Privacy Policy

The Digital School Leader

Last updated: 8 November 2026

1. About this website

The Digital School Leader (schoolleadershiphq.com) is an independent education publication operated by John Wright.

The website provides articles, educational resources, information about technology and school leadership, and a directory of educational software. Visitors can subscribe to newsletters, create free accounts, download resources, review software and save tools to personal shortlists.

We aim to collect only the personal information reasonably necessary to provide these services, communicate with visitors and maintain a safe, reliable website.

This policy explains what information we collect, why we collect it, how it is used and stored, and the rights you have in relation to your personal information.

Data controller: John Wright, operating The Digital School Leader.

Privacy enquiries: Please use our contact form.

This policy applies to schoolleadershiphq.com and its associated services.

2. Personal information we collect

The information we collect depends on how you use the website.

Website accounts

When you create an account, we collect and store:

• Your email address, which is used as your username.
• Your name and any profile information you choose to provide.
• A securely hashed version of your password, if you register using email and password.
• Account creation and last sign-in information.
• Information needed to authenticate your session and maintain account security.
• Your newsletter subscription preferences, if applicable.

Passwords are not stored in plain text.

You may also choose to sign in using Google. If you do, Google provides information needed to authenticate your account, including your verified email address, display name and a unique account identifier.

Member profiles are private and are not available for other visitors to browse.

Newsletter subscriptions

You can subscribe to our newsletter without creating an account, or choose to subscribe when registering or through your account settings.

We may collect:

• Your name and email address.
• Your chosen newsletter interests or topic preferences.
• The page or form through which you subscribed.
• Subscription and confirmation dates.
• Your subscription status and relevant delivery records.
• Information about newsletter opens and link clicks.

Newsletter registration uses double opt-in, meaning you must confirm your email address before your subscription becomes active.

Subscribing is optional. Creating a website account does not automatically subscribe you.

Software directory

Registered members can interact with the educational software directory.

Depending on the features you use, we may store:

• Software reviews, ratings and sub-ratings.
• Information you provide about your experience with a product.
• Professional context that you choose to include with a review.
• Disclosures of any relationships with software suppliers.
• Tools saved to personal shortlists.
• Software products you indicate that you use.
• Reports you submit about inappropriate or inaccurate reviews.

Your personal shortlists and individual "We use this" endorsements are private.

Public reviews

When submitting a software review, you can choose whether your real name or a general professional description is displayed.

Reviews are published immediately after submission. They may be read by other visitors and indexed by external search engines.

Other members can report reviews they believe are inappropriate, misleading or inaccurate. Reports are handled confidentially by the site administrator. The identity of the person submitting a report is not disclosed to other users.

Reported reviews may be removed or restored following moderation.

You can request changes to or removal of your published review through our contact form.

Resource downloads

Some resources require a free member account.

When you download one of these resources, we record your account identifier, the resource downloaded and the date and time of access.

These records are used to operate the resource service and identify potential misuse. There are currently no download quotas.

Download records are not displayed within member profiles.

Contact forms and directory suggestions

When you contact us or suggest a software listing or correction, we may collect:

• Your name and email address.
• Your organisation, where provided.
• The category or subject of your enquiry.
• Your message and any supporting information.
• Details of software products or proposed changes.

Contact details supplied with directory suggestions are kept private. Only relevant information about the software product may be published following review.

Please do not include unnecessary personal information about yourself or others.

3. How we use your information

We use personal information for the following purposes:

Where we rely on legitimate interests, we consider the necessity of the processing and its impact on individuals' rights and freedoms.

Where we rely on consent, you may withdraw that consent at any time.

Information required to establish and operate an account must be provided if you wish to use account-only features. Other information, such as optional profile details and newsletter preferences, is voluntary.

We do not sell personal information or use it for behavioural advertising.

4. Newsletters and email communications

Our newsletters primarily contain articles, resources, educational technology information and updates from The Digital School Leader.

Occasionally, they may also include information about other relevant projects, products or services, including promotions from third parties.

We do not provide subscriber contact details to third-party advertisers or organisations whose products are mentioned.

Newsletter tracking

Our newsletters are delivered through Brevo.

