# Privacy What Nalda holds, why, who else can see it, and how a family gets it back or gets it deleted. Last updated 21 August 2026. > Not ready to sign. This document is still missing: > - a registered address > - an address for privacy questions > - a review by a qualified lawyer ## The short version Nalda answers families on behalf of a school, from that school's own published content. The school decides what the assistant knows and what it is allowed to say. Nalda holds what a family typed and what a family volunteered, and nothing else. Nalda holds no student records. Not grades, not attendance, not discipline, not health, not application files. There is no field that stores them. ## Who is responsible for what The school decides why family data is collected and what happens to it. In data protection language the school is the controller and Nalda is the processor. Nalda acts on the school's instructions, which are the settings the school chooses in the product and the agreement it signs. That means a family asking for a copy of their data, or asking for it to be deleted, asks the school. The school can do both from inside Nalda, without contacting us, on the same day. ## What we hold - Content a school already publishes. Its website, its handbooks, its calendars, its own answers. This is the material the assistant answers from. - What a family typed. The questions asked in the widget, on the school's assistant page, or in an email sent to the school's Nalda address, and the replies the assistant gave. - Contact details a family volunteered. A name, an email address, sometimes a phone number, sometimes a child's year group. Given by the family, in the conversation, so the school can write back. - Bookings. The tour or call a family chose, and the time. - Staff accounts. The name, work email and permission role of the people at the school who use the product. ## What we do not hold Student records of any kind. There is no field for a grade, a mark, an attendance record or a health note. A school may connect its Blackbaud student information system, and that connection may ask for three lists and nothing else: the school's divisions, the grades it takes, and its term dates. Payment details of families. Nalda takes no money from families. The school's own subscription is paid through Stripe, which holds those card details, not us. ## How long we keep it Conversations, and everything that is part of a conversation, are kept for a period the school chooses and then deleted automatically. The default is 24 months. A school can set anything from one month to ten years, and the setting is visible to its staff on the privacy page inside the product. The family record itself, meaning the contact details a family volunteered, is kept until the school deletes it or a family asks for it to be deleted. It is the school's own record of somebody who got in touch, and a clock is the wrong thing to decide when a school stops holding it. The automatic deletion runs on a schedule, it records every run, and the school can see when it last ran. ## Getting a copy, and getting it deleted A family asks the school. Any member of staff with admin permission can produce a complete copy of everything Nalda holds about that household, as a readable file, in one click. The same page has a delete button. Delete means delete. The family record, every conversation, every message in both directions, every draft written for staff, every email, every queued reminder, every announcement sent to them and every booking are removed from the database. They are not marked hidden and they are not moved to an archive. ## What deletion does not remove, and why Several records are append-only by design and are not rewritten when a family is deleted: the ledger, which records that a first contact happened, that an answer was given, that a tour was booked and that a student eventually enrolled; the staff audit log, which records which member of staff did what; and the answer traces, which record the passages retrieved for a question and what the validator did with the draft. None of them is written with a family's name, address or phone number. They hold identifiers, timestamps and outcomes. The identifier is a random reference number that pointed at the family record. Once that record is deleted the reference points at nothing, and nothing can reconstruct it. A record that can be edited after the fact is not a record. So the row stays, the identifier goes dead, and Nalda writes a marker next to it saying that the household behind it was erased, when, and by whom. After every deletion Nalda goes back and searches the database for the family's own address, phone number and names. Every table that carries a household reference is searched in full, the ledger included. The audit log and the answer traces carry none, so those are searched over a sample, and a sample is not a proof. If it finds anything, the deletion is reported as incomplete and says exactly where, rather than reporting success. ## Cookies The widget that runs on a school's website sets no cookies. None, first party or third party. It remembers a conversation using a random token in the browser's own local storage on the school's own domain, so a family who reloads the page does not have to start again. That token is not shared with any other site, is not used for advertising, and can be cleared by clearing site data. The staff application does use a cookie, for one purpose: keeping a signed-in member of staff signed in. There is no advertising or analytics cookie anywhere in the product. ## Who else sees it The companies listed on the subprocessor page, each for a stated purpose. That list is generated from the product's own configuration rather than maintained by hand, so it cannot quietly fall out of date. Nobody else. Nalda does not sell data, does not share it between schools, and does not use one school's families to train anything. ## Google Workspace data, and the limits on it A school may connect its own Google account so the assistant can offer a real time for a visit and read a folder the school chooses. Connecting is optional, a member of staff does it themselves on Google's own consent screen, and the product works without it. Four permissions are requested and no others: reading when a calendar is busy, reading a named calendar, creating and updating the events Nalda books, and read-only access to Drive. Nalda does not request permission to read a school's email, and it does not have it. What that access is used for, and nothing else: showing a family times that are genuinely free, writing the visit onto the calendar once a person has confirmed it, and reading documents from a chosen Drive folder into the school's own answer library so the assistant can cite them. Drive access is read-only, so nothing in a school's Drive is ever changed or deleted by Nalda. Nalda's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Workspace data is never sold, never used for advertising, never used to train any model, and never shared between schools. It is not used for any purpose other than the ones named above. The credential that grants this access is encrypted before it is stored, under a key held outside the database, so a copy of the database on its own does not grant anybody access to a school's calendar or Drive. A school can disconnect at any time from its own settings, or revoke Nalda directly in its Google account, and either one ends the access immediately. ## Model providers The assistant drafts answers using language models run by the providers named on the subprocessor page. What is sent to them when a family asks a question is the question exactly as they typed it, and the passages of the school's own published content retrieved to answer it. A separate job that writes staff summaries also sends the family's label, which is the parent names on the household record, or the household's email address when no name is held. Nothing else from the record is added, and the text a family types is passed through unchanged, so anything they write in it reaches the provider too. Nalda does not use school or family content to train models. The providers are used through their business terms. ## Where it is In the United States. The application runs in a United States region and the database and every provider named on the subprocessor page are United States based. ## Changes When this page changes materially, schools using Nalda are told before the change takes effect. The date at the top is the last change.