Privacy Policy

Last updated: 27 October 2026

The short version.

A school chooses Pria. Its information, and its families’ information, belong to the school. We look after it for the school, and use it for nothing else.
Pria answers families only from what their own school has published. It never uses one school’s information for another, and never searches the internet.
Each school’s information is kept in its own region. The central systems we run hold no information about families or children.
Before a question reaches an AI model, names, email addresses and phone numbers are taken out of it.
We never sell personal information, use it for advertising, or use it to train AI models.
This website uses no cookies and no analytics.
To see, correct or remove your family’s information, ask your school. For anything else, write to [email protected].

1. Who we are, and our two roles

PriaHQ (“PriaHQ”, “we”, “us”) makes Pria, which helps schools answer the questions their families ask, from what the school itself has published, and brings in a member of staff when a question needs a person. This policy explains what personal information we handle, why, and what you can do about it. It covers this website (priahq.com), Find your school (app.priahq.com) and the Pria app.

We have two roles, and the difference matters.

For this website, and for the schools and people who deal with us directly, we decide how information is used. We are its controller. That covers visitors to this site, people who contact us or book a conversation, and the staff at schools we work with, in their dealings with us as a supplier.
Inside Pria, we handle information on behalf of the school that uses it: families’ accounts, children’s records, questions, messages and the school’s own documents. The school is the controller and we are its processor. We act only on the school’s documented instructions, under a written agreement with it. The school’s own privacy notice explains how it uses your information, and your rights over it are exercised through the school (section 10).

Our Data Protection Lead oversees how we handle personal information. You can reach them at [email protected].

2. The information we collect

Visiting this website

This website has no accounts, no forms that store what you type, no cookies and no analytics. Like any web server, the one it runs on records each request briefly for security and to keep the site working: your IP address, the page asked for, the time, and your browser’s description of itself. To show our typefaces, your browser fetches them from Google Fonts, which receives your IP address as part of that request.

Contacting us, or booking a conversation

When you write to us or book a conversation, we receive what you choose to send: usually your name, email address, school and role, and your message. We use it to reply, and, if your school becomes a customer, to work with you.

Find your school

Find your school asks which school you are looking for, and never who you are. It receives the letters you type to search for a school. Unless you untick “Remember my school on this device”, it keeps a note of which school in a cookie (section 11). Nothing you type there is linked to you.

In Pria, on behalf of your school

What the school provides, and what is created as the school, its staff and its families use Pria:

Accounts: name, email address, phone number where given, preferred language, how the person signs in (a password we store only in scrambled, one-way form, the school’s own sign-in such as Google or Microsoft, or a passkey), and two-step verification settings.
The school’s roll: the children and the parents and carers the school records, and how they are related. For each child: name, year group, class, and the details the school chooses to share, such as a timetable, clubs, kit and whether fees are due. This usually comes from the school’s management information system.
What families and staff do in Pria: questions asked and the answers given, whether an answer helped, messages between families and the school, notices and replies, forms and consents, bookings, payment records, notifications of an absence or a collection change, and any photos sent with them.
Safeguarding and wellbeing: where a message raises a concern about a child’s safety or wellbeing, Pria brings it to the school’s safeguarding lead. The record of that concern, and how the school handled it, is kept for the school.
The school’s own information: the handbooks, letters, calendars and web pages it gives Pria to answer from, and the answers its staff write.
Records that keep Pria safe: an audit log of what was done and by whom, and technical records such as errors and the device a notification is sent to.
Where you reached Pria from: each time you sign in, and when you use Pria (at most every fifteen minutes, or sooner when your network address changes, such as moving from Wi-Fi to mobile data), the time, your network (IP) address, the device, and an approximate place worked out from that address. The place is worked out on Pria’s own server, from a location database kept there, so your address is never sent to anyone to be looked up. It is a best guess: usually the right country, often only roughly the right city. Your school’s administrators can see it, to look into a sign-in nobody recognises.

We do not ask for, and Pria is not designed to hold, information about health, religion or ethnicity beyond what a school chooses to publish or a family chooses to write.

