Privacy Policy
Last updated: 16 October 2026
Effective date: 21 October 2026
1. Who We Are
This Privacy Policy explains how we, SLPractice Ltd (company number 17070357, registered at 12 Hillside Road, St Albans, AL1 3QL, UK), collect, use, store, and share your personal data when you use our platform at www.slpractice.com (the "Service"). Contact us at support@slpractice.com with any questions.
We are the controller of the personal data you provide to us when you use the Service, such as when you create an account, purchase a subscription, or create resources. However, when a professional (such as a speech and language therapist or educator) inputs Client Data - information about the children, students, or other people they work with - that professional (or the organisation they work for) is the data controller and we act as their data processor under our DPA. If you have any questions about how Client Data is processed, please contact that professional (or the organisation they work for).
Plain-English Summary
Before the full policy, here are the key points:
- We collect minimal data, such as your email, display name, and how you use the Service.
- We use your data to run the Service - to log you in, process payments, and improve the product. We don't sell your data.
- AI processing involves third parties. When you create or edit a resource, your inputs are sent to AI providers (such as OpenAI and Fal) to generate content.
- Your data stays yours. You can view, update, export, or request deletion of your data by emailing support@slpractice.com.
2. What Data We Collect
2.1 Account data (data you provide)
When you create an account, we collect your email address, display name, and optional preferences (such as language and user type). We authenticate you via a one-time passcode sent to your email - we do not store passwords. We use this data to identify you within the Service, authenticate your login, and tailor your experience.
2.2 Content you provide
When you create or edit resources, we collect the content you provide, such as prompts, chat messages, images you upload, and voice dictation. Where this content includes information about the children, students, or other people you work with, it is Client Data (see Section 1).
2.3 Play activity data
When a resource is played, we record how it is played, such as answers and progress. Play activity linked to a profile, or recorded through a link a professional has shared, is Client Data. Play without an account is saved against an anonymous session on the device.
2.4 Billing and payment data
We use Stripe to process payments. We store:
- Your Stripe customer ID (a reference number, not your card details).
- Subscription tier, status, and billing interval.
- Credit usage per billing period.
We do not store your payment card number, bank account details, or billing history. This information is held exclusively by Stripe. See Stripe's Privacy Policy.
2.5 Usage and analytics data
We automatically collect certain data when you use the Service:
| Data | Source | Purpose |
|---|---|---|
| IP address | Login sessions, page requests | Security, fraud prevention, approximate location |
| Browser and device information | Login sessions | Security, compatibility |
| Feature usage and interactions | Amplitude (analytics) | Product improvement |
| Page views and session data | Amplitude | Understanding user behaviour |
| Error logs | Sentry (error monitoring) | Debugging and reliability |
2.6 Cookies and similar technologies
We use cookies and similar technologies (such as local storage) to keep you signed in, to run play sessions (including the anonymous sessions described in Section 2.3), to provide live chat support (Crisp), and to measure how the Service is used (Amplitude). With your consent, we may also use advertising cookies, and tell advertising platforms when you sign up or subscribe, to measure and improve our ads. You can change your choice at any time.
You can turn off analytics on this device at any time:
2.7 CRM and communications data
We provide live chat support and keep basic professional information in our CRM to support onboarding, communications, and understanding our user base.
3. How We Use Your Data
We use your personal data for the following purposes:
| Purpose | Data used |
|---|---|
| Provide the Service | Account data, content you provide, resource configurations, play activity data - to generate and deliver therapy resources and save play progress |
| Process payments | Stripe customer ID, subscription data - to manage billing |
| Communicate with you | Email address - for account notifications, onboarding, and support |
| Improve the Service | Usage analytics and how resources are created and used - to understand how features are used, maintain quality, and prioritise improvements |
| Ensure security | IP addresses, session data - to detect and prevent unauthorised access |
| Customer relationship management | CRM data - to support your onboarding and understand our user base |
| Sales outreach | Name, work email, and workplace of professionals we receive from third parties (see Section 10) - to tell them about the Service |
| Marketing emails | Email address and name - to send you product updates, tips, and offers about the Service. You can unsubscribe at any time via the link in every email |
| Advertising (with consent) | Identifiers (such as cookie IDs), and whether you signed up or subscribed after seeing an ad - to measure and improve our ads |
We do not use Client Data for marketing or advertising.
