Privacy Policy.
Last updated: May 2026
per aspera ad astra
1. Who we are
Aspiro AI Ltd (Company No. 16326352) operates aspirocareers.com and platform.aspirocareers.com. We are registering with the Information Commissioner's Office (ICO) as a data controller.
Contact: [email protected]
2. Who this policy covers
All users of our website and platform: students, parents, and school staff. We provide services to young people under 18 and take our responsibilities under UK GDPR and the ICO Children's Code seriously.
3. What data we collect
Marketing website (aspirocareers.com):
- Contact form submissions: name, email, school or organisation name, role, and your message
- Analytics: anonymised usage data (page views, device type, approximate location) via Google Analytics. IP addresses are anonymised before storage. No personally identifiable information is collected.
Platform (platform.aspirocareers.com):
- Students: first name, last name, email address, school, year group, subjects, interests, career pathway preferences, and the content of your AI career guidance conversations
- Parents: first name, last name, email address, phone number (optional), and subscription tier
- School staff: name, email address, and school affiliation
- All users: anonymised platform usage data via PostHog EU (no personal data, no session recording)
AI memory: Career Compass remembers your previous conversations to provide continuity. This memory is stored securely via a third-party service (Mem0) and is linked to your account only.
Safeguarding metadata: If a conversation triggers our safeguarding system, we log the time, user ID, and category of concern. We do not store the content of flagged messages. This data is retained for the lifetime of the account and 7 years after closure.
4. How we use your data
- To provide the platform and Career Compass service
- To enable parents to monitor their child's engagement (with appropriate access controls)
- To enable schools to track student progress
- To send transactional emails (account creation, service notifications)
- To send service updates (you can opt out at any time)
- To improve the service using anonymised analytics
5. Legal basis for processing
| Data | Legal basis |
|---|---|
| Student account and conversations | Contract |
| Parent account | Contract |
| School account | Contract / Legitimate interest |
| Safeguarding metadata | Vital interests / Legal obligation |
| Marketing site analytics | Legitimate interest (anonymised, no personal data) |
| Platform analytics (anonymised) | Legitimate interest |
| Marketing communications | Consent |
6. Under-18 users
The platform is for students aged 11 to 15. Students access the platform through their school or via a parent or guardian. There is no direct self-registration route. We apply the following protections in line with the ICO Children's Code:
- No advertising or commercial profiling
- No session recording or behavioural tracking
- Data collection limited to what is necessary to provide career guidance
- Parents can link their account to their child's to monitor usage
- Schools subscribing to the platform are responsible for obtaining any required parental consents under their own GDPR obligations
7. Third-party processors
| Service | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | EU |
| Mem0 | AI conversation memory | US (SCCs apply) |
| Inception Labs | AI responses (Career Compass) | US (SCCs apply) |
| Resend | Transactional email | US (SCCs apply) |
| Vercel | Platform hosting | Global (EU region primary) |
| PostHog EU | Analytics | EU |
All processors are bound by data processing agreements. For US-based processors, Standard Contractual Clauses (SCCs) are in place.
8. Data retention
| Data | Retention |
|---|---|
| Student accounts and conversations | Active period plus 12 months after closure |
| Parent accounts | Active period plus 12 months after closure |
| Safeguarding metadata | Account lifetime plus 7 years |
| School staff accounts | Active period plus 12 months after closure |
| Marketing site enquiries | Up to 2 years |
| Analytics data | 12 months |
9. Schools as data controllers
When a school subscribes to Aspiro, the school acts as data controller for its students. Aspiro AI Ltd acts as data processor on the school's behalf and will enter into a Data Processing Agreement with each subscribing school.
10. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Restrict or object to processing
- Data portability
- Withdraw consent at any time (where processing is based on consent)
- Lodge a complaint with the ICO at ico.org.uk or 0303 123 1113
To exercise any of these rights, email [email protected]. For students under 18, a parent or guardian may exercise these rights on their behalf.
11. Cookies
Marketing website: Google Analytics with anonymised IP addresses. No personally identifiable data is collected or stored. No consent banner is shown because this analytics use falls within legitimate interest under UK ICO guidance. You can opt out at any time using the Google Analytics opt-out browser add-on.
Platform: session cookies necessary for authentication. These are essential to the service and cannot be disabled.
12. Security
We use encrypted data transmission (HTTPS), database-level row security, and role-based access controls. No internet service is completely secure, but we take reasonable steps to protect your data.
13. Changes to this policy
We may update this policy from time to time. For significant changes we will notify users by email or a notice on the platform. The date at the top shows when it was last updated.
14. Contact
Aspiro AI Ltd
[email protected]
If you are not satisfied with our response, you can contact the ICO at ico.org.uk.