On your phone, in the Pria app for iPhone

The app is Pria, for families. To find your school the first time, it asks Find your school with the letters you type, as the website does; after that it talks only to your school’s own Pria. On the phone it keeps:

What you have already seen, so it opens without a connection. That covers the day’s briefing, messages, the timetable, contacts and your recent questions to Pria. It is kept in the app’s own storage on the phone, and left out of iCloud and computer backups.
Anything you send while offline, such as a reply or an absence, until your school has it. Once it has arrived, the app clears it away after a day.
Your sign-in to your school, in the phone’s Keychain, never moved to another phone.
A key for notifications, also in the Keychain. Its public half is given to your school, so that notifications can be sent to you privately (section 7).
The school you last signed out of, its name, town, short name and web address, which PriaHQ region it is in, and its colours, nothing about you, so that the sign-in page can open on it next time.
Whether you turned on Face ID or Touch ID, or said “Not now”, for each account at each school, so that you are not asked again. It is kept with the app’s settings, which are included in the phone’s backups, under a scrambled, one-way form of your email address rather than the address itself.

Signing in with Face ID or Touch ID. If you turn it on, your phone makes a passkey: a pair of keys, one private and one public. The private key is kept by your phone’s password manager (on an iPhone, the iCloud Keychain, which may keep it on your other Apple devices, encrypted end to end) and is used only after Face ID or Touch ID confirms it is you. Your face and fingerprint never leave your phone, and neither we nor your school ever receive them. Your school keeps the public key, a name for it (such as “iPhone”), when it was made and when it was last used, and the details needed to check it: its identifier, a count of its uses, how it connects, and whether your phone keeps it in iCloud. Passkeys work the same way on the web with a computer’s own lock, such as Touch ID or Windows Hello. You can remove a passkey at any time in Pria’s settings, and changing your password removes them all. Removing one from Pria does not delete it from your phone; your phone’s own password settings do that.

Photos you add to Share a success are redrawn on your phone before they are sent. Where and when the photo was taken, and the camera it was taken with, are removed, and only your school receives the photo.

Signing out of a school removes from the phone what the app kept for that school, including anything still waiting to send, except the two notes above: which school it was, with its colours, and whether you turned on Face ID or Touch ID. Deleting the app removes those too. The app contains no advertising, analytics or tracking, and never asks for your location. If you test Pria through Apple’s TestFlight, Apple shares with us the crash reports from the app, and any feedback or screenshots you choose to send.

3. How we use it, and why we may

Where we decide (this website and our own dealings)

To run and protect this website: because we have a legitimate interest in keeping it working and secure.
To answer you, and to arrange and hold a conversation: because you asked us to, and it is in both our interests that we reply.
To provide Pria to a school and to manage our relationship with it: to perform our contract with the school.
To meet our legal obligations, such as keeping financial records.

In Pria (on the school’s behalf)

We use information in Pria only to provide Pria to the school, as the school instructs:

answering families’ questions from the school’s own published information;
bringing a question to the right member of staff when it needs a person;
delivering the school’s messages, notices, reminders and replies by the channels the school has turned on;
alerting the school’s safeguarding lead to a concern;
showing the school where its information is missing or unclear. Staff see the questions families ask, but on those screens they are not shown which family asked.
keeping Pria secure, and finding and fixing faults.

The school decides the lawful basis for this, which is usually its public task or legitimate interests in running the school and communicating with families. We never use information from Pria for our own purposes: not for marketing, not to profile anyone, and not to build products for anyone else. We never sell it.

Pria makes no decision about anyone that has a legal or similarly significant effect on them. Where something needs a judgement, a member of the school’s staff makes it.

4. How Pria uses AI

To answer a question, Pria finds what the school has published that is relevant to it, and asks an AI model to write an answer from that alone. Before an answer is shown, Pria checks that every date, time, price and name in it can be found in what the school published. An answer that cannot be checked is not shown; Pria says it does not know, and offers to ask a member of staff.