4. Legal Basis for Processing
Under UK GDPR, our legal bases for processing your data for the purposes described above are:
| Legal basis | Applies to |
|---|---|
| Legitimate interests (Article 6(1)(f)) | Provide the Service, process payments, communicate with you, improve the Service, ensure security, customer relationship management, marketing emails, sales outreach |
| Consent (Article 6(1)(a)) | Advertising cookies - you can withdraw your consent at any time by emailing support@slpractice.com |
| Legal obligation (Article 6(1)(c)) | Keeping billing and tax records for as long as the law requires |
Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. A detailed balancing assessment is available on request. You have the right to object to any processing based on legitimate interests by contacting support@slpractice.com.
5. AI Processing and Sub-Processors
When you create or edit a Resource, or use features that summarise play activity, the relevant inputs, including any Client Data, are sent to third-party AI services to generate content, index it for search, screen it for personal information, and log those requests. Our AI providers, including the coding tools we use, do not use your inputs or Client Data to train their models.
Beyond AI providers, we use additional third-party services to operate the platform. The following table lists our sub-processors:
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Account data, content you provide, Client Data, Resources | EU |
| Stripe | Payment processing | Billing data, Stripe customer ID | US |
| OpenAI | AI text generation, image understanding, and coding tools | Account data, resource inputs, play activity data, Client Data | US |
| Fal | AI image and audio generation | Resource inputs, Client Data | US |
| TypeSafe AI | Content screening before community sharing | Resource inputs, Client Data | US |
| Fireworks AI | AI text generation, image understanding, and content embeddings | Resource inputs, play activity data, Client Data | US |
| ElevenLabs | AI voice generation and speech-to-text | Resource inputs, Client Data | US |
| LangSmith (LangChain) | AI request logging and monitoring | Resource inputs, play activity data, Client Data | EU |
| Anthropic | AI coding and support tools | Account data, content you provide, Client Data | US |
| Amplitude | Product analytics | Usage data, user ID | EU |
| Sentry | Error monitoring | Error logs, IP address, user ID | EU (DE) |
| Crisp | Live chat and customer support | Email, display name, user ID | EU |
| Attio | Customer relationship management | Account data and workplace | EU/US |
| Resend | Email delivery | Email address, name | US |
| Google Workspace | Email and documents | Account data, content you provide, Client Data | Global |
| Granola | Meeting notes | Account data, content you provide, Client Data | US |
| Instantly | Sales outreach emails | Name, work email, workplace | US |
| Vercel | Application hosting | All request data (in transit) | US/EU |
| Render | Backend application hosting and transient response caching | All request data (in transit), logs, in-memory AI response streams | EU/US |
| QStash (Upstash) | Background job processing | Resource generation job data | US |
| Conductor | Development workspaces | Account data, content you provide, Client Data | US |
| n8n | Workflow automation for internal notifications and CRM updates | Account data, content you provide | EU (DE) |
| Slack | Internal team notifications | Account data, content you provide | US |
Advertising platforms act as independent controllers of the data their cookies collect, under their own privacy policies.
6. International Data Transfers
Your primary data is stored in the EU (Supabase). Some sub-processors are located in the US or elsewhere outside the UK and EU. For these transfers, we rely on the UK-US Data Bridge (where certified) or UK International Data Transfer Agreements / Standard Contractual Clauses. See the sub-processor table in Section 5 for details.
7. Data Retention
We retain your data while your account is active. When your account is closed, we delete your data from our systems within 14 days, except billing records, which we keep for as long as the law requires. Copies held by our service providers are deleted on their own schedules.
8. Your Rights
Under UK GDPR, you have rights to access, correct, delete, export, restrict, and object to processing of your personal data. To exercise your rights, email support@slpractice.com. We will respond within the timeframes required by applicable law.
9. Security
We implement appropriate technical and organisational measures to protect personal data. Primary data storage is in the EU. Payments are processed by Stripe (PCI DSS Level 1). We use Sentry for error monitoring, which may process IP addresses and user identifiers for debugging purposes.
10. Data We Receive from Third Parties
We may receive professional data (name, email, workplace) from enrichment services or referrals, solely about adult professionals, to aid our sales efforts. You can opt out of marketing or request deletion at any time by contacting support@slpractice.com.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes:
- We will notify you by email before the changes take effect.
- We will update the "Last updated" date at the top of this page.
We encourage you to review this policy periodically.
12. Contact Us and Complaints
Contact
If you have any questions about this Privacy Policy or how we handle your data:
- Email: support@slpractice.com
- Address: SLPractice Ltd, 12 Hillside Road, St Albans, AL1 3QL, United Kingdom
Complaints
If you are not satisfied with how we have handled your data, you have the right to lodge a complaint with us at support@slpractice.com. You also have the right to lodge a complaint with the UK's supervisory authority:
Information Commissioner's Office (ICO)
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF