Privacy Policy
Last updated: 29 July 2026
This is a draft policy prepared to describe how eOpinion actually works. It has not been reviewed by a solicitor. Please have it checked before relying on it, particularly the sections on children's data, given pupils may use the service.
Who we are
eOpinion is operated by Hutch Media Group Ltd, a company registered in England and Wales, of 160 Kemp House, City Road, London, EC1V 2NX. For any question about this policy or your data, contact hello@eopinion.org.
What we collect
We collect different data depending on how you use eOpinion:
If you sign up a school, college or university:the organisation's name, chosen link, notification email, an optional bio, an optional logo and header image, and the admin's name, email and phone number.
If you submit a suggestion through a school's page: the message itself, the role you selected (pupil, parent, teacher, staff or other), and, only if you choose to provide them, a name and email address. Submissions are anonymous by default and we do not require a name.
If you pay for a subscription: billing is handled entirely by Stripe. We never see or store card details. We hold only the subscription status, currency and billing interval Stripe reports back to us.
Technical data: we keep a short-lived, hashed record of the IP address behind a suggestion submission, used only to prevent spam and abuse. The IP address itself is never stored, only a one-way hash of it.
Why we collect it
To provide the service you or your school has signed up for (performance of a contract), to bill for it (contract and legal obligation), to notify a school when a new suggestion arrives (legitimate interest in making the service useful), and to prevent abuse of the public submission form (legitimate interest in keeping the service safe to use).
Children's data
eOpinion is built for use in schools, and some suggestions may be submitted by pupils under 18, including by design without a name attached. We keep the fields collected to a minimum for this reason, do not use submission content for any purpose beyond delivering it to the school, and do not knowingly build profiles of individual pupils. A school using eOpinion is responsible for how it handles the suggestions it receives, in the same way it is responsible for any other communication channel it operates.
Who we share data with
We use a small number of processors to run the service, each bound by their own data protection terms:
Supabase (database, authentication and file storage), Stripe (payment processing), and Resend(sending the "new suggestion" notification email). We do not sell data, and we do not share submission content with anyone beyond the school it was sent to.
Where data is stored
Our database is hosted in the EU (Ireland). Some processors above may process data outside the UK/EEA as part of their own infrastructure; where they do, they provide appropriate safeguards such as Standard Contractual Clauses.
How long we keep it
We keep organisation and submission data for as long as the school's subscription is active, and for a reasonable period afterwards in case of billing queries, after which it is deleted. You can ask us to delete specific data sooner, see below.
Your rights
Under UK GDPR you have the right to ask what data we hold about you, to correct it, to have it deleted, to object to or restrict certain processing, and to receive a copy in a portable format. Contact hello@eopinion.org to exercise any of these. You can also complain to the Information Commissioner's Office (ico.org.uk) if you think we have not handled your data properly.
Changes to this policy
If we make a material change to this policy, we will update the date at the top of this page.