1. Introduction
At Vellum Finch, we believe that educational software should support teachers without compromising their professional judgement or the privacy of the people they work with.
Vellum Finch develops digital tools to help educators organise information, manage assessment, monitor progress and support classroom practice.
We recognise that these activities may involve personal information about students, including children and young people, and that such information deserves particular care.

This Privacy Policy explains how personal information may be accessed, stored, used, shared and protected when using Vellum Finch products and services.
Our approach is built around three principles:

• Local-first design: Vellum Finch Core is designed to keep its working records on the user's device rather than requiring an online student database.

• Teacher control: Educators remain responsible for the information they enter, review, retain and share using the software, subject to their organisation's policies.

• Human judgement: Vellum Finch Core does not use generative artificial intelligence to produce automated professional judgements about students.

We aim to make our data practices understandable, proportionate and transparent.

2. Who we are
Vellum Finch is an independent educational software business based in the United Kingdom.
Trading name: Vellum Finch
Operator: Luke Taylor Kandiah
Website: https://vellumfinch.co.uk
Privacy enquiries: luke@vellumfinch.com
For personal information collected directly through our website, business communications, sales or support activities, Vellum Finch generally acts as a data controller.
Where educators or educational institutions use Core independently to process student information stored on their own devices, the relevant school or educational organisation will generally determine the purposes and lawful basis of that processing.
Where Vellum Finch separately processes personal information on behalf of an organisation, the respective responsibilities will be determined by the actual processing arrangements and any applicable data processing agreement.

3. Information processed through Vellum Finch Core
Vellum Finch Core includes tools supporting educational administration, assessment, pastoral organisation and classroom activities.
Depending on the features used, information entered into the application may include:

• Student names, classes, year groups and identifiers.

• Assessment marks, targets, grades and feedback.

• Coursework observations, evidence and progress records.

• Tutor notes, pastoral observations and records of educational support.

• Seating arrangements and classroom organisation.

• Teacher-authored reports, comments and communications.

• Information imported from spreadsheets or other files.

• Application preferences, locally saved settings and backup information.

Some educational records may contain sensitive information, including details relating to health, wellbeing or additional educational needs.
Users should enter only information that is necessary and authorised for their educational responsibilities.
The presence of information within Core does not, by itself, mean that Vellum Finch receives or independently controls that information.

4. Local storage and data control
Vellum Finch Core is designed as a local-first desktop application.
Its educational working records are intended to be stored on the user's device, rather than automatically uploaded to a central Vellum Finch student database.
This design aims to reduce unnecessary transmission of student information and allow organisations to maintain control over their records.
Users and their organisations are responsible for managing authorised access to their devices, protecting their files, maintaining appropriate backups and following applicable school data protection policies.
Local storage does not eliminate all privacy or security risks. Information may still be exposed through unauthorised device access, insecure exports, shared accounts, backup arrangements or other actions outside the application's direct control.
Vellum Finch does not claim that local storage alone constitutes full compliance with data protection legislation.

5. Data exports and external services
Core includes functionality intended to support exporting information and preparing educational communications.
Depending on the features used, this may include producing reports, exporting files and preparing communications using third-party applications such as Microsoft Outlook.
When a user deliberately exports information, saves it to another location or transfers it into another service, that information may become subject to the security arrangements and privacy practices of the destination.
For example, information sent through Microsoft Outlook may be processed by Microsoft and by the educational organisation's email infrastructure.
Vellum Finch does not control the independent privacy practices of third-party services.
Users should ensure that exports and communications are authorised, addressed to appropriate recipients and handled in accordance with their organisation's information governance requirements.

6. Artificial intelligence and automated decisions
Vellum Finch Core is designed to support, rather than replace, the judgement of educators.
The application does not use generative AI to make professional assessments of students, determine grades or produce automated pastoral judgements.
Features that organise, calculate, format or assemble information should not be interpreted as independent professional decisions.
The educator remains responsible for reviewing the accuracy, appropriateness and context of information produced or presented through the application.
Vellum Finch does not use student records entered into Core to train generative AI models.

7. Children's information
Vellum Finch Core is intended primarily for educators and educational organisations, rather than for direct independent use by children.
However, the application may be used to process information relating to children and young people.
We recognise that children's personal information requires particular consideration.
Educational organisations using Core should ensure that student data is collected and processed lawfully, that appropriate privacy information is provided, and that access is restricted to authorised personnel.
The application should not be used to record unnecessary, excessive or inappropriate personal information.
Where the processing of special category information is necessary, the relevant organisation must identify an appropriate legal basis and satisfy any additional requirements under applicable data protection law.

8. Lawful basis for processing
The lawful basis for processing educational records within Core is generally determined by the school or organisation responsible for those records.
Depending on the circumstances, an organisation may rely on a legal obligation, public task, legitimate interests or another applicable lawful basis.
Vellum Finch does not determine the lawful basis for educational records independently maintained by a school.
For information Vellum Finch processes directly in operating its business, relevant lawful bases may include:

• Contract: To provide purchased software, respond to service requests or fulfil contractual commitments.

• Legitimate interests: To respond to enquiries, maintain business relationships, improve operational security and administer the business, where those interests are not overridden by individuals' rights.

