy

This policy explains how Edoardo Chidichimo and Raoul Lee, trading as Vox-LLM (“Vox”, “we”, “us”), collects and uses personal data when you use schoolexclusion.co.uk. We are the data controllers. Vox is run as a general partnership of the named individuals below, not a company.

Vox helps parents and carers in the UK understand the school suspension and permanent exclusion process. To do this we necessarily process information about a child and, in places, sensitive information. Please read this policy carefully before using Vox Analysis or the chat.

1. Who we are and how to contact us

Controllers: Edoardo Chidichimo and Raoul Lee, trading as Vox-LLM (“Vox”) — a general partnership.
Address: Magdalen College, High Street, Oxford, OX1 4AU
Contact for privacy questions and data-rights requests: contact [at] vox-llm.com

2. The personal data we collect

Account and technical data

• Your email address (used to sign in and to send your documents).
• Your IP address and request metadata (used transiently for rate-limiting, security and abuse prevention).
• A single strictly-necessary session cookie (see section 9).
• Your account status (how many free questions you have used and whether you have paid for the chat unlock or for Vox Analysis).

Chat (Vox Helper)

The questions and messages you type. These may contain personal data about you and your child. They are sent to our AI provider to generate an answer in real time and are not stored in our database.

Vox Analysis

The information you enter into the Vox Analysis form and any follow-up answers, which may include: the child’s name; your name as the parent/carer; the school’s name; exclusion and letter dates; the content of the exclusion letter; the school’s account of events and its evidence; the child’s account; witness details; whether the child has special educational needs or disabilities (SEND) or an Education, Health and Care (EHC) plan and related details; whether the child is from an ethnic minority; previous suspensions; family and behavioural background; and any other information you choose to provide.

Payment data

Payments are processed by Stripe. We do not see or store your card details. We receive confirmation of payment and the email address associated with it.

3. Children’s data and special category data

Vox Analysis is designed to be used by a parent or other person with parental responsibility, on behalf of a child. By using it you confirm you hold parental responsibility for the child whose information you submit, or are otherwise lawfully entitled to provide it.

Some of the information you may provide is special category data under Article 9 UK GDPR — in particular information revealing the child’s racial or ethnic origin, and information about SEND/disability or health. We process this data only on the basis of your explicit consent, given when you choose to submit it, and only to produce the guidance or document you have asked for. You can withdraw consent at any time (see section 8); this will not affect processing already carried out.

4. Why we use your data and our lawful bases

• To provide Vox Analysis and the paid chat — performance of our contract with you (Article 6(1)(b)); for special category data, your explicit consent (Article 9(2)(a)).
• To provide the free chat — your consent (Article 6(1)(a)), withdrawable at any time by stopping use.
• Sign-in, security and abuse prevention — our legitimate interests in keeping the service secure (Article 6(1)(f)).
• Taking payment and keeping tax/accounting records — performance of a contract and our legal obligations (Article 6(1)(b) and (c)).

We do not use your data for advertising, we do not sell it, and we do not use your case information to train AI models.

5. Who we share data with

We use the following processors and service providers, who act on our instructions under data-processing terms:

• Anthropic — provides the AI that generates chat answers and Vox Analysis documents. Your inputs are sent to Anthropic to produce a response.
• Resend — delivers sign-in codes and emails your generated document to you.
• Stripe — processes payments.
• Railway — hosts the application and database.

We may also disclose data where required by law or to establish, exercise or defend legal claims.

6. International transfers

Some of these providers process data outside the UK, including in the United States. Where that happens we rely on appropriate safeguards as required by UK data protection law — in particular the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses as incorporated into our providers’ data-processing terms — together with a transfer risk assessment. You can ask us for more detail using the contact above.

7. How long we keep data

• Account email and status: kept while your account is active and deleted on request (see section 8).
• Sign-in codes: short-lived and become unusable shortly after being issued.
• Chat messages and Vox Analysis inputs: not stored in our database. They are processed transiently to generate your response/document, which is then emailed to you. The copy in your inbox is under your control. Our AI and email providers retain data for limited periods under their own policies.
• Payment and tax records: retained by Stripe under its policy, and by us for 6 years as required by UK tax law.
• Server logs: email addresses are masked in our logs; logs are kept only for a limited period for security.

8. Your rights

Under UK data protection law you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing;
• data portability;
• withdraw consent at any time; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Vox produces guidance and draft documents; you decide whether and how to use them.

To exercise any right, email contact [at] vox-llm.com. We will respond within one month. You can also complain to the Information Commissioner’s Office (ICO), the UK regulator, at ico.org.uk or on 0303 123 1113, though we’d ask you to contact us first.

9. Cookies

We use a single strictly necessary cookie, vox_session, to keep you signed in. It is essential to the service, so no consent banner is required for it. We do not use analytics, advertising or tracking cookies. When you pay, Stripe’s checkout pages may set their own cookies governed by Stripe’s privacy policy.

10. Security

We protect data with HTTPS/TLS, strict transport security, signed HTTP-only session cookies, rate limiting, masking of email addresses in logs and access controls. No online service can be guaranteed completely secure, and email is not an encrypted channel; please bear this in mind when handling the document we send you.

11. Changes

We may update this policy. The “last updated” date above shows when it last changed; material changes will be highlighted on the site.