Writeboard
Sign in
Start free
Privacy notice
Last updated 15 October 2026.
Writeboard is a shared whiteboard for one-to-one tuition, run by Writeboard Ltd, a company registered in England and Wales under number 17460235, registered office 71-75 Shelton Street, London WC2H 9JQ ("we"). This notice says what we store, why, for how long, and what you can ask us to do. Questions to hello@writeboard.uk.
Who is who
Writeboard is run by Writeboard Ltd, trading as Writeboard, and the company is the data controller. It is registered with the Information Commissioner's Office under registration number ZC251517.
Until 17 September 2026 Writeboard was run by Oliver Woodcock as a sole trader, under his own registration ZC235221. On that date the company he owns and directs took over as the controller of the same data, held in the same place under the same rules; nothing about what is stored, who can see it or how long it is kept changed with the name. Every account open on that day is told of the change by email.
A tutor creates an account and adds their students. For the students a tutor adds, the tutor decides what is written on the boards and who may look; we store it on their behalf. For tutor accounts themselves, we are the controller.
What we store
| About | What | Why |
|---|---|---|
| Tutors | Email address, a display name, an optional logo, sign-in sessions (device type, last seen) | To run the account and let you sign in |
| Students | A first name or nickname the tutor chose, a username the student chose, a password hash, an optional email the invite went to or the student added (used for password resets, a reminder the day before homework is due if the student asks for one, and reminders their tutor sends about homework), the date and wording of the tutor's confirmation of authority | To let the student sign in, get back in if they forget, and hear about their homework |
| A student's record, where the tutor or their agency keeps one (since September 2026) | Date of birth and year group; schools attended; subjects with exam boards and target grades; mock and test results; where the enquiry came from; parent or guardian contacts, including phone numbers; documents the tutor uploads, such as school reports, exam entries, correspondence and consent or safeguarding forms; progress reports; a weekly lesson time and what happened to each lesson. A consent or safeguarding form can say things about a child's health or circumstances, and is held because the agency is expected to hold it | So that a tutor or an agency can keep on Writeboard the record they would otherwise keep on paper. Visible only to the people who run that student; never to the student's own sign-in |
| Lessons | Everything written on the boards: ink, text, images and worksheet pages, homework notes and hand-ins; files a tutor puts on a student's shelf for the student and their parents, such as past papers; a recording of the lesson where the team has switched replay on; the lesson note a tutor writes afterwards, which the tutor may email to a parent on file. If the tutor saves a meeting link (Zoom, Meet and so on) we store that link to show a Join button; the call itself never touches us | That is the product |
| Enquiries, where an agency puts Writeboard's enquiry form on its website (since October 2026) | What a parent or guardian sends: their name, email and, if they give it, a phone number; their child's year group and subjects; when they are free; and anything else they write. Nothing else about the child: no name, school or age | So the agency can reply. The agency decides what happens next and is responsible for it; Writeboard keeps it for them. One that becomes a student moves onto that student's record and the enquiry keeps only the link. One that does not is deleted after 90 days, or sooner if the agency deletes it |
| Invoices, where a tutor or their agency invoices through Writeboard (since October 2026) | The rate each student is charged; who pays for them (the contact marked as the one the bills go to: a name and an email); each invoice: who it is to, the students on it, the dates and lengths of their lessons, the amounts, and whether it was paid. For a team: the rate each tutor is paid and what they were paid for | So that a tutor or an agency can invoice from the lessons they record. Paying for a student gives no view of their work. An issued invoice is the tutor's or agency's accounting record, which the law has them keep, so it stays after a student is erased; it never carries a student's work |
| Teams | For a tutoring team or agency: who is on it and in what role, its policies and who has read them, and its own record of what was changed by whom | To run the team, and so that the team can answer for its own record |
| Everyone | A security log of sign-ins and changes with a hashed, daily-salted form of the network address, never the address itself, and the country a sign-in came from | To spot abuse and answer questions about what happened |
| Paying | When you open our payment page: which steps of Paddle's form you reached (the form loaded, details entered, the kind of payment method chosen, a payment tried, completed or refused, and the reason Paddle gives for a refusal). Never your card details, which only Paddle sees. Kept for 90 days | So that when a payment gets stuck we can see where, and help you the same day |
We do not use analytics trackers or advertising cookies. The only cookies are the ones that keep you signed in. Image files have their hidden metadata (location, camera) removed on upload.
Emails from us
Besides the emails you get because you asked for them (signing in, invites, the notifications you chose), Oliver, who runs Writeboard, sometimes writes to tutors and learners about it: a question, help getting started, what changed or an offer. Every one has a link to stop them, and so does Settings, under Notifications. We keep a record of each choice you make, with when and how, so we can show we did as you asked. A notice you need in order to keep using the service, such as a change to these terms, still reaches you. We never track whether an email was opened or a link in it followed.
