A record about a child deserves care
Plain English first, because this is your child's life we are holding. Last updated 7 August 2026.
Who we are
Individa is the data controller for the information described here. Write to hello@individa.app for anything in this notice, including a request to exercise your rights.
What we hold
Your name and email, your plan, the children you add and their age and location if you give them, the moments you log, and the readings, reports and briefs Individa generates from those moments. If you choose to record health or neurodevelopmental context, that sits in a separate table from the learning record and is only entered with your explicit consent.
Why we hold it, and on what basis
Account details and the learning record are processed to deliver the service you asked for, which is contractual necessity. Product improvement, security and abuse prevention rest on our legitimate interests, balanced against your family's privacy, which is why anything a reviewer sees is pseudonymised. Health context is special-category data and is processed only on your explicit consent, which you can withdraw at any time by clearing those fields.
Who can see it
You. Access rules at the database level mean a record can only be read by the account that owns it. A brief link you create yourself is read-only, expiring and revocable, and carries health context only if you separately allow it. Our own team can see pseudonymised readings for quality checking: children appear as a letter and an age band, names, addresses and contact details are stripped, and health flags are not shown at all.
AI processing
When you log a moment, the text is sent to a hosted AI model to be read back and mapped to competencies. It is not used to train the provider's models. Readings we judge correct may be kept as worked examples to improve future readings, and only after names and other direct identifiers have been removed. There is no automated decision-making that produces a legal or similarly significant effect.
Children's data
Accounts are held by adults. Children do not sign in and are not users of the service. We collect the minimum needed to build a useful record, we never sell, rent or share it for advertising, and you decide what goes in. Individa is not a diagnostic, medical, legal or educational-compliance service.
How long we keep it
For as long as your account is open. Delete your account from the Account page and your login, children, moments, reports and share links are removed. Readings previously approved for quality survive only in anonymised form, with no link to you or your child. Anything else you ask us to delete, we delete.
Your rights
You can access, correct, erase, restrict or object to our processing, and take your data elsewhere. Download and deletion are self-service on the Account page, and take effect immediately. If you would rather we handled it, email us and we will respond within one month. You can also complain to the Information Commissioner's Office.
Who processes data on our behalf
Hosting and application delivery through Lovable, database and authentication through Supabase, and AI processing through the Lovable AI Gateway to Google's Gemini models. Data is processed in the UK, the EEA and the United States under appropriate safeguards. We will tell you before adding a processor that changes this picture.
Security
Access is enforced per account at the database layer rather than in the interface alone, health context is stored separately, share links expire and can be revoked, and admin actions are logged. No system is perfect, so tell us at once if you think something is wrong.
Cookies
We set only what is needed to keep you signed in. No advertising or third-party tracking cookies.
Changes
This is a beta and this notice will be expanded before general release. If we change anything material we will write to you rather than quietly update the page.
Questions: hello@individa.app