Privacy notice

WithMe (withme.school) helps schools quickly account for students with an unexplained mark on a lesson register. In this notice, “we”, “us” and “our” mean WithMe.

For anything about privacy or data protection, email privacy@withme.school.

When a school uses WithMe, the school is the controller of the personal information about its staff and students. It decides why and how that information is used. We are its processor: we handle that information only to run WithMe for the school, following its instructions. The commitments we make to schools as a processor are in our terms of use.

We are the controller for a small amount of information we need to run WithMe itself: details of the person who signs a school up, security records such as sign-in attempts, messages you send us and short-lived logs of visits to this website.

If you are a student, parent or member of staff with a question about how a school uses WithMe, please contact the school first. It can explain how it uses WithMe and deal with your request, and we will help it do so.

We don’t collect student photos, dates of birth, addresses or contact details, or any special educational needs, medical or safeguarding records. WithMe only reads from a school’s attendance system. It never changes a register.

• To run lesson checks: finding students with an unexplained mark, notifying the staff whose groups cover them, and showing the school’s attendance team who has been found.
• To keep accounts secure: signing you in, including two-step sign-in and passkeys, and spotting suspicious sign-in attempts.
• To send service emails: invitations, email verification, password resets, security alerts, check notifications when a push notification can’t be delivered, and alerts when a school’s attendance system can’t be reached.
• To keep an audit log of important changes, so schools can see who did what.
• To support you: answering questions, fixing problems and keeping WithMe secure and reliable.

We don’t sell personal information, use it for advertising or use school data to train AI models. WithMe doesn’t make decisions about students. It highlights unexplained marks so that staff can follow them up.

For school data, the school decides the lawful basis. Most schools rely on their public task and legal duties around attendance and safeguarding. Your school’s own privacy notice explains the basis it uses.

For the information we control, we rely on our legitimate interests in running a secure, reliable service and replying to people who contact us. When someone signs a school up, we also rely on taking steps, at the school’s request, to enter into an agreement with it.

Push notifications and emails about a lesson check give only the lesson and the number of students not yet accounted for, for example “Lesson 2 check: 6 students not yet accounted for”. They never name a student. Names are shown only after you sign in.

In Settings you can also hide the lesson and number from your lock screen.

We use these providers to run WithMe. Each one handles personal information only on our instructions, under a written data processing agreement.

Where a provider may access personal information from outside the UK, we rely on UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework, or on the UK International Data Transfer Agreement or Addendum.

We give schools at least 30 days’ notice before adding or replacing a provider that handles school data.

A school’s attendance system, such as Arbor, is not one of our providers. It is the school’s own system. We connect to it only with the school’s permission, and only to read data.

• All traffic is encrypted with HTTPS, and the database is encrypted at rest.
• Passwords and recovery codes are stored only as one-way hashes, never in plain text.
• Authenticator app secrets and attendance system credentials are encrypted with AES-256-GCM.
• Two-step sign-in works with an authenticator app or a passkey, and schools can make it compulsory.
• Each school’s data is kept separate. Staff can see only the schools they belong to.
• Important changes are recorded in an audit log that school administrators can review.

If a breach affects a school’s data, we will tell the school within 48 hours of finding out, so it can meet its own duties. Where we are required to, we will also report it to the Information Commissioner’s Office.

WithMe uses only what it needs to sign you in. We don’t use analytics, advertising or tracking cookies, so there is nothing to accept or decline.

The mobile app keeps your sign-in in your phone’s secure storage (the iOS Keychain or Android Keystore).

Under UK data protection law you can ask to see the personal information held about you, have it corrected or deleted, restrict or object to how it is used, and in some cases receive a copy in a portable format.

• For school data, contact your school first, as it is the controller. If you contact us instead, we will pass your request to the school and help it respond.
• For information we control, email privacy@withme.school. We will reply within one month.

If you are unhappy with how your information has been handled, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Students never use WithMe and don’t have accounts. Their information comes only from their school, which is responsible for telling students and parents how it uses WithMe.

We will update this notice when WithMe changes. For significant changes, we will email school administrators before the changes take effect. The date at the top of this page shows when it was last updated.