Taken out before it leaves: before a question and the school’s text are sent to the model, the names of children and families, email addresses and phone numbers are replaced with placeholders. The model never sees them, and they are put back into the answer only once it returns. Schools have this on by default.
Documents: a scanned document or a photo cannot have names taken out in the same way. Each school decides whether such files may be read by the AI model, or must be read on Pria’s own servers instead.
The providers: the AI models Pria uses are provided by Google, OpenAI and Anthropic. Each school’s region uses the providers its school has chosen. They process the text only to produce the answer, under terms that do not allow them to train their models on it and that limit how long they may keep it.
No training on your information: neither we nor our providers use information from Pria to train AI models. Pria learns nothing about one school from another. Only a school’s staff can add to what Pria knows about that school.

5. Where it is kept

Pria runs in regions. Each school’s information, including its families’ and children’s, is stored and processed in the region the school was set up in, and does not leave it except as this section describes. Our first region is in the United Arab Emirates.

Our central systems hold no information about families or children. The portal our team uses to run Pria sees only what each region reports about its schools: their names, settings and totals, such as how many questions were asked this week. It cannot reach into a region.
Find your school holds only schools’ names, towns and short codes.
AI providers may process the text of a question outside the school’s region, after names and contact details have been taken out (section 4).

Where personal information is transferred to a country that does not offer an equivalent level of protection, we use appropriate safeguards, such as standard contractual clauses approved for that purpose, together with the measures described in section 9.

6. How long we keep it

We keep personal information only as long as it is needed. In Pria, the school sets how long:

Everyday records (questions and answers; notifications to the school, such as an absence, and any photos sent with them; conversations with the school; messages received through WhatsApp; records of what was delivered to whom; reminders; usage; and ordinary audit records) are deleted automatically after the period the school chooses. That is 24 months unless the school sets another.
Safeguarding, harm, missing-child and bullying cases, and the conversations they were handled in, are never deleted automatically. They are kept until the school deletes them, or until the family’s information is erased at their request, because a school may need them long after the event.
Where you reached Pria from is kept for 90 days, whatever the school’s period. Only the latest sign-in and the latest use are kept on the account after that.
Accounts and the roll are kept while the school keeps the person on it. When a family’s information is erased, their account and everything recorded against it go with it. A record that the erasure happened is kept, so the school can show it did what was asked.
A school’s own published information is kept until the school removes it.
When a school stops using Pria, its information is erased after a 30-day window in which the decision can be reversed. Copies in backups are removed as the backups are replaced, within 35 days.

For our own records: the website’s request records are kept for 30 days; correspondence with people who contact us is kept for 24 months after our last contact, unless we go on to work together; and records we must keep by law, such as invoices, are kept for as long as the law requires.

7. Who we share it with

We share personal information only with organisations that help us provide Pria, under written agreements that require them to protect it and use it only on our instructions. These are our sub-processors:

Hosting: the data centre each region runs in.
AI models: Google, OpenAI and Anthropic, as section 4 describes.
Email: the school’s own mail service, or the email delivery service we use on the school’s behalf.
WhatsApp: Meta, where a school turns WhatsApp on for its families.
Notifications: the push services of Apple, Google and your browser, which deliver a notification to your device. A browser’s notifications are encrypted by the web’s own standard. For the Pria iPhone app, we encrypt each notification to your phone before it leaves your school’s region. Apple sees that a notification was sent, and to which device, but not what it says.
The school’s own systems: its management information system (such as iSAMS or Arbor), and its sign-in service (such as Google or Microsoft), where the school connects them.
Payments: the payment provider a school chooses (such as Stripe, Telr or Network International), where the school takes payments through Pria. Card details go straight to the provider; Pria never sees or stores them.

A school can ask us for the current list of sub-processors at any time, and we tell our schools before we add one. We disclose personal information to anyone else only where the law requires it, such as a valid order from a court or regulator, and we tell the school concerned unless the law forbids us. If PriaHQ’s business were ever transferred, this policy, and our agreements with schools, would go with it.

8. Children’s information

Pria is used by parents, carers and school staff. Children do not have Pria accounts, and nothing on this website is aimed at children. Information about children comes from their school, and is handled with particular care:

Pria tells a family only about their own children. It will not tell anyone about another family’s child, or name one in an answer.
Someone a parent gives access to, such as a grandparent or a childminder, sees only the children the parent chose, and only what the parent allowed. That access ends the moment the parent withdraws it.
Children’s names are taken out of anything sent to an AI model (section 4).
A concern about a child’s safety goes to the school’s safeguarding lead, and is visible only to the people the school has chosen to handle safeguarding.
We never use children’s information for marketing or profiling, and never share it with anyone except as section 7 describes.

