Privacy Policy

NKITRA is provided by SPHERE TECHNOLOGIES LTD., a company registered in England and Wales with company number 14980410, whose registered office is at 49 St James Street, 4th Floor, London SW1A 1AH, United Kingdom. SPHERE TECHNOLOGIES LTD. is the controller of the personal information described in this policy.

Contact us about this policy, your information or your rights: support@sphere-initiative.com

NKITRA accounts are for adults — parents, guardians and the carers they choose. Children do not use NKITRA and cannot have accounts. We do hold information about children, which their parent or guardian gives us or connects.

NKITRA finds what matters to your child in the sources you choose to connect and shows it to you and the people you authorise.

Today the only source NKITRA connects to is Gmail, and it processes only messages from your child's school that it recognises. We will update this policy, and ask you first, before connecting any other source or processing any other kind of message.

• Your account: your email address (you sign in with a one-time link or code), your name and, if you add one, a profile photo.
• Your family space and child: the family name you choose, your child's name and, if you provide them, your child's date of birth and photo.
• School email, if you connect Gmail: described in section 5.
• What NKITRA works out: actions, dates, deadlines and changes taken from those messages, each linked to the message it came from, and a record of what changed and when.
• Health information: described in section 6.
• Your consent records: who gave or withdrew consent, for which child, for which purposes, in which words and when.
• School Run, if you use it: the run's details, the adults you authorise to coordinate or collect, and each journey step with who recorded it and when. NKITRA does not collect location data.
• Your requests to us, including corrections, feedback and deletion requests.
• Website statistics: described in section 10.

What Google authorises. When you connect Gmail, Google asks you to give NKITRA read-only access to your mailbox (the gmail.readonly permission). That permission covers your whole mailbox. NKITRA cannot send, delete, label or change email.

What NKITRA actually uses. NKITRA searches only for messages from your child's school and reads up to the 50 most recent each time you check. For each of those messages it stores the sender, subject, date, message text, a short preview, the message's Gmail labels, and Gmail's identifiers for the message and its conversation. NKITRA does not read or store your other email, the mail you send, or attachments.

Who can see it. Imported messages can be read only by members of your family space who are its owner or administrator, or who hold permission for your child's school information. Adults you authorise only for a school run are not family-space members and cannot read your school email. Your Google sign-in tokens are kept in a separate store that only NKITRA's servers can read.

No other use. We do not sell Gmail data, use it for advertising, or transfer it to anyone other than the service providers that host NKITRA (section 9), and only to provide NKITRA to you.

No AI. NKITRA works out actions and dates using rules we have written. It does not send your messages to any AI or machine-learning service and does not use Gmail data to develop, improve or train AI models.

No human reading. No one at SPHERE TECHNOLOGIES LTD. reads your Gmail data unless you ask us to (for example, to help with a support request), it is necessary for security or to investigate abuse, or the law requires it.

Limited Use. NKITRA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Stopping access. You can disconnect Gmail in NKITRA at any time. Disconnecting revokes NKITRA's access with Google, deletes the stored sign-in tokens and stops any further reading. You can also remove access in your Google Account at myaccount.google.com/permissions. Disconnecting does not delete messages already imported; they remain until you ask us to delete them (section 11).

School messages can contain health information about your child — for example a vaccination consent letter or an allergy notice. When NKITRA imports a school message, any health information in it is stored with that message, and NKITRA may show you what a health notice asks of you, such as a vaccination consent deadline. This is not a medical record and is never presented as one. NKITRA is not connected to the NHS or any other healthcare provider.

Health information about a child is a special category of personal data. NKITRA processes it only with the explicit consent of the child's parent or guardian. We ask for that consent separately — not as part of accepting these terms or Google's permission screen — before any school email is imported, and we record it for each child. Without it, NKITRA does not import school email or process health information.

You can withdraw consent at any time in NKITRA. From then on NKITRA stops importing school email and stops processing health information. Withdrawing does not delete what was already imported; to ask for that, email support@sphere-initiative.com.

• Providing NKITRA to you — creating your account, importing and organising your school messages, and showing them to the people you authorise: necessary for our contract with you (UK GDPR Article 6(1)(b)).
• Children's health information within school messages: your explicit consent as the child's parent or guardian (Articles 6(1)(a) and 9(2)(a)).
• Keeping NKITRA secure and preventing unauthorised access: our legitimate interests (Article 6(1)(f)).
• Responding to requests, corrections and complaints: our legitimate interests (Article 6(1)(f)), or our legal obligations where a request is a data-rights request (Article 6(1)(c)).
• Website statistics: our legitimate interests (Article 6(1)(f)).

NKITRA uses automated rules to organise school messages, but it does not make decisions about you that have legal or similarly significant effects.

Information in a family space is visible only to people who belong to it and hold the relevant permission; this is enforced in our database. An adult authorised for a school run sees that run only. Sharing a family space with a second parent or another adult is not yet available.

We use these providers to run NKITRA, under their data processing terms:

• Supabase — database, file storage and sign-in, including sending sign-in emails. Data is stored in London, United Kingdom.
• Vercel — hosts the website and the application's server code, and provides website statistics. The server code runs in Washington, D.C., United States.
• Google — only if you connect Gmail, to provide your school messages as described in section 5.

Because NKITRA's server code runs in the United States, information it processes — including imported school messages — is transferred to the US. Supabase's and Vercel's data processing terms, which form part of our agreements with them, include the UK International Data Transfer Addendum to the EU Standard Contractual Clauses for these transfers.

NKITRA uses cookies that are strictly necessary to sign you in and keep you signed in. We count page views with Vercel Web Analytics, which does not use third-party cookies; it counts visitors using a hash of the request that is discarded after 24 hours and reports only aggregated statistics.

We keep your information for as long as your account is active. NKITRA does not currently delete information automatically.

• Google sign-in tokens are deleted as soon as you disconnect Gmail.
• Imported email data: you can ask us to delete it from within NKITRA.
• Your whole account and family space: email support@sphere-initiative.com.
• Consent records are kept as the record of what was agreed, including after withdrawal, for as long as we hold information it relates to.

Deletions are currently carried out by our team rather than instantly in the app. We will complete them, and confirm to you, within one month of your request. Copies may remain in our hosting provider's backups until those backups expire.

You can ask us to access, correct, delete or give you a copy of your personal information; to restrict or object to how we use it; and to withdraw consent where we rely on it. Email support@sphere-initiative.com and we will respond within one month. If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk.

Access to information is controlled by permissions enforced in our database, Google sign-in tokens are stored where app users cannot read them, and information travels over encrypted connections. If a personal data breach is likely to put you at risk, we will tell you and, where required, the ICO.

We will update this policy when NKITRA or our practices change and tell you about significant changes before they take effect. Please also read our Terms.