Privacy Policy

1. Who we are

This policy explains how Instructor Buddy Limited handles personal information. We are registered in England and Wales, company number 17478231, and our registered office is 3 Weekley Wood Close, Kettering, Northamptonshire, United Kingdom, NN14 1UQ. In this policy, we, us and our mean Instructor Buddy.

Instructor Buddy gives UK driving schools and driving instructors an AI assistant that answers enquiries from learner drivers, answers questions about prices, areas and availability, finds a lesson slot and arranges it.

We operate in the United Kingdom only. The service is offered to UK driving schools, and the learners who contact them are in the UK. UK data protection law applies to everything in this policy — the UK GDPR and the Data Protection Act 2018.

2. The two roles, and why it matters who you are

There are three different groups of people in this policy, and what we do with their information is different for each.

What this means in plain terms

The controller decides what happens to someone's information — why it is held, what it is used for, how long it is kept. The processor acts on the controller's instructions.

For learner drivers, the driving school is in charge. When a learner messages a school, they are messaging that school. We hold and handle the message because the school uses our software to answer it. If a learner wants their information deleted, or wants to see what is held, that is the school's decision — though we will always help, and section 7 explains what we do if a learner cannot reach them.

3. What we collect

3.1 From driving schools and instructors

3.2 From learner drivers, on the school's behalf

We handle this as the school's processor.

3.3 Automatically

• Server and security logs kept by our hosting and database providers, which include IP addresses and request times, used to keep the service running and secure.
• The date you last used the service, and whether it was on a phone or a computer.

We do not build a profile of you, and we do not record your device make, model or browser version.

3.4 Bank details

If you choose to enter them, we store your bank account name, sort code and account number so the assistant can tell a learner where to send payment after a lesson is confirmed. This is the most sensitive information we hold and it is handled differently:

• Entering them is optional. Without them, the assistant tells a learner your payment method and nothing more.
• They are encrypted before they are stored, with a key kept outside the database.
• They are never sent to your browser, and never written into the record of a conversation.
• Screens show the last four digits only.
• They are given to a learner only after a lesson is confirmed. Someone who simply asks for your account number is told the payment method and nothing else.
• We email you whenever they change, so an unauthorised change is visible immediately.
• They are deleted straight away when you remove them or close your account.

3.5 What we do not collect

• Card numbers, from anybody. Stripe handles all of it.
• Learner licence numbers, dates of birth or home addresses.
• Full postcodes — outward codes only, for instructors and learners alike.
• The titles or contents of your calendar events — only when you are busy.
• Device fingerprints.
• We do not ask anyone for health, ethnicity, religion, sexual orientation, political opinions or trade union membership. If a learner volunteers something of that kind in a message, it will be in the message content — schools should not ask learners for health or medical information through the service.

3.6 From forms on our website

Our website has forms for getting in touch with us — for example to try the demo, book a call or set up an account — and we will add more as the service grows. This section covers all of them.

We collect what each form asks for: usually your name, your driving school’s name, your email address, your phone number and how many instructors you have. We use it to reply to you, to arrange what you asked for and to follow up on your enquiry. Our lawful basis is our legitimate interest in answering a business enquiry, or taking steps you have asked for before an agreement.

Your details go into our own database. Where a form is run for us by another provider — a scheduling tool when you book a call, or the services that raise an invoice and take payment when you set up a school account — that provider receives only what the form collects.

We keep them for as long as there is a realistic chance of us working together, and review what we hold at least once a year, deleting anything we no longer need. If you become a customer, they become part of your account and are kept as section 6 describes. You can ask us to delete them at any time at info@instructorbuddy.co.uk.

4. Why we collect it, and our lawful basis

We need a lawful basis for everything we do with personal information. Most of ours is contract or legitimate interests. We do not rely on consent as a catch-all.

4.1 Using conversations to improve the service

We review conversations handled by the assistant, and use them to train, improve and validate our AI models and the service. This is how the assistant gets better at understanding learners and answering them correctly.

We do not sell this data, and we do not use it to train anyone else's AI models. Where we use conversations for testing and development, we reduce and remove identifying details wherever we reasonably can.

Driving schools agree to this when they subscribe. It is set out in our Terms of Service.

You can object to processing based on legitimate interests, and withdraw consent to marketing at any time without affecting anything else.

5. Who we share it with

We do not sell personal information. We share it only with the organisations that help us run the service, each bound by a contract limiting what they may do with it.

Not every channel above is switched on for every customer. Where one is not connected to your account, no information reaches that provider.

We may also share information with our professional advisers, with a buyer if our business is sold, and where the law requires it.

Information going outside the UK

Our database is in London, so the information held in it stays in the United Kingdom.

Some providers are in the United States. Where information goes to them we rely on the International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, together with an assessment of that transfer.

Where data is stored and who can reach it are different questions. Some providers hold data in the UK or the EEA but are American companies whose staff may access it to support us. Those arrangements are covered by the same safeguards.

6. How long we keep it

7. Your rights

Under UK data protection law you have the right to:

• Be told what we do with your information — this document;
• See a copy of the information we hold about you;
• Correct anything that is wrong;
• Have it deleted, in some circumstances;
• Restrict what we do with it while a question is resolved;
• Take it elsewhere in a portable format;
• Object to processing based on legitimate interests, and to direct marketing at any time; and
• Not be subject to solely automated decisions with legal or similarly significant effects.

Exercising any of these is free and we will respond within one month. Contact info@instructorbuddy.co.uk.

