fab.school

Privacy policy

Version 2026-10-01

Draft. This describes what fab.school actually does with data today, but it hasn't been reviewed by a lawyer. Have it checked — and name your data controller and contact address — before relying on it.

What we collect

From the parent: name, email, phone if you give it, country and timezone, and a record of what you booked and paid. About each learner: a first name and birth year, plus anything you choose to add about their interests or support needs. We ask for a first name only — please don't give us a child's full name, school or address. Payments are taken by Stripe; we never see or store your card number.

Why we have it

To run your bookings and take payment, to let a teacher know who is joining their class, to send the emails a booking needs — confirmations, reminders, receipts — and to keep the accounts that tax and company law require us to keep. Marketing email is separate and only goes to people who asked for it.

Children's information

A child's data is held under the parent's account and the parent controls it. Teachers see only the first name and age of the learners in their class, plus any support needs you chose to share. Teachers must not record learners or ask for personal details. You can edit or remove a learner at any time from your dashboard.

Marketing email

Only if you opted in. Every marketing email carries a one-click unsubscribe, and unsubscribing is immediate. In the EEA, the UK and Switzerland the opt-in box starts empty, because consent there has to be an active choice. Booking confirmations, reminders and receipts aren't marketing and are sent regardless.

Who else sees it

Our suppliers, each for one job: Supabase (database and sign-in), Stripe (payments), Amazon SES (email), Daily.co (the live classroom), Mux (recorded video) and Vercel (hosting). They act on our instructions. We don't sell your data or share it for anyone else's advertising.

Where it lives

On servers in the regions our suppliers operate, which may be outside your country. Where data leaves the EEA or UK we rely on the standard contractual clauses those suppliers offer.

How long we keep it

Your account for as long as you have one. Payment and invoice records for eight years, because tax law requires it. Support conversations for two years. Sign-in codes for 24 hours. Close your account and we delete what we aren't required to keep.

Your rights

Ask us for a copy of your data, a correction, or deletion. In the EEA and UK you can also object to processing, ask us to restrict it, and complain to your data protection authority. Email or use the chat and we'll respond within 30 days.

Cookies

We set what's needed to run the site: your sign-in session, your language, and a referral code if you arrived through someone's invite link. We don't run advertising or third-party analytics cookies, which is why there's no cookie banner.

See also the terms of use.