Privacy Policy

Last updated: 10 September 2026

We've written this policy in plain English. We want you to understand exactly what we do with your data — and why.

1. Who we are

Dottie ("Dottie", "we", "us", "our") is an invoicing and business management tool built specifically for UK childminders and childcare professionals. Our service is available at www.godottie.cloud.

We are the data controller for the personal data you provide to us. If you have any questions about this policy or how we handle your data, please contact us at support@godottie.cloud.

2. Data we collect

We collect the following categories of personal data:

Account & profile data

  • Full name and email address
  • Phone number
  • Home or business address (including postcode)
  • Ofsted registration number (optional)

Financial data

  • Bank account name, sort code, and account number (for inclusion on invoices you send to parents)
  • Subscription payment details (processed by Stripe — we do not store raw card numbers)

Children's data (entered by you)

  • Child's first and last name
  • Child's date of birth (used to verify parent identity when accessing invoices)
  • Parent or guardian name, email address, and phone number
  • Care schedule (days and session types)
  • Childcare rates
  • Any notes you choose to add

Usage and technical data

  • Log data (browser type, IP address, pages visited) — retained for security purposes
  • Authentication tokens managed by Supabase

We collect only what is necessary to provide the service. Children's dates of birth are used to verify parent access to invoices. Extra-needs notes you type on an enquiry can be health data (Article 9) — see Children's data below.

3. How we use your data

  • To create and manage your account
  • To generate, store, and send invoices on your behalf
  • To display your bank details on invoices you send to parents
  • To allow parents to securely access their child's invoices (using DOB as verification)
  • To process subscription payments via Stripe
  • To send transactional emails (welcome, trial reminders, payment confirmations) via Resend
  • To generate draft invoices and parent-enquiry replies using AI assistance (xAI Grok) — see Third-party Processors
  • To provide expense tracking and tax-year reports
  • To respond to support requests
  • To comply with our legal obligations

4. Parent enquiries

Dottie Enquiries helps you draft replies to parents who have asked for a childcare place. You paste the parent's message into Dottie. Dottie does not currently connect to Gmail or read your inbox.

What we store

  • We store the parent facts and messages you enter (name, email, child age, days needed, and any extra-needs notes you type).
  • We store AI drafts so you can read them before anything is sent.

How sending works

  • Nothing is sent to a parent until you send it — Dottie drafts a reply in your voice. You copy it, or you tick send on an outcome letter.
  • Auto-send is not on. There is no inbox connection to pause or disconnect yet.

How long we keep enquiry data

  • Enquiry threads we store are kept for 365 days by default.
  • Retention is configurable (you or we can set a different period where the product allows).
  • After retention ends, we delete or anonymise that enquiry data as described in this Privacy notice.

AI processing (xAI, Anthropic failover)

  • Drafting enquiry replies uses AI services from xAI (Grok). If xAI is unavailable, drafting may fall back to Anthropic (Claude). You send the reply yourself (copy, mailto, or an explicit send tick). Extra-needs / SEN notes are stored for you and are not sent to those AI processors.
  • Drafting may involve a transfer of enquiry content to the United States (or other locations where xAI or Anthropic process data). We only send what is needed to draft the reply for that enquiry thread.
  • See the subprocessors / international transfers section for more detail.

What we do not claim / do not do via Gmail

  • We do not run a full mailbox sync for unrelated personal or business mail.
  • Soft Launch Gmail Enquiries is not WhatsApp, medical records access, or DfE systems via Gmail.

5. Lawful basis for processing

Under UK GDPR, we rely on the following lawful bases:

Processing activityLawful basis
Providing the invoicing serviceContract (Article 6(1)(b))
Generating parent-enquiry AI draftsContract (Article 6(1)(b))
Processing subscription paymentsContract (Article 6(1)(b))
Sending transactional emailsContract (Article 6(1)(b))
Security monitoring and fraud preventionLegitimate interests (Article 6(1)(f))
Complying with tax/legal obligationsLegal obligation (Article 6(1)(c))

Children's dates of birth are processed under contract (necessary to provide invoice verification) and legitimate interests (preventing unauthorised access to financial documents).

