Privacy notice

Who we are

Trove is a trading name of Danielle Batih, a sole trader based in the United Kingdom, at 12 Chestnut Close, Great Waldingfield, CO10 0RU. We make teaching resources and free tools for primary schools, and we are the data controller for the personal data described here. If you have any questions about your data, email hello@trove.education.

What we collect

• The Wiki and School Calendar work without an account. Some settings, such as your light or dark theme, are saved in your own browser (local storage) on your device. That data stays with you and is not sent to us. The whiteboard tools have their own section below.
• If you buy a resource, we collect your email address so we can send your receipt and download links, and we keep a record of what you bought and your reward points balance. You can buy as a guest: we still set up an account against your email so your downloads are always recoverable.
• If you create or claim an account, we also keep anything you choose to add: your name, your school, the year group you teach, and your email preferences.
• If you download a free resource, we collect your email address so we can send you the file and save it to your account.
• When you claim a free resource you can tick a box to hear when new worksheets come out. It is never ticked for you, and you get the resource either way. If you tick it, we record your email address, the exact wording you agreed to and its version, the time, that it came from a free claim, the order it came with, and the campaign tag you arrived with, if any. Every later change to that preference, turning it off or back on, is recorded the same way. You can turn it off any time in your account.
• Payments are handled by Stripe. You enter your card details on their secure page, not ours, so Trove never sees or stores your card number.
• If you contact us by email, we keep your message and email address so we can reply.
• We use Vercel Web Analytics to count page views. It is cookieless and does not store your IP address, so it cannot identify you.
• If you arrived through one of our posts or adverts, the link carried a short campaign tag (such as "ig-day3"). Your browser keeps it for 30 days. If you buy or claim a resource in that time, the tag is saved with the order and with Stripe's record of the payment, so we can see which posts lead to orders. The tag says which post it was, not who you are.
• If you suggest a tool through the Requests Open form on tools.trove.education, we keep your idea, the year group, your first name, your town if you give it, whether you said we may publish them, and when you sent it. We do not ask for your email address. Your first name, year group and town are only shown publicly if you tick the box to say we may. To stop the form being flooded, it also keeps a one-way coded version of your internet (IP) address for 24 hours, never the address itself.
• If you send a message through “Something not right?” on a tool page at tools.trove.education, we keep your message, which tool it was about, your email address if you choose to give one, and when you sent it. The email address is only used to reply to you. To stop the form being flooded, it also keeps a one-way coded version of your internet (IP) address for 24 hours, never the address itself.
• If you accept it in the cookie banner, the Meta Pixel tells Meta (the company behind Facebook and Instagram) which pages you open, which resources and packs you look at or add to your basket, and when you start checkout or complete an order, with the order's value. We use this to see whether our adverts work. It never runs unless you accept, and we never send Meta your name, email address or payment details. The cookies page has the details.

How we use it

To provide and improve the service, to give you access to what you have bought, to respond to you, and to meet our legal obligations. We use the Meta Pixel only with your consent, which you can withdraw at any time from the cookie settings link at the bottom of every page. Receipts and download links are sent because they are part of your purchase, whatever your email preferences say. We do not sell your personal data.

Why we are allowed to use it

The law asks us to say which reason applies to each use. Selling you resources, sending your receipts and download links, and running your account are part of our contract with you. Keeping sales records is a legal obligation. Error reports, campaign tags and the tool ideas and feedback people send us are in our legitimate interests in running and improving Trove, and we keep them to what is needed. The Meta Pixel, any news emails you opt into, and publishing a requester's name all rely on your consent, which you can withdraw at any time.

How long we keep it

Your account and its download history stay until you ask us to delete them. If you delete your account we remove your personal details, but we keep a record of what was sold and for how much, because tax law requires it. Your details are stripped out of that record. We keep those sales records for six years after the end of the tax year they fall in, which is what HMRC requires of a business like ours. Tool ideas sent through the Requests Open form, and messages sent through “Something not right?” with any email address left with them, are deleted after 180 days, although each one also reaches our email inbox like any other email. Error reports are deleted after 30 days. Records of your email preferences are kept as evidence of what you agreed to and when; if you delete your account, your email address is removed from them.

Who we share it with

Only the suppliers we need to run the site: Stripe for payments, Supabase for hosting the database, Vercel for hosting the site, and our email provider for receipts and sign-in links. They act on our instructions, and we do not give your data to anyone else or sell it. The one exception is Meta, and only if you accept the Meta Pixel: Meta then receives the information described above and decides for itself how to use it, under its own privacy policy.

Stripe holds its own record

Stripe is not only working on our behalf. As the company actually taking the payment, it keeps its own copy of the transaction, under its own privacy policy and its own retention schedule, for fraud prevention and financial regulation. That means deleting your Trove account does not remove Stripe's record of the payment, and we cannot delete it for you. Stripe's privacy policy is on their website.

Downloads

We record when you download something you have bought. It tells us whether your download worked if you contact us for help, and it matters legally: the right to cancel ends for each resource when you download it, so we keep a record of which item you took and when.

Error reports

If a page fails to work properly, your browser sends us a short technical report so we can fix it: which page it was, the error, and the type of browser. On about 1 page view in 20, a page that loaded properly also sends a short check-in saying so, which is how we know the reports are still arriving. Neither includes your name, your email address, or anything you typed.

The free tools site

Our free whiteboard tools at tools.trove.education have no accounts, no sign-in, no cookies and no adverts, so that site needs no cookie banner. It uses Vercel Web Analytics and Speed Insights in the same cookieless way as this site.

• Saved in your browser on that device and never sent to us: tools you star as favourites, and whether you view the tool library as pictures or a list.
• The name picker keeps a class list you type in on that device, so it is there next lesson. Clearing the browser's site data removes it.
• If you arrived through one of our posts, the campaign tag (such as "tt-day2") is kept for 30 days and added to links from the tools site into the shop, where it is treated as described above.
• Each tool's share button puts the board into the link itself, and nothing is stored on our side. A shared name picker link contains the class list, so anyone you send it to can see the names. Check before you share it.
• Ideas sent through the Requests Open form, and messages sent through “Something not right?”, are covered above.

Your rights

Under UK GDPR you can ask to see the data we hold about you, ask us to correct or delete it, and object to certain uses. You can update your details or delete your account yourself from your account page. Email us and we will help with anything else. You can also complain to the Information Commissioner's Office (ICO).