Privacy Policy

Draft for review · Last updated August 2026. This document describes how Aurelia is designed to work. It is a working draft and should be reviewed by qualified legal counsel before public launch.

Who we are

Aurelia operates a protected platform for young creators, their guardians, teachers, schools and, from age 16, alumni. Throughout this policy, "we" and "Aurelia" refer to the organisation responsible for operating the platform and deciding how personal data is used within it.

What data we collect and why

We collect the data needed to run a safe, verified platform, and no more than that. This includes:

• Account and identity information for children, guardians, teachers and administrators, used to create and verify accounts.
• Work that a child creates on the platform, including drafts, media and submissions, used to provide the creative and learning features themselves.
• Guardian consent and approval records, used to demonstrate that publication and sharing decisions were properly authorised.
• Verification records from teachers and schools, used to support the Achievement Passport.
• Safeguarding reports and related case notes, used to investigate and respond to concerns.
• Basic technical and usage information, used to keep the platform secure and functioning correctly.

Lawful bases and consent for children

Where we process a child's personal data, we rely on the involvement and consent of a parent or guardian in addition to any other applicable lawful basis, such as the performance of our contract with the family or school, or a legitimate safeguarding interest. A guardian must approve a child's account, and no child's work is published or shared beyond the family without guardian approval.

Guardian rights

Guardians can view what information is held about their child, review and withdraw consent for publication or sharing, request corrections, and request deletion of their child's account and associated data, subject to any safeguarding or legal records we are required to retain.

How long we keep data

We keep personal data only for as long as it is needed for the purpose it was collected for. Account and creative data is retained while an account is active and for a limited period afterwards to allow reactivation or guardian requests. Safeguarding records are retained for longer where necessary to meet our safeguarding responsibilities. Retention periods are enforced through defined rules rather than left to individual discretion.

Who data is shared with

We do not sell personal data, and we do not use children's data for advertising. Data is shared only with service providers who help us operate the platform — for example hosting, storage and moderation tooling — under agreements that require them to protect it and use it only for the purpose we specify. Data is shared with a school or organisation only where the account was created through that school or organisation and only to the extent needed for their oversight role. Data may be disclosed to authorities where we are legally required to, or where necessary to protect a child from harm.

Security measures

Access to personal data is controlled through role-based permissions enforced at the database level, so that a person or system can only see the data their role requires. Sensitive actions are logged for review. We apply encryption, access controls and internal review to reduce the risk of unauthorised access, loss or misuse of data.

International transfers

Aurelia serves families, schools and organisations in different locations. Where personal data is transferred across borders — for example because of where our infrastructure or service providers are located — we take steps intended to keep that data protected to a standard consistent with this policy, wherever it is processed.

Data rights and how to exercise them

Depending on your location and role, you may have rights to access, correct, delete or export personal data, and to object to or restrict certain processing. Guardians can exercise these rights on behalf of a child. To make a request, use our contact page, and we will respond as required by applicable law.

Changes to this policy

We may update this policy as the platform evolves or as our legal obligations change. Where a change is significant, we will take reasonable steps to bring it to the attention of guardians and schools before it takes effect.

Contact

Questions about this policy, or requests relating to personal data, can be sent through our contact page.