We use standard email tracking technologies to measure newsletter engagement. These include:

• Tracking pixels that can indicate when an email has been opened.
• Tracked links that record when a link within a newsletter is selected.

These technologies may record individual engagement events associated with a subscriber's email address. We use the resulting information primarily to understand overall readership, identify useful content and improve future newsletters.

Subscribers are informed about tracking during the signup process.

There is currently no separate facility to disable newsletter tracking while remaining subscribed. You can stop receiving future newsletters, and therefore future newsletter tracking, by unsubscribing.

Unsubscribing

Every newsletter contains an unsubscribe link.

Registered members can also manage their newsletter subscription through their account settings.

Newsletter-only subscribers who unsubscribe have their subscription details removed from our systems, including their contact record and subscription history.

For registered members, newsletter preferences and subscription history may remain associated with their account until the account is deleted.

5. Cookies and browser storage

The website does not use advertising cookies, cross-site profiling cookies, or third-party web analytics services such as Google Analytics.

We use limited browser storage and essential or functional technologies.

Functional cookies

The website uses a first-party cookie called sidebar_state within its administration interface. It remembers whether the navigation sidebar is open or collapsed.

This cookie is retained for seven days.

Authentication

When members sign in, authentication session tokens are stored in the browser's local storage rather than traditional authentication cookies.

These tokens allow the website to recognise an authenticated session and maintain access to member features.

Security services

Cloudflare, including Cloudflare Turnstile, helps protect the website against spam, automated submissions and malicious traffic.

Cloudflare may use necessary security cookies, such as __cf_bm, and temporary verification information to distinguish legitimate visitors from automated activity.

These technologies are used for security rather than advertising or marketing.

Website analytics

We do not use third-party website analytics or tracking pixels to monitor individual visitors across websites.

Any general website performance statistics are based on aggregated technical information.

Newsletter tracking, described separately above, is not part of our website analytics.

6. Third-party service providers

We use a limited number of external providers to operate the website.

Lovable Cloud

Provides our managed backend, database, authentication services and resource storage. It processes account information, password hashes, profile data, directory interactions, newsletter records and resource download information.

Brevo

Provides transactional email and newsletter services. It processes subscriber contact information, newsletter preferences, delivery records and email engagement information. It also delivers essential account notifications, including password reset and account deletion emails.

Cloudflare

Provides website delivery infrastructure, security services and spam protection. It may process IP addresses, browser information, technical request information and bot-verification data.

Google

Provides an optional sign-in method. When you choose Google sign-in, we receive the account information needed to identify and authenticate you.

We use these providers to deliver the functions described in this policy. We do not share individual directory usage information with software suppliers for their independent marketing purposes.

7. Where information is stored

Our principal database and user-account information are hosted within the European Union, in Ireland, through Lovable Cloud.

Brevo's principal email infrastructure is hosted within the European Union, including France and Germany.

Cloudflare operates a global network, including infrastructure within the United Kingdom and Europe.

Although our primary database and email infrastructure are based in the EU, some service providers or their subprocessors may process information in other countries.

Where personal information is transferred internationally and data protection law requires additional safeguards, we use or rely on appropriate arrangements provided by the relevant service providers, such as applicable adequacy regulations or contractual transfer safeguards.

8. How long information is retained

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected.

Member accounts

Account credentials, profile information and associated activity records are retained while the account remains open, unless deletion is requested or another applicable requirement justifies a different period.

Newsletter subscriptions

Subscriber records are retained while the subscription remains active.

For newsletter-only subscribers, unsubscribing removes their subscription information. For registered members, subscription history is retained while the account remains open.

Contact forms

Routine enquiries and notifications are normally deleted once processed or resolved.

Email copies delivered to the administrator are normally deleted within five working days of processing.

Stored correspondence may be retained longer where there is a continuing administrative, operational or legal reason. Older submissions are reviewed periodically and deleted when no longer required.

Published reviews

Published reviews remain available while relevant to an active software listing, unless removed through moderation or following an appropriate request.

When a software listing is permanently deleted, its associated reviews are also deleted.

Moderation reports

Reports and associated moderation records are retained according to the circumstances of each case, including any continuing need to investigate abuse or resolve disputes.

