01Who we are
InspectorWho is provided by Early Tree Limited, a company registered in England and Wales (company number 14693946), whose registered office is at 8 Oak Field, Brayton, Selby, North Yorkshire, YO8 9QZ, United Kingdom. In this policy, “we”, “us” and “our” mean Early Tree Limited.
We are the controller of the personal data described in this policy, which means we decide how and why it is used. We are registered with the Information Commissioner's Office (ICO) under registration number ZB551264.
This policy applies to the InspectorWho website at inspectorwho.com, the InspectorWho web application at beta.inspectorwho.com (and any domain it moves to), the InspectorWho mobile apps for iOS and Android, and the emails we send (together, the “Service”).
Questions about this policy or your personal data can be sent to support@inspectorwho.com. We have not appointed a Data Protection Officer because we are not required to, but that address reaches the person responsible for data protection.
02The short version
- To create an account we need your email address. We also ask for your name, a display name and your role.
- We use your data to run your account, send the sign-in codes, links and alerts you ask for, run the community features and Deep insight, and keep the Service secure.
- We do not sell your data, show advertising, or use advertising or cross-site tracking.
- InspectorWho also contains the names of Ofsted inspectors, taken from reports Ofsted publishes. Section 4 explains how we handle that data and the rights inspectors have.
- You can access, correct or delete your data at any time. See Your data rights and Delete your account.
03Personal data we collect about users
Data you give us
- Account details: your email address and, when you set up your profile, your name, a public display name, your role (for example parent, teacher, early years practitioner, childminder, inspector or researcher) and, optionally, the setting you work at.
- Community content: ratings, comments and replies you post, and reports you make about other content (with any note you add).
- Preferences: the inspectors and settings you follow and whether email alerts are switched on.
- Deep insight: your request for access, the questions you ask and the answers, your access tokens (stored as a secure hash), ratings you give answers, and your credits: the credits you are given or buy, what each answer used and the cost behind it.
- Feedback and support: messages you send through “Tell us”, “Report a problem” or by email, together with the page they relate to.
Data from sign-in providers
If you choose to sign in with Google, Microsoft, Apple, Facebook or X instead of an email link, that provider shares your name, email address and, where available, your profile picture with us, and confirms your email address is verified. We store the tokens the provider issues so that sign-in keeps working. We do not receive your password for that service. What the provider shares is also governed by its own privacy policy.
Data collected automatically
- Session data: when you sign in we record your IP address and browser or device type (user agent) against your session, to keep your account secure and let you recognise your sessions.
- Server and security logs: our servers keep short-lived technical logs of requests (such as IP address, time, page requested and response) to keep the Service running and investigate faults and abuse. Rate limiting uses your IP address or account in memory only.
- Website analytics: on inspectorwho.com we measure page views, the referring site and broad device and browser information using self-hosted analytics, so that we can see which pages are useful. See our cookie policy.
- Activity records: we record which reports alerts were sent for, when you asked for an AI summary of a report, and moderation actions taken on content.
We do not collect special category data (such as health information) about users, and we ask you not to post it.
04People named in Ofsted reports
Ofsted publishes inspection reports under the Open Government Licence. Those reports name the inspectors who carried out each inspection, and sometimes the provider, registered person or senior staff. InspectorWho reads every published report and links each inspection to the inspectors named in it. This section is our notice to those people under Article 14 of the UK GDPR, because we did not collect their data from them directly.
What we hold
- The inspector's name and inspector title (for example HMI or Ofsted Inspector) as printed in published reports.
- The inspections they appear in, and statistics we calculate from those published reports: the number of inspections, the grades awarded compared with national averages for the same type of setting, the areas they inspect, the inspectors they work with, and measures of report language such as tone and length compared with similar reports.
- Ratings and comments that signed-in members post about their experience of an inspection.
Why, and our lawful basis
We rely on legitimate interests (Article 6(1)(f) UK GDPR). Ofsted inspections have significant consequences for schools, nurseries, childminders, care providers and the people who work in them. There is a strong public interest in the transparency and consistency of how inspections are carried out, and education professionals, parents and researchers have a legitimate interest in understanding the published record. We consider this interest is not overridden by inspectors' rights because:
- the data relates only to inspectors' professional role in a public function, and comes from reports Ofsted itself publishes and names them in;
- we do not collect anything about inspectors' private lives, and our community guidelines prohibit it;
- statistics are presented with their context and sample size, and are described as context, not a judgement on any individual;
- every fact links back to the original published report so it can be checked; and
- inspectors can ask us to correct errors and can object to the processing at any time (see below).
