Privacy notice

Last updated 29 September 2026

Who is responsible

Simple Metrics Ltd (company number 16700613, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ) runs Catchmently and is the controller of the personal data described here. We are registered with the Information Commissioner's Office. Contact us about privacy at support@catchmently.com.

Using Catchmently without an account

Searches run in your browser. To show results, your device downloads data files for the area or school you look up, so our hosting provider's request logs can show which postcode districts and schools were viewed, with your IP address and browser details. We use these logs only to run and protect the site.
Use my location: your browser asks your permission, and your position is used in your browser to find the nearest postcode. It is not sent to us; only the data files for nearby postcode districts are downloaded.
Your shortlist and notes, while you are not signed in, are kept in your browser's local storage on your device and are not sent to us.
Visit statistics: we count visits with our own copy of Umami, a cookieless analytics tool. It records the page, the referring site, browser, device type, screen size, language and country (worked out from your IP address, which is not stored), and site actions such as a search, opening a school or starting a payment, without what you searched for. Visits are grouped with a daily-changing scrambled identifier, so we cannot tell who you are or follow you across days or sites.
Maps: your browser loads map tiles directly from OpenFreeMap (or OpenStreetMap as a fallback), and flood-risk layers from the Environment Agency when you switch them on. Google Maps loads only if you choose the Satellite view or open a Google Maps or Street View link. These providers see your IP address and the map area requested, under their own privacy policies.

If you sign in, buy a pass or write a review

Account: your email address and when you created your account and last signed in.
Sign-in links: a scrambled (hashed) copy of each link, when it was requested and used, and the IP address that asked for it, so we can stop abuse. Sign-in emails and pass confirmations are sent through Cloudflare's email service.
Session: a hashed session token linked to your account, set in a cookie when you sign in.
Payments: Stripe takes your card details; we never see them. We keep the Stripe checkout and payment references, the amount, currency and date, and your pass dates. Stripe processes payment and fraud-prevention data as described in its privacy policy.
Shortlist and notes: when you are signed in, the schools you save and your notes on them are kept with your account, so they appear on every device where you sign in. Only you can see them. Any you saved on a device before signing in are added to your account when you sign in with a pass.
Reviews: your rating, text, connection to the school and year, linked to your account. Reviews are published without your email address.
Emails you send us and our replies.

Why we use it, and our lawful basis

To provide your account, sign-in and pass, and to publish your reviews: performance of our contract with you.
To keep the site secure, prevent abuse and fraud, check reviews and fix problems: our legitimate interests in running a safe, reliable service.
To count visits and see which parts of the site are used, so we can improve it: our legitimate interests.
To keep payment and accounting records: legal obligation.

We do not sell personal data, show advertising, or use tracking or analytics cookies.

Cookies and local storage

cm_session: set only when you sign in, to keep you signed in for up to 180 days or until you sign out. Strictly necessary.
Cloudflare may set a strictly necessary security cookie (such as __cf_bm) to protect the site from automated abuse.
Local storage on your device holds your shortlist and notes (a copy of your account's while you are signed in, removed when you sign out), and where to return to after the pass page.

Because these are strictly necessary for things you ask for, we do not need your consent for them, and there is no cookie banner.

Who else handles your data

Cloudflare, Inc.: hosting, security, our database and sign-in emails (processor).
Stripe Payments UK, Ltd. and its affiliates: payments (processor, and a controller for its own legal and fraud-prevention duties).
Vercel Inc.: hosts our Umami visit statistics (processor).
Our professional advisers, and authorities where the law requires it.

Cloudflare, Stripe and Vercel may process data outside the UK, including in the United States. Where they do, the transfer is covered by UK adequacy regulations (such as the UK–US data bridge) or the UK's approved contractual safeguards.

How long we keep it

Sign-in links and the IP addresses that requested them: deleted after about 2 days.
Sessions: until they expire (180 days) or you sign out.
Your account, reviews, shortlist and notes: until you remove them or ask us to delete them.
Payment and pass records: 6 years after the end of the financial year of the payment, as UK tax and company law requires, even if you delete your account.
Hosting request logs: a short period set by Cloudflare, typically a few days.

Your rights

You can ask us for a copy of your personal data, to correct or delete it, to restrict or object to how we use it, or to receive it in a portable form. Email us from the address you sign in with. We reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113; we would appreciate the chance to put things right first.

Children

Catchmently is for parents and carers. You must be 13 or over to create an account and 18 or over to buy a pass.

Changes

We will update this notice when how we use personal data changes, and show the date at the top.