Privacy Policy

Who we are

Quiet Space ("we", "us") is a tool for parents and carers of neurodivergent children, operated by Earth Child Project Limited, registered in England and Wales (company number 12597581), registered office The Essex House, Waterworks Close, Layer-De-La-Haye, Colchester, England, CO2 0EP. We are the data controller for the information described here.

What we collect

• Account details: name, email address, contact number if you give one, password (stored hashed) or your Google/Apple sign-in identifier, and your parent PIN (stored hashed).
• Child profile: the name or initials you choose, date of birth or age, diagnoses and traits you record, and the answers you give in the Discover conversations.
• Logs and notes: well-being logs, dysregulation and sensory notes, journal entries, energy profile, schedules and prep notes.
• Documents you upload: OT reports, EHCPs, school assessments, letters and images, plus the summaries we generate from them.
• Conversations with Iris: your messages, Iris's replies, and any voice recordings you make.
• Kid Mode activity: check-ins, emoji diary entries and journal notes your child makes.
• Calendar data: if you connect a calendar, the event titles, times, organisers and calendar names we import, and your keep/hide choices.
• Device and notification data: push subscription tokens and basic device info, so reminders reach the right place.
• Billing data: subscription status and payment references. Card details are handled by our payment provider, we never see or store them.
• Technical and usage data: error logs, request timings, page views and feature usage, including analytics cookies.

Health and neurodivergence data

Much of what you record, diagnoses, traits, sensory needs, well-being patterns, clinical reports, is health data, which UK GDPR treats as "special category" data needing extra care. You provide it as your child's parent or guardian, and we process it on the basis of your explicit consent, given when you create the account and each time you choose to add this information. You can withdraw that consent at any time by deleting the data or your account.

Why we use it, and our lawful bases

• To provide the service you asked for, building your child's profile, powering Iris, schedules, stories and reminders (contract, plus explicit consent for health data).
• To keep families safe, automated safety checks on AI conversations and, where needed, internal safeguarding review (legitimate interests and, where relevant, protection of vital interests).
• To keep the service running and secure, error logs, abuse prevention, backups (legitimate interests).
• To take payment and meet our accounting duties (contract and legal obligation).
• To understand how the app is used and improve it (consent for analytics cookies; otherwise legitimate interests in aggregate).

We do not sell your data, and we do not use your family's data to train AI models.

AI processing

When you talk to Iris, the relevant parts of your child's profile and your message are sent to a third-party AI service to generate a reply in real time. We ask those providers not to retain or train on the content. We reduce what's sent where we can, and strip identifying details out of the excerpts kept in safety records.

Voice recordings

If you or your child use voice features, the audio is sent to a speech-to-text service to produce a transcript, and Iris's spoken replies are generated by a text-to-speech service. We keep the transcript, not the raw audio, beyond the short time needed to process it. Voice data is not used to train models.

Children and Kid Mode

Accounts are held by adults, we don't knowingly create accounts for under-16s. Kid Mode is a supervised space inside your account, protected by your PIN. Anything a child enters belongs to your family record and is visible to you. Nothing a child says is shared outside your account, other than the AI and safety processing described above.

Who processes data for us

We use a small number of trusted suppliers to run Quiet Space. We don't publish their names here, but we can tell you who they are on request. By role, they cover:

• Hosting, database and file storage
• AI model processing for Iris and document summaries
• Speech-to-text and text-to-speech for voice features
• Transactional and newsletter email delivery
• Payment processing and subscription billing
• Web analytics and error monitoring
• Retrieval of publicly available web content for our knowledge base (no personal data involved)

Each is bound by a data-processing agreement, may only act on our instructions, and may not use your data for their own purposes. We may also disclose data where we're legally required to, or where there's a serious safeguarding concern.

International transfers

Some of our suppliers process data outside the UK and EEA, including in the United States. Where that happens we rely on UK International Data Transfer Agreements, the EU Standard Contractual Clauses with the UK Addendum, or an adequacy decision, together with encryption in transit and at rest.

Cookies and analytics

We use essential cookies and local storage to keep you signed in and remember your preferences, these can't be turned off without breaking the app. We also use Google Analytics to understand which pages and features are used, using cookies that identify a browser rather than a person. Analytics data is aggregated and never includes your child's profile content. You can block these cookies in your browser settings.

Emails and push notifications

Service emails (confirmations, password resets, billing) are part of holding an account. Optional prep reminders, weekly round-ups and push notifications can be switched off in Settings or via the unsubscribe link in any email. We record delivery status so we can stop emailing addresses that bounce.

How long we keep things

• While your account is open: your profile, logs, documents and chats stay until you delete them.
• Deleted items: removed from the app immediately and purged from backups within 30 days.
• Closed accounts: deleted within 30 days of your request, apart from anything we must keep by law.
• Safety records: de-identified excerpts kept for up to 3 years so we can review and improve our safeguarding.
• Billing records: kept for 6 years to meet UK accounting requirements.
• Technical logs: typically 90 days.

Storage and security

Data is held in an encrypted database with row-level security, so your records are reachable only by you and the family members you invite. Traffic is protected with industry-standard TLS. Access by our team is limited to what's needed to run the service and support you, and safeguarding review is restricted to trained staff.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of your data, or export it in a portable format
• correct anything inaccurate
• delete your data or your whole account
• restrict or object to certain processing
• withdraw consent for health data or analytics at any time

Most of this you can do yourself in Settings. Otherwise email irfan@quiet-space.ai and we'll respond within one month.

Changes to this policy

We'll update this policy as Quiet Space develops, and tell you by email or in-app about anything material. The version number at the top tells you which policy is current.

Contact and complaints

Email irfan@quiet-space.ai or use the contact page. Company: Earth Child Project Limited, 12597581. If you're unhappy with how we've handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to put it right first.