Security logs

Limited technical connection information, such as IP addresses, browser types and access timestamps, is processed for security and abuse prevention.

Operational security logs are typically retained for between 24 hours and five days, and no longer than 30 days under the applicable operational retention arrangements.

9. Deleting your account

Members can delete their accounts through their account settings.

For security, deletion requires confirmation. Members using password-based authentication must also re-enter their password.

Once confirmed, deletion is performed immediately against the live database.

The process permanently removes:

• Account and authentication records.
• Personal profile information.
• Saved software shortlists.
• "We use this" endorsements.
• Resource download records.
• Associated contact submissions stored in the website database.
• Associated newsletter and account records, subject to any information required to be retained by law.

Previously published reviews

Published reviews are handled differently.

When an account is deleted, the reviewer's account association is permanently removed and replaced with an unrelated identifier. Any publicly displayed personal name is replaced by a general professional description.

The review text, ratings and sub-ratings remain available to other visitors.

We aim to ensure that retained reviews are no longer identifiable. However, where review text itself contains information that could identify an individual, further action may be necessary.

Backup copies

Personal information removed from the live database may remain temporarily within automated system backups for up to 14 days.

These backup copies are subsequently overwritten or purged.

If a system backup must be restored, previously completed deletion requests are reapplied.

A confirmation email is sent following account deletion.

10. Security and misuse prevention

We use reasonable technical and organisational safeguards to protect personal information.

These include managed authentication, securely hashed passwords, account access controls, website security protections, and measures to prevent automated abuse.

The website applies limits to certain activities, including review submissions.

Suspected misuse may result in restrictions or account suspension following administrator review. Account suspension decisions are not made solely by an automated decision-making system.

Suspected personal data breaches are investigated and documented. Where required by applicable law, we notify the relevant supervisory authority and affected individuals.

No internet service can guarantee absolute security.

11. Your data protection rights

Under UK GDPR, you have rights relating to the personal information held about you. Depending on the circumstances, these include:

• Access: Request a copy of your personal information.
• Correction: Ask us to correct inaccurate or incomplete information.
• Erasure: Request deletion of personal information where the right applies.
• Restriction: Ask us to restrict certain processing activities.
• Objection: Object to processing based on legitimate interests.
• Portability: Request certain personal information in a structured, commonly used format.
• Withdrawal of consent: Withdraw consent where consent is the lawful basis for processing.

You have the right to object at any time to the use of your personal information for direct marketing.

Members can delete their accounts through account settings. Other requests can be made through our contact form.

Where you hold an account, please use the email address associated with it when making a request. We may ask for additional information where reasonably necessary to verify identity before disclosing or changing personal information.

If you no longer have access to your registered email address, you may still contact us. We will consider whether your identity can be adequately verified through another appropriate method.

Requests are normally handled within one month, subject to applicable legal provisions.

You may also complain to the UK Information Commissioner's Office (ICO):

www.ico.org.uk

Where EU data protection law applies, you may also have the right to complain to a relevant EU data protection supervisory authority.

12. Children and sensitive information

The Digital School Leader is primarily intended for education professionals and other adults aged 18 and over.

The website does not contain age-restricted content, and registration does not currently include age verification.

The website is not intended to collect pupil records, safeguarding information, confidential school records or other sensitive educational information.

Please do not submit information that identifies individual pupils, safeguarding concerns or confidential staff information through contact forms, reviews or other website features.

If such information is submitted inadvertently, please contact us so that appropriate action can be taken.

13. External websites

Our articles and directory listings may link to external websites.

Following an external link takes you to a service that operates independently of The Digital School Leader. That organisation's privacy policy and data protection practices will apply to your use of its website.

We do not currently embed third-party video or social media content within our pages.

14. Changes to this policy

We review this privacy policy as the website develops and as relevant legal requirements change.

Minor corrections and clarifications may be published without individual notification.

Where a significant change affects how registered members' personal information is collected, used or shared, we will notify affected members by email where appropriate.

The latest version of this policy will always be available on this page.

15. Contact

For questions about this privacy policy, requests relating to your personal information or concerns about data protection, please use our:

Contact form

Data controller: John Wright, The Digital School Leader.