How the assistant decides

The assistant works out which lesson slots to offer, from the school's working hours, its diary and the learner's answers. Depending on the setting the school has chosen, it either pencils a slot in for an instructor to approve, books it, or simply passes the learner's details to the instructor. Arranging a driving lesson is not a decision with legal or similarly significant effects, so the rules on solely automated decisions do not apply to it. A learner can ask to speak to a person at any time, and the assistant hands the conversation over as soon as they do.

If you are a learner driver

Your driving school decides what happens to your information, not us. Ask them first — they can see everything we hold about you.

If you cannot reach the school, contact us at info@instructorbuddy.co.uk. We will pass your request to the school and tell you we have done so. If they have not acted within 14 days, we will chase them.

8. Deleting your data

If you are a driving school

Email info@instructorbuddy.co.uk from the address on your account, asking us to delete your account and its data. We will:

• Delete your account, settings, pupils, lessons, conversations and bank details within one month, which is the period the law allows. If a request is complex and we need longer, we will tell you why; and
• Tell you when it is done, and what we had to keep.

If you would like a copy of your data before it goes, ask and we will provide one. Deletion cannot be undone.

Only a school's owner can request erasure of the school's data. An employed instructor's own details can be erased, but deleting a school's record of other people's lessons is a decision for the school.

If you are a learner driver

Ask the driving school you contacted — they decide. If you cannot reach them, email us and we will pass it on and chase it.

What we have to keep

We keep financial records for seven years, as HMRC requires. We keep a minimal record that an account existed and was deleted, and a record that someone asked us not to market to them.

9. Cookies

Instructor Buddy uses the smallest number of cookies it can.

10. Children

Instructor Buddy is a business tool for driving instructors. Nobody under 18 may open an account.

A person cannot hold a provisional licence for a car until they are 17, so learner drivers who contact a school are 17 or over. Occasionally a parent enquires on behalf of a younger person. Where that happens:

• The information we hold is what the parent has told us.
• The assistant never asks anyone's age. If it is told a learner is under 17, it stops trying to arrange a lesson and passes the enquiry to the instructor.
• The driving school, as controller, is responsible for handling that enquiry appropriately.

If you believe we hold information about a child that should not be held, tell us at info@instructorbuddy.co.uk.

11. How we keep information safe

No system is perfectly secure, but we take it seriously:

• All information is encrypted in transit and at rest.
• Bank details are encrypted separately, with a key held outside the database.
• Access controls limit who can see what, enforced by the database itself and not only by the app.
• There are no passwords to steal — signing in uses a single-use link sent to your email address.
• We never store card numbers.
• Live customer data is kept separate from the systems we use to build and test the product.

If a security breach puts personal information at risk, we will tell the Information Commissioner within 72 hours where required, and tell affected people without undue delay where the risk to them is high. Where the information belongs to a school's learners, we will tell the school straight away.

12. Google Calendar

If you connect a Google Calendar, Instructor Buddy works with it in both directions. This section explains exactly what we read, what we write, and what we never touch.

What we read from your calendar

We read your calendar for one purpose: to know when you are busy, so the assistant never offers a learner a time you cannot teach.

• We read when you are busy and nothing else — the start, the end, whether it is an all-day event, and whether it is marked free or busy.
• We do not read or store the title, description, location, guests or contents of any event. A dentist appointment in your calendar blocks that time and tells us nothing else.
• We use it only to work out your availability. It is not used for any other purpose.

What we write to your calendar

When a lesson is arranged through Instructor Buddy, we add it to your calendar so that it appears on your phone alongside everything else.

• We write only lessons that this service arranged. We never create, alter or delete any other event in your calendar.
• A lesson we wrote can be updated or removed by us if it is later changed or cancelled in Instructor Buddy, so that your calendar does not keep a booking that no longer exists.
• A pencilled-in slot is never written. Where your setting is “ask me first”, nothing reaches your calendar until you have approved it and it has become a real lesson.
• The event carries what you need to teach the lesson: the date and time, the learner’s name, the area we are picking them up from, and their phone number. It is written so that you have everything on your phone without opening the app. This means those details are held in your Google account as well as ours — see below.

Because those details sit in your Google account as well as ours, they are subject to Google’s own privacy terms once they are there, and to whatever you have shared your calendar with. If you would rather the entry carried less, tell us and we will keep it to the date, the time and a first name.

What we never do with it

• Calendar information is never used to train, improve or validate our AI models, and it is never part of the conversation data described in section 4.1.
• We never sell it, never transfer it to anyone except as needed to run the service for you or where the law requires, and never use it for advertising or any kind of profiling.
• Nobody here reads your calendar unless you ask us to while helping you, we must for security reasons, or the law requires it.
• Disconnecting your calendar stops all of this immediately. We delete the busy times we had stored. Lessons we have already written into your calendar stay there, because they are yours — you can remove them yourself.

Instructor Buddy’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The policy is published at developers.google.com/terms/api-services-user-data-policy.

13. Changes to this policy

We may update this policy as the service changes or the law does. The date at the top says when it was last changed. If we make a change that materially affects how we use your information, we will give you reasonable notice by email or in the app before it takes effect.

14. Complaints

If you are unhappy with how we have handled your information, tell us first at info@instructorbuddy.co.uk so we can put it right.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint.

If you are a learner driver, your complaint is usually one for the driving school you contacted, because they decide what happens to your information. You can complain to the ICO about either of us.

15. Contact us

Instructor Buddy Limited

• Email: info@instructorbuddy.co.uk
• Post: 3 Weekley Wood Close, Kettering, Northamptonshire, United Kingdom, NN14 1UQ
• Company number: 17478231
• Website: instructorbuddy.co.uk