Privacy policy
Appeal Ready is a product of Tweenage.
This policy explains what we collect, why, and what happens to it.
Data controller
The data controller is Rebecca Everton, a sole trader trading as Tweenage.
Registered with the Information Commissioner's Office, registration reference ZC120037. Contact: hello@appealready.co.uk
What we collect
When you use the assessment form, we collect:
- Your name and email address.
- The year group, school names, and whether the school is selective or grammar.
- Your home postcode, used to assess distance-based grounds for your appeal.
- Your reasons for appealing, including any circumstances you describe (such as sibling connections, distance, childcare, community ties, or other grounds).
- Any information you share about your child's educational, medical, or additional needs that are relevant to the appeal.
- Any supporting evidence you describe.
We do not ask for your child's name, date of birth, pupil ID, home address, or phone number, and we ask that you do not include these in the open text fields. The draft letter uses [Child's name] as a placeholder. You fill it in yourself before submitting to the appeal panel.
Sensitive information
Some of the information you provide may include details about medical conditions, special educational needs, or family circumstances. This is sensitive personal data. We only collect it because you choose to include it in your appeal reasons, and we only use it to generate your draft letter. We need this information to deliver the service you have asked for.
Where the information you choose to include is special-category data (for example health, disability, or special educational needs), our lawful basis for processing it is explicit consent under Article 9(2)(a) of the UK GDPR, which you give by ticking the dedicated consent box before you submit. You can withdraw consent at any time by contacting us; we may then be unable to provide further support or regeneration of your toolkit.
Most of this information is about your child rather than about you. When you tick that box you are giving consent on your child's behalf, in exercise of your parental responsibility, because the appeal is made on their behalf too. We only ever ask for what the panel needs to weigh your case: we do not ask for your child's name, and we do not ask for diagnoses or documents — a short description of the need is enough. If your child is old enough to understand, we would encourage you to talk to them about what you are sharing.
How we use your information
- To generate your personalised appeal letter and evidence checklist.
- To email your toolkit to you.
- To process payment through Lemon Squeezy.
- To provide support and regenerations if requested.
- To detect and prevent misuse of the service.
Our lawful basis for each purpose
Under UK GDPR Article 6, we rely on the following lawful bases:
- Contract (Article 6(1)(b)) — generating and delivering your toolkit, taking payment, and providing support or regeneration: these are necessary to perform the service you have purchased.
- Legal obligation (Article 6(1)(c)) — keeping the basic order record needed for accounting and tax purposes.
- Legitimate interests (Article 6(1)(f)) — preventing fraud and abuse of our forms (rate limiting) and monitoring errors so the service keeps working. These uses are low-impact and do not involve the substance of your appeal.
- Consent (Article 6(1)(a)) — the advertising measurement tag, which only loads if you accept it in the consent banner.
For special-category data, see “Sensitive information” above.
How the draft is produced
Your appeal reasons are sent to Anthropic (our AI provider) to generate the draft letter. Anthropic does not use your data to train its models. Anthropic may retain API data for up to 30 days for safety monitoring purposes, after which it is deleted. The finished draft is made available to you as a PDF via a secure, time-limited download link. Payment is handled by Lemon Squeezy.
What we keep and what we delete
Session data (the form data you submit) is deleted from our database within 48 hours of your toolkit being generated.
Assessment data (a snapshot of your submitted information used for regeneration and support) is retained for 30 days, then permanently deleted.
Your generated PDF is stored securely for 30 days so you can download it. After 30 days, the file is permanently deleted. We send you a reminder email 3 days before your download link expires, and a confirmation email once the file has been deleted.
Your delivery email includes a copy of the information you submitted. Once sent, that email is in your inbox and outside our control.
What we do keep:
- A basic order record: your email address, name, the school name, appeal type, year group, and payment reference.
- The fact that a letter was generated and downloaded.
We keep this order record for six years from the end of the financial year in which you bought, because UK tax and company law requires us to retain business records for that long. After that it is deleted. It does not include the substance of your appeal — that is already gone within 30 days, as described above.
Who processes your data
| Provider | Purpose |
|---|---|
| Anthropic | AI provider. Processes your appeal content to generate the letter. Does not use your data for training. May retain API data for up to 30 days for safety monitoring. We contract with Anthropic's EU entity; transfers are covered by Standard Contractual Clauses with the UK addendum. |
| Lemon Squeezy | Payment. Processes your name, email, and payment details. Data processed in the US under EU Standard Contractual Clauses. |
| Resend | Email delivery. Sends your download link and notification emails. Data processed in the US under EU Standard Contractual Clauses. |
| Vercel Blob | File storage. Temporarily stores your generated PDF for up to 30 days. Hosted by Vercel in the US — certified under the EU-US Data Privacy Framework, with Standard Contractual Clauses and the UK addendum. |
| Supabase | Database. Temporarily stores your form data and assessment data during processing, then deletes it as described above. Hosted in the EU (AWS eu-west-1, Ireland). |
| Vercel | Hosting. Hosts the application and collects anonymous, cookieless analytics. US-based — certified under the EU-US Data Privacy Framework, with Standard Contractual Clauses and the UK addendum. |
| Upstash | Rate limiting. Briefly stores your IP address to detect and prevent abuse of our forms. Covered by Standard Contractual Clauses including the UK transfer addendum. |
| Sentry | Error monitoring. May process technical data (including the page address) when an error occurs, so we can fix faults. Our Sentry instance is hosted in the EU (Germany), so this data stays in the EEA. |
Cookies and tracking
We do not use Google Analytics or Meta Pixel. We do not load any behavioural advertising tag unless you explicitly accept it in our consent banner. If you accept, we load Google's advertising tag to measure the performance of our ads; if you decline — which is the default — no advertising tag is loaded and no advertising cookies are set. You can change your choice at any time by clearing this site's cookies.
A small number of strictly necessary technical cookies may be set by our hosting (Vercel) and our error monitoring (Sentry) to keep the site working — for example, to remember CSRF tokens during a form submission or to associate an error report with the page it came from. These are exempt from consent requirements under PECR regulation 6(4) because they are essential to the service you have requested. They contain no personal identifiers and are not used for any other purpose.
Vercel Analytics (which measures aggregate page views) is configured in cookieless mode and does not identify you.
Your rights
Under UK data protection law you have the right to access, correct, or delete your data, and to withdraw consent at any time. Because we delete your appeal content within 30 days, there is very little personal data to retrieve. If you contact us, we can confirm what order record we hold and delete it if you ask.
Complaints
If you are unhappy with how we have handled your data, you can submit a complaint or contact the Information Commissioner's Office (ICO) at ico.org.uk. The data controller is Rebecca Everton, trading as Tweenage.
Important limit
Appeal Ready produces AI-generated draft letters only. It is not legal advice. You must review the draft for accuracy and adapt it to your personal circumstances before submitting it. This is a drafting support tool and we cannot guarantee any panel outcome.
Contact
Questions, support, or privacy requests: hello@appealready.co.uk
Appeal Ready is a product of Tweenage.