Children
Students are often under 18 and sometimes under 13. Their own sign-in holds no tracking, and an email only if the invite went to one or the student adds one, used for the three things in the table above and never for marketing. What else is held about a child is decided by the tutor or agency, who can keep the record described in the table above, date of birth and consent forms included, and who alone can see it. The tutor is the person with the relationship with the family: before their first invite they confirm they have the authority to use Writeboard with their students and, for a student under 13, a parent or guardian's agreement. That confirmation, with its date and wording, is recorded on each sign-in it creates. A parent can ask the tutor, or us, for a copy of everything held about their child or for it to be deleted. There is a page written for students at /privacy/students.
A Learner account is different: somebody signs up with their own email for their own notes, and must be 13 or over, confirmed when the account is made and recorded with its date. We hold their email, their notes and nothing else new; everything above about export, deletion and never selling data applies the same.
Who else handles the data
| Service | What for | Where |
|---|---|---|
| Vultr | The server the app runs on | London, United Kingdom |
| Backblaze | Continuous encrypted backup of the database | European Union (its EU Central region, since 9 October 2026). Backblaze is a US company, so its own access is under the UK-US data bridge |
| Cloudflare | A second nightly backup of the database, with a different company so that one failing is not both | European Union (R2, EU jurisdiction) |
| Supabase | Tutor sign-in (email and password, verification emails) | United Kingdom (London) |
| Only if you choose it. Continue with Google: Google tells our sign-in service your name and email. From Google Drive: Google's file picker opens in your browser, and the file you choose comes straight to us. Google is the controller of your Google account, under its own terms | Google's own, as its privacy policy says | |
| Resend | Sending the product's emails (invites, password resets, notifications) and the founder's emails | United States, under standard contractual clauses |
| Paddle | Taking payment for paid plans. Paddle is the merchant of record, which means Paddle is the seller on your receipt, charges any VAT or sales tax due where you live, and answers questions about the payment itself. Paddle holds your name, email, billing address and the card you type into Paddle's own page | Paddle.com Market Ltd, London, United Kingdom; card data never reaches our server |
| Stripe | Held the same details for payments taken before September 2026 (in practice only the founder's own test payments); no new payments go through Stripe | Stripe Payments Europe Ltd, Ireland |
How long
While the account is open. When a tutor removes a student, the lessons wait 30 days in a bin, in case it was a mistake, then are removed for good; backups follow within a further 30 days. The student's record and documents are removed when a team admin erases the student, or when the tutor, a parent or the student asks us to. The security log is kept for 12 months. A tutor can delete their whole account from Settings. When a team closes, everything of it is read-only for 30 days so everyone can take a copy, then every student and the team's own records are removed for good; backups follow within a further 30 days.
Your rights
You can ask for a copy of your data (tutors: "Your data" in Settings, as one zip; students and parents: through the tutor, or write to us), ask for it to be corrected or deleted, and complain to the Information Commissioner's Office (ico.org.uk, quoting our registration ZC251517). We answer within one month.
Lawful basis
For tutors' own accounts: the contract with the tutor, and our legitimate interest in keeping the service secure. For the founder's emails: our legitimate interest in telling the people who use Writeboard about it, with a way to stop them in every one. For what is written about students: the tutor is the controller and we process on their instructions; where a parent's agreement is needed, the tutor obtains it and confirms so to us. Where a safeguarding report is made about a tutor, we may preserve their boards and open them, read-only, to assess the report or to answer a lawful request from the police, a local authority or a court, reading no more than that needs; each opening is recorded with its reason. For that we rely on the law's requirements and on protecting a child from harm.
Changes to this notice
When this notice changes in a way that affects how your information is used, we email the accounts it affects before the change takes effect. Every change is listed here with its date.
- 15 October 2026. Lawful basis: after a safeguarding report about a tutor, we may open their preserved boards, read-only, to assess the report or answer a lawful request, and each opening is recorded with its reason.
- 11 October 2026. How long: what happens when a team closes. Your rights: Your data in Settings takes a copy of everything as one zip. What we store, and the page for students: a student's email also carries the homework reminders they ask for and their tutor's reminders, as it always has; the page for students now names the people at an agency who can open a student's pages. Who else handles the data: Supabase, for tutor sign-in, is in London; this said the European Union.
- 10 October 2026. What we store: enquiries a parent sends through an agency's form, and that one never made into a student is deleted after 90 days. Nothing changes for anybody whose agency does not use the form.
- 9 October 2026. What we store: files a tutor puts on a student's shelf. Google named, for Continue with Google and the Google Drive picker. Backblaze's backup moved to its EU Central region.
- 8 October 2026. What we store: the steps of Paddle's payment form you reached, kept for 90 days.
- 5 October 2026. The switch that stops Oliver's emails moved to Settings, under Notifications.
- 2 October 2026. Emails from us, added; Resend named for all the product's emails and Oliver's.
- 1 October 2026. Final after a solicitor's review; the draft notice removed.