Privacy policy

Who we are

Maternly is operated by Teach SPL Ltd, a company registered in England and Wales under company number 17343448. The service provides Shared Parental Leave planning tools for teachers, including questionnaire flows, pay estimates, plan generation, document support, AI chat support and optional expert review.

Maternly provides administrative leave, pay and document support. We do not provide medical or wellness advice.

Our registered office is 124 City Road, London, EC1V 2NX.

Teach SPL Ltd is the data controller for the personal information described in this policy, and is registered with the Information Commissioner's Office (ICO) under registration number ZC202136.

For privacy questions or rights requests, contact us at support@maternly.co.uk.

Information we collect

• Account and contact details, such as your name, email address, login details, plan level, marketing preference and support messages.
• Planning information you enter, such as region, school type, contract type, FTE, pay scale or salary details, due date, leave dates, partner SPL/ShPP information, school calendar dates and custom school policy details.
• Generated planning outputs, such as monthly pay breakdowns, estimated totals, SPL blocks, action checklists, summaries and document packs.
• Uploaded documents and file metadata, such as school policies, employer or local-authority forms, filenames, file types, Maternly-generated form drafts and reviewer files returned to you.
• Payment and checkout information, such as Stripe customer identifiers, checkout session details, payment status, plan purchased, amount and currency. We do not store full card details.
• Feedback, issue reports, review requests and correspondence you send to us.
• Questions you choose to type into AI chat. The question may contain personal information if you include it.
• Private-beta invite, consent and waitlist information, including whether you separately permit anonymised form structure and wording to be used to improve form matching.
• NHS early-access information, consisting of your email address, signup time, any campaign attribution attached to the page link you used, and any optional answers you give about your confidence, difficult topics and current planning approach.
• Technical and security information, such as authentication records, cookies needed to keep you signed in, device/browser information and basic usage logs.
• Optional analytics and advertising information, such as public page views, confirmation of successful leave-plan creation, broad device/browser details and campaign attribution, only where you consent to those technologies.
• Marketing email preferences and email engagement data, such as unsubscribe tokens and whether a broadcast email was opened or clicked.

How we use your information

• To create and manage your Maternly account.
• To calculate maternity pay and Shared Parental Leave planning estimates.
• To generate, save and display your leave plans, pay breakdowns, summaries and action checklists.
• To check uploaded files for safe handling, provide the human document support you request and generate pre-filled Shared Parental Leave form drafts for supported cases.
• To provide AI chat support, Teacher Support + expert review and customer support.
• To process payments, discounts, refunds and plan access through Stripe.
• To send essential service emails, such as account, payment, review and support updates.
• To send marketing emails only where you have opted in, and to manage unsubscribe requests.
• To manage the Maternly for NHS early-access list, email you about its development, availability and launch, and use optional survey answers to understand what NHS staff need from the service.
• To investigate feedback, document issues, complaints, security events and service problems.
• To improve the service, maintain audit logs and understand high-level product usage.

Cookies, analytics and advertising

Maternly uses necessary cookies and similar technologies to provide core features such as authentication, security and remembering your privacy choices. These cannot be switched off through our cookie controls because the service needs them to work.

With your permission, we use PostHog to understand product usage and improve Maternly. We do not record your screen or your session. Our event tracking is limited to a fixed list of non-identifying details, such as which step of the planner you reached, so names, email addresses, dates, questionnaire answers and uploaded document contents are never sent. PostHog stores this information in the European Union.

With your advertising permission, we share visits to selected public pages, including the NHS early-access page, and a confirmation when you successfully create a leave plan or join NHS early access with Meta (Facebook and Instagram), to measure which adverts lead people to use Maternly. These confirmations tell Meta that a browser completed the relevant Maternly journey. We do not include your name, email address, account identifiers, questionnaire answers, pregnancy or birth dates, pay information, or plan or document contents.

Meta receives information about these events, page addresses, and browser and network information, including your IP address, and may use its own cookies where your browser allows them. You can refuse advertising tracking and still use Maternly. Change or withdraw your choice at any time using Cookie settings in the footer. Withdrawal stops future sharing from our website. For help exercising your rights over information already shared, contact support@maternly.co.uk.