9. How we protect it

Encryption: information travels over encrypted connections, and passwords, keys and other secrets are stored encrypted or in one-way scrambled form.
Separation: each region is separate, and each school’s information is kept apart from every other school’s. Every request is checked against the school it belongs to.
Access: staff at a school see only what their role allows. Two-step verification is required for our own team, and a school can have its staff sign in through its own Google or Microsoft accounts, with the protections the school has set there.
Our access, only when needed: our team cannot see a school’s families or children in the normal course of running Pria. If a school needs our help from inside its account, we open temporary access that is time-limited and recorded in the school’s audit log. The school’s administrators are told when it is opened.
A record of what is done: significant actions in Pria are written to an audit log that the school can review.
Backups: each region is backed up, and every upgrade makes a fresh backup first.
If something goes wrong: if we become aware of a breach affecting a school’s information, we tell the school without undue delay, and in any case within 48 hours of confirming it, so that it can meet its own obligations. For our own records, we tell the relevant regulator, and anyone affected, as the law requires.

10. Your rights

Depending on where you live, you have rights over your personal information. These include the right to:

ask for a copy of it;
have it corrected, or erased;
restrict how it is used, or object to it being used;
receive it in a form you can take elsewhere;
withdraw consent where we rely on it.

For information in Pria, ask your school: it is the controller, and it decides. Pria lets a school give a family everything held about them, or erase it, and we help the school do so promptly. If you write to us about information in Pria, we pass your request to your school and let you know we have.

For information we hold as controller, write to [email protected]. We reply within one month, and tell you if we need longer and why. There is no charge. We may ask you to confirm who you are before we act.

11. Cookies

This website uses no cookies. Find your school and the Pria app use only the cookies they need to work. There are none for advertising or analytics, and none from anyone else.

Cookie	Where	What it is for	How long
`pria_school`	Find your school	Remembers which school you chose, unless you untick it, so next time it takes you straight there.	One year, or until you turn it off
`__Host-pria_session`	Pria	Keeps you signed in.	Until you close your browser, and 12 hours at most; or 14 days if you choose “Remember me”
`__Host-pria_oauth`, `__Host-pria_invite`	Pria	Complete a sign-in through your school’s own account, or an invitation, safely.	10 minutes
`__Host-pria_add_profile`	Pria	Keeps your place while you add a second school to your account.	15 minutes
`pria_known`	Pria	Remembers that you have signed in on this browser or phone before, so you can still sign in here while somebody elsewhere is trying to guess your password. It does not sign you in, and it stays when you sign out.	One year from your last sign-in
`__Host-pria_task`	Pria	Opens a payment, a booking or a form you chose in the Pria iPhone app, and only that page, without signing in again.	30 minutes, or until you sign out of the app

Pria also remembers, on your own device, whether you last asked it to remember you, so the switch is set the way you left it. That stays in your browser and is not sent to us.

The Pria iPhone app uses the same __Host-pria_session sign-in, kept in the phone’s Keychain rather than in a browser, for 14 days, and keeps pria_known there too. A payment, a booking or a form opens in a browser view inside the app, through a link that works once and for two minutes. That view is given __Host-pria_task for that one page, never the app’s sign-in.

12. Changes to this policy

We will update this policy when what we do changes, and show the date of the latest version at the top. If a change is significant, we tell our schools at least 30 days before it takes effect. Where it affects families, we ask the school to tell them, or tell them in Pria.

13. Contact and complaints

For anything about privacy, write to our Data Protection Lead at [email protected]. For anything else, write to [email protected].

If you are unhappy with how your information has been handled, please tell us first, so we can try to put it right. You also have the right to complain to a data protection regulator: in the United Arab Emirates, the UAE Data Office; in the United Kingdom, the Information Commissioner’s Office; in the European Union, the supervisory authority where you live; or the regulator for wherever your school is. For information in Pria, your school’s own complaints process is often the quickest way to a resolution.