Profiling
Calculating statistics about an inspector's published work is a form of profiling. We do not use it to make any decision that has a legal or similarly significant effect on anyone.
Childminders, children and other individuals
Ofsted does not publish the names of childminders or the names of children's homes, and we do not add them: these settings appear under a generated label such as their Ofsted reference number. In Deep insight and its connections to AI assistants we go further, shortening postcodes, rounding locations and hiding owners who are private individuals. We do not intentionally process information about children. Ofsted reports are written so that children cannot be identified. If you believe a page on InspectorWho identifies a child or exposes personal information that should not be public, contact support@inspectorwho.com and we will act quickly.
Your rights if you are named in a report
You have the right to be informed, to access the data we hold about you, to have inaccurate data corrected, and to object to our processing. If you object, we will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms. We will assess every objection individually and tell you the outcome. Contact support@inspectorwho.com. See also Data sources and corrections.
05How we use personal data and our lawful bases
Data protection law requires us to have a lawful basis for each use of personal data. These are ours:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and running your account, signing you in (including email sign-in codes and links) | Account details, sign-in provider data, session data | Contract: necessary to provide the Service you signed up for |
| Sending alerts about inspectors and settings you follow | Email address, follows, alert preference | Contract. You can switch alerts off at any time on your Following page |
| Answering your questions in Deep insight, keeping your conversations so you can return to them, and managing access (including its waiting list) | Your questions, the answers and the conversation history | Contract |
| Issuing and checking personal access tokens for connecting your own AI assistant | A secure hash of each token, its name and when it was last used | Contract |
| Logging Deep insight data lookups to prevent abuse, control costs and investigate faults | Your account ID, the conversation, which lookup ran, the search terms and filters it used (such as a local authority or a setting name), whether it succeeded and how many rows it returned | Legitimate interests: security, fair use and running the Service |
| Running Deep insight early access and credits: handling your request, telling our admins about it and you about the outcome, keeping your balance, charging each answer and adding credits | Name, email address, access request, credit balance and history, the cost of each answer | Contract, and legal obligation for records of any payment |
| Improving Deep insight from the thumbs up or down you give an answer | Your rating and the answer it relates to | Legitimate interests: improving the Service |
| Showing your ratings and comments to other members, with your display name and role | Profile, community content | Contract |
| Moderating community content, handling reports and complaints, and enforcing our terms | Community content, reports, account details | Legitimate interests: keeping the community lawful, safe and fair |
| Responding to feedback, support requests and corrections, and telling you the outcome | Feedback, email address | Legitimate interests: running and improving the Service |
| Keeping the Service secure, preventing fraud and abuse, and fixing faults | Session data, logs, IP address | Legitimate interests: security and integrity of the Service |
| Understanding how the website is used and improving it | Website analytics | Legitimate interests (and your consent if we ever use non-essential cookies) |
| Publishing analysis of Ofsted inspections and inspectors | Data from published Ofsted reports (section 4) | Legitimate interests: transparency of a public function |
| Service messages, such as changes to these policies or your account | Email address | Contract and legitimate interests |
| Complying with the law, responding to lawful requests and defending legal claims | Any relevant data | Legal obligation and legitimate interests |
We will not send you marketing emails unless you have opted in, and every marketing email will include a way to unsubscribe. Where we rely on legitimate interests, you can ask us for more detail about how we balanced them, and you have the right to object.
06Who can see what you post
Ratings, comments and replies are visible to other signed-in members, together with your display name and role. Visitors who are not signed in see only totals (such as the number of ratings), and we ask search engines not to index community content. Your email address and real name are never shown to other members.
Think carefully before posting anything that could identify you or anyone else. Our community guidelines explain what is not allowed.
08International transfers
The Service is hosted on servers in the United Kingdom. Some providers, such as Anthropic and the sign-in providers, process data in the United States or elsewhere. Where personal data is transferred outside the UK, we make sure it is protected by UK adequacy regulations or by appropriate safeguards such as the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for more information about these safeguards.