With your separate advertising permission, the TikTok Pixel records page views on public marketing pages and a conversion when a plan is successfully created, to help measure advertising. The conversion shows that a browser completed the planning journey. We do not add names, email addresses, questionnaire answers or plan contents as event parameters. The Pixel can process browser and device information, network information, cookie identifiers, page addresses and referrers. The page-view events we request are limited to public marketing pages; we do not request them on registration, questionnaire, dashboard, account, checkout, review or admin pages.

You can accept, reject or choose optional categories when first visiting Maternly. You can change or withdraw your choice at any time using Cookie settings in the footer.

Lawful bases

Under UK data protection law, we need a lawful basis to use personal information. The lawful basis depends on what we are doing with the information.

• Contract: to provide your account, calculator, paid plan, document tools, AI support and review services.
• Consent: for optional analytics and advertising technologies, optional marketing emails and optional uploads or support requests where you choose to provide extra information.
• Legitimate interests: to secure the service, prevent misuse, improve Maternly, respond to support requests, keep appropriate audit records and understand service performance.
• Legal obligation: where we need to keep payment, tax, accounting or legal records, or respond to lawful requests.

Your leave information and explicit consent

We use your expected due date and, where provided, your baby's date of birth to calculate your leave plan. Some information in a plan, completed form or supporting document can reveal pregnancy or recent childbirth. Where it does, UK data protection law treats it as special category health information and gives it additional protection.

Using it lawfully needs two things: a basis under Article 6, and a separate condition under Article 9. Our Article 6 basis is contract — we cannot provide the service you asked for without this information. Our Article 9 condition is your explicit consent, under Article 9(2)(a).

We ask for that consent inside the planner, on its own screen, immediately before the questions about your due date or your baby's date of birth. The box is never pre-ticked, and you cannot continue until you tick it. We record which version of the wording you agreed to, and when.

We use your due date, birth date, questionnaire answers and documents to build your plan, prepare the documents you request and provide document review or support where requested. We do not send those details or document contents to advertisers. The separate optional advertising measurement described above can tell Meta and TikTok that you created a leave plan.

You can withdraw your consent at any time by deleting your account from the Account page, which erases your plan and any documents you uploaded, or by emailing us and asking us to do it for you. Because a plan cannot be calculated without this information, withdrawing consent and deleting your plan are the same thing — we would rather say that plainly than imply a choice that does not exist.

AI and document processing

Maternly uses AI tools where needed to help summarise information, prepare guidance, draft document packs and support the chat feature. AI outputs are guidance only and should be checked before you rely on them or send documents to your school.

For general SPL questions, Anthropic receives your current question, the guidance region you select, the general effective-date context and a small server-owned list of reviewed answer categories. This assistant does not read or assess your personal plan. Maternly does not send your earlier chat history or retrieve your name, email address, salary, account identifiers, questionnaire answers, documents or saved-plan values for the provider. Because you control the question, it can still contain any personal information you choose to type. Avoid including personal details. The conversation stays in memory on the page and is cleared on reload; earlier messages are not sent with your next question.

Maternly does not put the wording of AI chat questions into product analytics. After a completed and privacy-checked interaction, it records only aggregate topic and outcome counts. The admin view hides any topic with fewer than five questions, shows a 90-day window and deletes aggregate rows after 180 days.

When you upload documents, we process them to provide the document support you request, troubleshoot issues, support review requests and improve reliability. Please upload only documents that are relevant to your SPL planning.

For a submitted generated-pack review, only the exact Maternly-generated ACAS form and booking-notice evidence enters the existing assisted-review evidence path. Uploaded policy files and additional school-form bytes stay in Supabase storage in London and are not sent to OpenAI or Anthropic. If an authorised reviewer explicitly tries the school-form filling tool, Anthropic receives only the server-detected field labels and the minimum frozen plan facts needed to match those labels; the reviewer must still check and approve any resulting draft, and it is released only when the whole review is completed.

For private-beta users, uploaded personal data is not used for examples, marketing or training without separate explicit consent. Optional form-improvement consent applies only to anonymised structure and wording used to improve form matching. Personal details, signatures, National Insurance numbers and addresses are excluded from anonymised examples.

Who we share information with

We share personal information only where needed to run Maternly, provide the service, meet legal obligations or protect the service.

• Supabase, for authentication, database and file storage.
• Railway, which hosts the Maternly application. Everything you send to us passes through Railway, and its systems keep basic server logs.
• Stripe, for checkout, payment processing, refunds and payment records. Stripe also acts as a data controller in its own right for fraud prevention and regulatory compliance, which means it decides how it uses some payment information rather than acting only on our instructions.
• Resend, for service emails, marketing emails where you have opted in, and delivery, bounce and complaint reporting.
• Anthropic, to process the current question for general SPL guidance, support other AI features such as summaries and draft document packs, and match detected school-form field labels to minimum frozen plan facts when an authorised reviewer explicitly starts that tool.
• OpenAI, to support the assisted part of the Teacher Support + review service using the exact Maternly-generated ACAS form and booking-notice evidence after you submit it for review. Policy files and additional school-form bytes are excluded in this version and remain human-only.
• Google, if you choose to sign in using a Google account. Google acts as a data controller in its own right for the sign-in itself.
• PostHog, for optional product analytics where you consent.
• Meta, for optional advertising measurement of visits to selected public pages, successful leave-plan creation and NHS early-access sign-ups where you consent, as described above.
• TikTok, for optional advertising measurement of public-page visits and successful plan creation where you consent, as described in the cookies and advertising section.
• Professional advisers, regulators or authorities where required for legal, accounting, tax, security or complaint reasons.

International data transfers

Maternly is operated from the United Kingdom. Some of the providers we use process information outside the UK, mainly in the United States. Where that happens, we rely on safeguards approved under UK data protection law — normally the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework.

• Supabase stores your account, plan, uploaded documents and generated forms in London, in the United Kingdom. This is the information most personal to you, and it does not leave the UK. Supabase Inc. is a United States company, so its staff may access systems for support; those transfers are covered by Standard Contractual Clauses including the UK Addendum.
• Railway hosts the application in Amsterdam, in the Netherlands. Railway Corporation is a United States company, so its staff may access systems for support; it is certified under the EU-US Data Privacy Framework and its UK Extension.
• PostHog stores analytics information in the European Union. PostHog Inc. is based in the United States and carries out some processing there, under the Data Privacy Framework and Standard Contractual Clauses.
• OpenAI processes the exact Maternly-generated ACAS form and booking-notice review evidence in the United States after a customer submits that fixed review set. Policy files and additional school-form bytes are not transferred to OpenAI in this version. Our agreement uses Standard Contractual Clauses with the UK Addendum, governed by the law of England and Wales, with the ICO as the supervisory authority.
• Anthropic processes the current AI chat question and other AI prompts in the United States. For an admin-triggered school-form fill, that prompt contains detected field labels and minimum frozen plan facts, not the uploaded document bytes.
• Stripe and Meta process information under their own privacy notices and transfer arrangements.

Our AI providers are contractually prohibited from using your information to train their models.

A transfer outside the UK does not change your rights. You can still ask us to access, correct or delete your information, and we remain responsible for it.

Where information comes from

• Directly from you when you register, answer questions, upload files, make a payment, use chat, request review, submit feedback or contact us.
• From generated service activity, such as your saved plans, documents, support history, email preferences and payment events.
• From service providers such as Stripe, Supabase and email delivery tools when they send us account, payment, authentication or delivery events.

How long we keep information

The short version: while your account exists, we keep your information so you can come back to your plan. When you delete your account, we immediately erase your account and plan information, including uploaded documents and generated forms, and the names, email addresses and prepared email content held for referral requests linked to your account. Some limited records remain, as explained below: payment records, feedback with your email address removed, and email preference records needed to honour unsubscribe links and requests to stop emails.

If you have not signed in for three years, we will email you, and delete your account and its information 30 days later. We chose three years so that a teacher returning for a second baby still finds her plan, without keeping inactive accounts indefinitely.

• Your account, plan, questionnaire answers, uploaded policy and school documents, generated form drafts and reviewer files returned to you: while your account exists.
• Unfinished planner answers, calendar entries, proposed date changes, review notes and unsent feedback or chat text saved to your account: while your account exists, unless you complete or discard that draft sooner. Saving a draft does not submit it or send a message.
• Unconfirmed recovery copies on this device are eligible for restoration for 14 days from your latest edit; older copies are cleared when this browser next checks them. Pending plan, date or review requests remain on this device until their result is resolved or you sign out. Confirmed recovery copies are removed after server saving. Sign-out or account deletion also clears this device’s copies. Browser storage may be unavailable or cleared earlier by your browser; an offline device may retain copies until it is used again and its site data is cleared.
• Feedback and issue reports you send us: kept after your account is deleted, with your email address removed so they no longer identify you. They help us fix problems and improve the service. If a message you wrote contains personal details you would rather we removed, email us and we will delete it.
• Payment records: six years, because company law requires us to keep records of payments received. These are kept even if you delete your account, but we remove the link to you, so what remains is the amount, date and payment reference rather than information about you.
• Unsubscribe records and spam complaints: kept indefinitely. If we deleted the record that you asked us to stop emailing you, we would not know to stop.
• Referral email unsubscribe links: when we prepare a requested referral email, we store a random unsubscribe token and the original email address so that the link continues to work after an email change or account deletion. This separate record contains only the token and email address, not your name, account ID or referral invitation. It has no automatic expiry.
• Email delivery and opening records: 12 months, except detailed records for requested referral emails. Those records become eligible for deletion after 12 months and may remain longer until we run manual cleanup.
• Records of administrator access to customer accounts: 12 months.
• AI chat aggregate topic and outcome counts: 180 days. Maternly does not retain the wording of the question in those analytics records.
• Server logs: seven days, held in the European Union and not forwarded anywhere else.
• Waitlist entries: until 12 months after public launch, or sooner if you ask to be removed.
• Maternly for NHS early-access entries, including optional survey answers: until 12 months after Maternly for NHS launches, or sooner if you ask us to remove your entry. If we decide not to launch it, we will delete the list within 12 months of that decision.

You can delete your account at any time from the Account page, or email us and we will do it for you. Our payment provider keeps its own transaction records under its own retention rules, which we cannot shorten.

Your rights

Under UK data protection law you have the following rights. They apply whether your information is held in the UK or transferred abroad.

• Object. You can object to us using your information where we rely on legitimate interests, and you can object to direct marketing at any time. If you object to direct marketing we must stop, without exception.
• Withdraw consent. Where we rely on your consent — for optional analytics, advertising or marketing emails — you can withdraw it at any time. Withdrawing consent does not affect anything we did before you withdrew it, and it will not stop you using the parts of Maternly you have paid for.
• Access. You can ask for a copy of the personal information we hold about you.
• Correction. You can ask us to correct information that is wrong or incomplete.
• Erasure. You can ask us to delete your information. You can also delete your account yourself at any time from the Account page, which removes your uploaded documents and generated forms.
• Restriction. You can ask us to pause our use of your information while a concern is investigated.
• Portability. You can ask for the information you gave us in a portable format, or ask us to send it to someone else.

To exercise any of these rights, email support@maternly.co.uk. We may need to verify your identity before responding. We will reply within one month, and there is no charge.

You can also change your cookie choices at any time using Cookie settings in the footer, and withdraw your marketing consent using the unsubscribe link in any marketing email or by contacting us.

Marketing emails

We only send marketing emails if you opt in. You can unsubscribe using the link in a marketing email or by contacting us. You will still receive essential service emails, such as password, payment, account, review or support messages.

Security

We use technical and organisational measures designed to protect personal information, including access controls, private storage buckets, row-level security, signed download links and admin-only access for sensitive operational data. Please use a strong password and keep your login details private.

Complaints

If you are concerned about how we use your personal information, please contact us first at support@maternly.co.uk so we can try to resolve it.

You can also complain to the Information Commissioner's Office (ICO), the UK regulator for data protection. The ICO can be contacted through ico.org.uk, and its postal address is Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Changes to this policy

We may update this privacy policy as Maternly develops or if legal, technical or operational requirements change. The latest version will be published on this page.