Privacy notice

Last updated 15 October 2026

Who is responsible

Simple Metrics Ltd (company number 16700613, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ) runs Catchmently and is the controller of the personal data described here. We are registered with the Information Commissioner's Office. Contact us about privacy at support@catchmently.com.

Using Catchmently without an account

Searches run in your browser. To show results, your device downloads data files for the area or school you look up, so our hosting provider's request logs can show which postcode districts and schools were viewed, with your IP address and browser details. We use these logs only to run and protect the site.
Use my location: your browser asks your permission, and your position is used in your browser to find the nearest postcode. It is not sent to us; only the data files for nearby postcode districts are downloaded.
Your shortlist and notes, while you are not signed in, are kept in your browser's local storage on your device and are not sent to us.
Visit statistics: we count visits with our own copy of Umami, a cookieless analytics tool. It records the page, the referring site, browser, device type, screen size, language and country (worked out from your IP address, which is not stored), and site actions such as a search, opening a school or starting a payment, without what you searched for. Visits are grouped with a daily-changing scrambled identifier, so we cannot tell who you are or follow you across days or sites.
Maps: your browser loads map tiles directly from OpenFreeMap (or OpenStreetMap as a fallback), and flood-risk layers from the Environment Agency when you switch them on. Google Maps loads only if you choose the Satellite view or open a Google Maps or Street View link. These providers see your IP address and the map area requested, under their own privacy policies.
Deadline reminders: if you ask a school page to remind you before applications close, we keep your email address, the school page, the closing date, when you asked and your IP address (so we can stop abuse), and send you one email through Cloudflare's email service.

If you sign in, buy a pass or write a review

Account: your email address (the one you sign in with, or give Stripe when you buy a pass without signing in) and when you created your account and last signed in.
Sign-in links: a scrambled (hashed) copy of each link, when it was requested and used, and the IP address that asked for it, so we can stop abuse. Sign-in emails and pass confirmations are sent through Cloudflare's email service.
Session: a hashed session token linked to your account, set in a cookie when you sign in.
Payments: Stripe takes your card details; we never see them. We keep the Stripe checkout and payment references, the amount, currency and date, and your pass dates. Stripe processes payment and fraud-prevention data as described in its privacy policy.
Shortlist and notes: when you are signed in, the schools you save and your notes on them are kept with your account, so they appear on every device where you sign in. Only you can see them. Any you saved on a device before signing in are added to your account when you sign in with a pass.
Reviews: your rating, text, connection to the school and year, linked to your account. Reviews are published without your email address.
Emails you send us and our replies.

If you use Catchmently in an AI app

AI apps such as ChatGPT and Claude can look up Catchmently for you. The app's servers send us only the lookup itself (such as a school name, postcode or school ID), not your conversation.

Without signing in: we keep a count of lookups per day for each scrambled (hashed) IP address, which changes every day, to stop abuse, and a daily total with no IP address.
If you sign in from the app: a hashed copy of each emailed sign-in code, when it was requested and used, and the IP address that asked for it; the app's name and the address it returns you to; hashed access tokens (valid for 1 hour) and refresh tokens (valid for 90 days); and a count of lookups per day for your account. The app sees only the schools and figures it asks for, never your email address, shortlist, notes or payments.
What we send back is then handled by the AI provider (such as OpenAI or Anthropic) under its own privacy policy.

If you use the Catchmently Chrome extension

The extension works only on Rightmove property pages. In your browser, it reads the listing's postcode from the page and matches the schools Rightmove lists with Catchmently's figures. To do that it downloads Catchmently's public data files for that postcode district, the surrounding map area and those schools, so, as with searches on the site, our hosting provider's request logs can show which files were requested, with your IP address and browser details. It does not send us the page, the listing or your browsing history, has no sign-in, stores nothing on your device and includes no visit statistics. Its links to Catchmently are tagged as coming from the extension and carry the listing's postcode after the # in the link, which your browser does not send to us.

Why we use it, and our lawful basis

To provide your account, sign-in and pass, and to publish your reviews: performance of our contract with you.
To send a deadline reminder you asked for: your consent, given when you ask for it.
To keep the site secure, prevent abuse and fraud, check reviews and fix problems: our legitimate interests in running a safe, reliable service.
To count visits and see which parts of the site are used, so we can improve it: our legitimate interests.
To keep payment and accounting records: legal obligation.

We do not sell personal data, show advertising, or use tracking or analytics cookies.

Cookies and local storage

cm_session: set only when you sign in, to keep you signed in for up to 180 days or until you sign out. Strictly necessary.
cm_guest: set when you start paying without signing in, so only this browser is signed in when Stripe sends you back; removed then, or after a day. Strictly necessary.
Cloudflare may set a strictly necessary security cookie (such as __cf_bm) to protect the site from automated abuse.
Local storage on your device holds your shortlist and notes (a copy of your account's while you are signed in, removed when you sign out), and where to return to after the pass page.

Because these are strictly necessary for things you ask for, we do not need your consent for them, and there is no cookie banner.

Who else handles your data

Cloudflare, Inc.: hosting, security, our database, and sign-in and reminder emails (processor).
Stripe Payments UK, Ltd. and its affiliates: payments (processor, and a controller for its own legal and fraud-prevention duties).
Vercel Inc.: hosts our Umami visit statistics (processor).
Our professional advisers, and authorities where the law requires it.

Cloudflare, Stripe and Vercel may process data outside the UK, including in the United States. Where they do, the transfer is covered by UK adequacy regulations (such as the UK–US data bridge) or the UK's approved contractual safeguards.

How long we keep it

Sign-in links and codes and the IP addresses that requested them: deleted after about 2 days.
Sessions: until they expire (180 days) or you sign out. AI app tokens: deleted a day after they expire.
Daily lookup counts from AI apps: per scrambled IP address, about 2 days; daily totals and per-account counts, about 13 months.
Your account, reviews, shortlist, notes and deadline reminders: until you remove them or ask us to delete them.
Payment and pass records: 6 years after the end of the financial year of the payment, as UK tax and company law requires, even if you delete your account.
Hosting request logs: a short period set by Cloudflare, typically a few days.

Your rights

You can ask us for a copy of your personal data, to correct or delete it, to restrict or object to how we use it, or to receive it in a portable form. Email us from the address you sign in with. We reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113; we would appreciate the chance to put things right first.

Children

Catchmently is for parents and carers. You must be 13 or over to create an account and 18 or over to buy a pass.

Changes

We will update this notice when how we use personal data changes, and show the date at the top.