6. Third-party processors

We use the following sub-processors to provide our service. Each is bound by their own privacy policies and, where applicable, Data Processing Agreements (DPAs):

SupabaseEU/UK

Database, authentication, and file storage

StripeEU/UK

Subscription payment processing

ResendEU

Transactional email delivery

Anthropic (Claude AI)USA (Standard Contractual Clauses apply)

AI-assisted invoice generation, and (when xAI is unavailable) failover drafting of enquiry replies for Soft Launch Gmail Enquiries. Sending the reply is via the childminder’s Gmail, not via Anthropic. We only send what is needed to draft that reply. When invoices are auto-generated, schedule and rate data is sent to Anthropic's API. No child names or contact details are included in these invoice requests.

xAI (Grok)USA (or other locations where xAI processes data)

Drafting enquiry replies for Soft Launch Gmail Enquiries. Sending the reply is via your Gmail (gmail.send), not via xAI. We only send what's needed to draft the reply for that enquiry thread.

We do not sell your data to third parties. We do not use your data for advertising or profiling.

7. Children's data

As a childminder, you enter data about the children in your care. This data belongs to you and is used solely to provide the invoicing service. We act as your data processor for this information — you are the data controller for the children's data.

By using Dottie, you confirm that you have appropriate consent or another lawful basis (such as the performance of a contract with the child's parent/guardian) to enter and process this data within the app.

We store children's dates of birth for the sole purpose of verifying parent identity when they access an invoice. This verification step protects your bank details from unauthorised access.

Enquiries also store parent and child names, ages, and optional extra-needs (SEN) notes you type. Extra-needs notes can be health data (UK GDPR Article 9). We store them for you as processor; we do not send those notes to xAI or Anthropic. You remain the controller for family data and confirm you have a lawful basis to record it.

We do not share children's data with any third party other than the sub-processors listed above, and only to the extent necessary to deliver the service.

8. Data retention

Data typeRetention period
Active account dataFor the duration of your subscription
Data after account cancellation30 days (then permanently deleted)
Invoice records6 years (UK tax law requirement)
Payment records (Stripe)As required by financial regulations
Security/access logs90 days
Enquiry records you enterFor the duration of your Enquiries subscription, then 30 days after cancellation

Invoice records are retained for 6 years in accordance with HMRC requirements for self-employed income records. All other personal data is deleted within 30 days of account closure.

9. Your rights

Under UK GDPR, you have the following rights. To exercise any of them, email us at support@godottie.cloud. We will respond within 30 days.

Right of access: Request a copy of all personal data we hold about you.
Right to rectification: Ask us to correct inaccurate or incomplete data.
Right to erasure: Request deletion of your personal data (the "right to be forgotten"). Note: invoice records may be retained as required by law.
Right to data portability: Request your data in a structured, machine-readable format (JSON or CSV).
Right to restrict processing: Ask us to pause processing your data in certain circumstances.
Right to object: Object to processing based on legitimate interests.
Right to withdraw consent: Where we rely on consent, you can withdraw it at any time.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Cookies

We use essential cookies required for the service to function. These include session authentication cookies managed by Supabase. Essential cookies cannot be disabled as they are necessary for you to log in and use the app.

With your consent, we also use Google Analytics to understand how visitors use our website. These analytics cookies (such as _ga) are only set after you accept them via the cookie banner shown on your first visit. If you decline, no analytics cookies are set and no analytics data is collected. You can change your choice at any time by clearing your browser's site data for this site, which will show the banner again. We do not use advertising cookies or third-party advertising trackers.

11. Security

  • All data is encrypted in transit using TLS 1.2+
  • Data at rest is encrypted using AES-256 (managed by Supabase)
  • Row-level security ensures your data is isolated from other users
  • Bank details on invoices are protected by a date-of-birth verification step for parent access
  • We perform regular security reviews
  • Access to production systems is restricted and logged

While we take all reasonable precautions, no internet service is completely secure. If you believe your account has been compromised, contact us immediately at support@godottie.cloud.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by displaying a notice in the app. The "Last updated" date at the top of this page reflects the most recent revision.

Continued use of Dottie after a change is posted constitutes your acceptance of the updated policy.

13. Contact us

For any questions, requests to exercise your rights, or data concerns, please contact us:

Dottie

support@godottie.cloud

www.godottie.cloud

If you are not satisfied with our response, you have the right to complain to the ICO at ico.org.uk.