• Legal obligation: To maintain records and comply with applicable tax, accounting or regulatory requirements.

• Consent: Where consent is required for particular optional communications or activities.

We do not rely on consent where another lawful basis is more appropriate.

9. Information collected through our website and support
When someone contacts Vellum Finch, requests support or communicates with the business, we may receive information such as:

• Their name and professional role.

• Their email address and organisation.

• The content of their enquiry.

• Relevant correspondence and support history.

• Technical information they voluntarily provide to help resolve a problem.

We use this information to respond to enquiries, provide requested assistance, manage professional relationships and meet applicable legal obligations.
Users should not send identifiable student records, sensitive pastoral notes or other confidential school information through ordinary support communications unless an appropriate and authorised secure arrangement has been established.
The Vellum Finch website may involve additional technical processing by its hosting provider, including information necessary to deliver the website securely. Any use of optional analytics, cookies or tracking technologies must be disclosed separately where applicable.

10. Security
Vellum Finch aims to incorporate appropriate security considerations into the design and maintenance of its software.
Core's local-first architecture is intended to reduce unnecessary reliance on remote storage of educational records.
Depending on the version and configuration, the application may provide local access protection, backup functionality and other safeguards.
These measures operate alongside, rather than replace, the security responsibilities of the user and their educational organisation.
Users should follow appropriate security practices, including protecting devices and accounts, applying software updates, managing backups securely and preventing unauthorised access.
No software can guarantee absolute security. Vellum Finch therefore does not represent that information stored or processed using Core is immune from loss, compromise or unauthorised access.

11. Sharing of personal information
Vellum Finch does not sell student information entered into Core.
Information may be shared with third parties in limited circumstances, including where:

• A user deliberately exports or transmits information through another service.

• A customer contacts Vellum Finch and provides information for support purposes.

• A third-party provider processes business, payment, website or support information on Vellum Finch's behalf.

• Disclosure is required by law or an applicable legal obligation.

Distribution and purchases through the Microsoft Store may involve Microsoft processing customer account, transaction, licensing and payment information under its own applicable terms and privacy notices.
Vellum Finch does not receive student educational records merely because the application is installed or purchased through the Microsoft Store.

12. International data transfers
Records maintained solely within Core's local storage are not transferred internationally by Vellum Finch merely because they are entered into the application.
However, users may export information to external systems whose processing or storage arrangements involve other countries.
Business service providers, website hosting arrangements and communication platforms may also involve processing outside the United Kingdom.
Where Vellum Finch itself transfers personal information internationally, it will take steps to ensure that the transfer complies with applicable data protection requirements, including the use of appropriate safeguards where required.
Organisations using third-party services alongside Core are responsible for assessing the relevant arrangements in accordance with their own data protection obligations.

13. Data retention and deletion
Educational records stored within Core are generally retained according to the actions of the user, the application's local storage behaviour and the retention arrangements established by the relevant educational organisation.
Vellum Finch does not independently prescribe retention periods for student information maintained by schools using the application.
Users should follow their organisation's retention, archiving and secure deletion policies.
Deleting information from the application may not remove copies previously exported, backed up or stored in other locations.
Information received directly by Vellum Finch for business purposes will be retained only for as long as reasonably necessary for its relevant purpose, subject to applicable legal and regulatory requirements.
For example, financial transaction records may need to be retained for statutory accounting and tax purposes.

14. Individual rights
Under applicable data protection law, individuals may have rights concerning their personal information, including rights of access, rectification, erasure, restriction, objection and data portability.
The availability of these rights depends on the circumstances and applicable legal conditions.
Requests concerning educational records held by a school should normally be directed to that school or its designated data protection contact.
Because Core is designed to store working records locally, Vellum Finch may not possess or have access to the information required to respond to such requests.
For personal information held directly by Vellum Finch, individuals may contact us using the privacy contact information provided in this policy.
Individuals also have the right to raise concerns with the UK Information Commissioner's Office (ICO), at https://ico.org.uk.

15. Data incidents and breaches
Users and educational organisations should report suspected incidents involving school-held personal information through their established internal procedures.
Where a suspected security issue relates directly to Vellum Finch software, users may contact Vellum Finch using the details provided below.
If Vellum Finch becomes aware of a personal data breach involving information for which it has legal responsibility, it will assess and respond to the incident in accordance with applicable law, including any required notifications.
Users should not assume that Vellum Finch can remotely investigate, access or recover records held solely on their own devices.

16. Changes to this policy
We may update this Privacy Policy to reflect changes in our products, services, technical arrangements or legal obligations.
When changes are made, the updated policy will be published on our website with a revised effective date.
Where material changes affect how personal information is processed, we will take appropriate steps to provide additional notice when required.

17. Contact
For privacy questions, data protection enquiries or concerns about Vellum Finch products, please contact:
Vellum Finch
Luke Taylor Kandiah
United Kingdom
Email: luke@vellumfinch.com
Website: https://vellumfinch.co.uk
We aim to respond to privacy enquiries promptly and appropriately.
Vellum Finch — Tools for teaching, with judgement where it belongs.