09How long we keep personal data
| Data | How long |
|---|---|
| Account details, profile, follows and alert preferences | While your account is open. Deleted within 30 days of you deleting your account |
| Sign-in sessions | Until you sign out or the session expires (30 days after last use) |
| Email sign-in codes and links | Codes expire after 10 minutes and links after 15 minutes; each can be used once |
| Deep insight conversations, answer ratings and waiting-list entries | Until you delete the conversation or your account |
| Deep insight credit records | While your account is open. When you delete your account they are anonymised, and kept only as totals for our accounts; records of a payment are kept for 6 years as tax law requires |
| Deep insight access tokens and lookup logs | Tokens until you revoke them or delete your account; lookup logs until you delete your account |
| Ratings and comments | Until you delete them or your account. Removed content may be kept for up to 12 months for moderation and legal claims |
| Reports about content and moderation records | Up to 2 years, then deleted or anonymised |
| Feedback and support messages | Up to 2 years after the matter is closed |
| Server and security logs | Rotated automatically; normally kept for no more than 30 days |
| Backups | Overwritten on a rolling basis within 90 days |
| Data from published Ofsted reports (section 4) | For as long as the report is published by Ofsted and remains relevant to the historical record, unless an objection is upheld |
We may keep data for longer where the law requires it or where it is needed to establish, exercise or defend a legal claim.
10How we keep data secure
We use appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), password-free sign-in with single-use links that expire, secure session cookies, access controls that restrict administrative access to named staff, rate limiting, and separation of authentication data from other data. No system is completely secure. If a personal data breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.
11Your rights
Under the UK GDPR you have the right to:
- be informed about how your data is used (this policy);
- access a copy of your personal data;
- have inaccurate data corrected;
- have your data erased;
- restrict how we use your data;
- receive your data in a portable format, and have it sent to another organisation;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent where we rely on it; and
- not be subject to decisions based solely on automated processing that significantly affect you.
See Your data rights for how to exercise them. You can update your profile and alert settings in the app, and delete your account as described on Delete your account.
12Automated processing and AI
InspectorWho extracts facts from Ofsted reports automatically using rules. Where two independent readings disagree, we may ask an AI model (Anthropic's Claude) to settle the disagreement, and people review difficult cases. On request, AI also writes short plain-English summaries of a report. Measures of a report's tone and themes are calculated by rules from the report's language, without AI.
Deep insight is a chat assistant, powered by Anthropic's Claude, that answers your questions by querying published inspection data. The assistant can only read that public data; it cannot see accounts, email addresses, follows or community content. Your questions and its answers are sent to Anthropic to produce each reply and are stored in your account until you delete them. Our admins can see who has requested access, each member's credit balance and the number and cost of their answers, but not what you asked or the answers you received. Don't include personal information about yourself or anyone else in your questions. Answers are generated automatically and can be wrong, so check anything important against the report itself.
The data Deep insight can read is masked to protect private individuals: childminders appear only as “Childminder in” their local authority with their Ofsted reference number, postcodes are shortened to the district, locations are rounded to about 1 km, and owners who are private individuals are hidden. The assistant is instructed never to identify or locate a private individual. We log each data lookup it makes (which lookup, the search terms and filters it used and how many rows it returned, but not your conversation itself) to prevent abuse and control costs. Search terms are short, but they can repeat words from your question.
You can also create a personal access token and connect the same read-only Deep insight tools to your own AI assistant. When you do, your assistant's provider processes your questions and the data it looks up, under its own terms and privacy policy, not ours. We store only a secure hash of each token, and you can revoke a token at any time.
Apart from the questions you type into Deep insight, none of this uses your account data, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
13Children
The Service is intended for adults. You must be 18 or over to create an account. If we learn that we hold an account for someone under 18, we will close it and delete their data. If you think a child has created an account, contact support@inspectorwho.com.
14Mobile apps
The InspectorWho mobile apps use the same account and the same data as the web app, and this policy applies to them in full. In addition:
- Notifications: if you allow push notifications, we store a notification token for your device so we can send alerts. You can turn notifications off in your device settings at any time.
- No tracking: the apps do not use advertising identifiers (IDFA or GAID), do not track you across other companies' apps or websites, and do not include advertising SDKs.
- Location: the apps do not collect your precise location. Maps show the locations of inspected settings, not yours.
- Diagnostics: we may collect crash reports and basic performance data (such as device model, operating system version and the error) to fix problems. These are not used to identify you.
- Account deletion: you can delete your account and its data as described on Delete your account.
16Changes to this policy
We may update this policy from time to time. We will change the “last updated” date at the top and, if the changes are significant, tell you by email or in the app before they take effect.
17Contact and complaints
If you have a question or concern, please contact us first at support@inspectorwho.com or write to Early Tree Limited, 8 Oak Field, Brayton, Selby, North Yorkshire, YO8 9QZ, United Kingdom. We aim to respond within one month.
You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113.