Privacy Policy
Last updated: 22 October 2026
1. Who we are
Ofsted Insights is a trading name of M Walker, based in England and Wales. We operate the website at ofstedinsights.com.
Registered address: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.
We are registered with the Information Commissioner's Office (ICO) under registration number ZC145329.
For any privacy-related queries, contact us at: info@ofstedinsights.com
2. What data we collect and why
| Data | Why we collect it | Legal basis |
|---|---|---|
| Name, email address, username, institution | To create and manage your account | Contract (Article 6(1)(b) UK GDPR) |
| Password (stored as a one-way hash) | To authenticate you securely | Contract (Article 6(1)(b) UK GDPR) |
| Activity logs (pages visited, actions taken, timestamps, IP address) | To detect abuse, diagnose errors, and monitor fair usage | Legitimate interests (Article 6(1)(f) UK GDPR) |
| Aggregate visit counts for pages you view before signing in (page address, the website that referred you, any campaign tag in the link, and a short-lived identifier described in section 9) | To count visits, understand which pages people find useful, and measure whether our advertising works | Legitimate interests (Article 6(1)(f) UK GDPR) |
| Content you enter into Key Questions (your school, answers, written evidence and figures) | To generate your AI assessment and keep your results in your archive | Contract (Article 6(1)(b) UK GDPR) |
| Messages you send us via the feedback or contact form (name, email address, message) | To respond to your enquiry | Legitimate interests (Article 6(1)(f) UK GDPR) |
| Billing information (name, email, payment method) | To process subscription payments via Stripe | Contract (Article 6(1)(b) UK GDPR) |
| Email address | To send product updates and service announcements | Legitimate interests (Article 6(1)(f) UK GDPR) |
We do not collect any special category data (such as health, race, or political views).
3. School data we display
Ofsted Insights displays publicly available information about schools — including Ofsted inspection reports, school performance data, and Parent View survey results. This information is sourced from public government datasets and Ofsted's published reports. We do not collect or store personal data about pupils or school staff.
Some tools, such as Scrutiny and Similar Schools, let you enter information about your own school. This information is not saved by Ofsted Insights and is used only to produce your result. In Scrutiny, what you type is passed to Anthropic (see section 6) solely to generate the reply.
4. Key Questions
Your school. When you use Key Questions you choose your school from the government's register of schools. We store its URN (unique reference number) on your account so we can show the right questions and the school's published figures.
What is sent to Anthropic. Your answers, anything you write in your own words (including the evidence you give when you claim a higher standard), and any figures you enter are sent to Anthropic to check your evidence and write your result. We do not send your name, email address or other account details.
Your archive. Each area you finish is saved as a dated entry in your archive, with its result and the figures it used. Retaking an area adds a new entry rather than replacing the earlier one, so you can see how things have changed. You can download any result, your whole-school results, or a saved snapshot as a PDF. Results from the earlier version of Key Questions have been kept in your archive as PDFs containing the questions, your answers and your result.
Colleagues you invite. If your organisation has an active subscription, you can invite colleagues from the same organisation to help with your Key Questions. They can help answer questions, and can see the result of an area only if they worked on it. They cannot see your other results, your earlier-version results, your snapshots or your whole-school report. Only you can finish an area, delete entries, make snapshots or invite people. You can remove a colleague at any time, and their access ends automatically if they leave your organisation or its subscription ends.
How we use it. We use this information only to provide Key Questions to you and the colleagues you invite. We do not analyse it, combine it with other users' data, share it, or use it for any other purpose, including research, marketing or product improvement.
Deleting it. You can delete any entry from your archive. If you delete your account, your archive, PDFs, snapshots, the figures you entered and your invitations are deleted with it.
5. Inspection Briefing
Ofsted inspectors. When a subscriber prepares for an inspection, Inspection Briefing shows the past published reports of the inspectors named for that inspection. To do this we process inspectors' names and roles as printed in inspection reports that Ofsted publishes. We do not collect any other information about inspectors, and we do not rank or score them. Our lawful basis is legitimate interests: helping schools prepare for their own inspection using published information. If you are an inspector and want to object, ask for a copy of what we hold, or correct an error, contact us through our contact form. You can also complain to the Information Commissioner's Office.
What you enter. The school and inspector names you type into Inspection Briefing are kept in your login session for up to 14 days, so the briefing is there when you come back. Signing out clears them. We do not store them in our database.
6. Third parties we share data with
We use the following third-party services to operate the platform. Unless noted otherwise, each acts as a data processor on our behalf:
- Amazon Web Services (AWS Lightsail and Amazon SES, eu-west-2) — hosts the application and database and sends our emails. AWS is certified under the UK International Data Transfer Addendum.
- Anthropic (Claude API) — processes inspection report text to generate AI summaries, and the content you enter into our AI tools (Scrutiny messages; Key Questions answers, written evidence and figures) in order to generate your response. We do not send your name, email address or other account details. Under Anthropic's Commercial Terms, content sent through the API is not used to train Anthropic's models and is not retained beyond a short period (up to 30 days under Anthropic's standard policy; longer only where content is flagged as breaching its usage policy). Anthropic may process data outside the UK; such transfers are covered by the Standard Contractual Clauses and UK Addendum in its data processing terms.
- Stripe — processes subscription payments. Stripe is PCI-DSS compliant and certified under the UK IDTA. We never store your card details.
- Cloudflare (Turnstile) — a bot-protection check on our signup and contact forms. Your browser loads Cloudflare's script, and we send Cloudflare the check token and your IP address to verify it. Turnstile does not set cookies on our site. Legal basis: legitimate interests (security).
- LinkedIn — with your consent (given via our cookie banner), we use the LinkedIn Insight Tag, which sets cookies to measure the performance of our LinkedIn advertising and understand site traffic. We may also upload hashed email addresses to LinkedIn's Matched Audiences tool to show relevant advertising to existing users and find similar audiences; for that purpose LinkedIn acts as a joint controller alongside us, based on our legitimate interests in marketing our service. You can opt out at any time by rejecting cookies via the banner or contacting info@ofstedinsights.com.
We do not sell your personal data to any third party.
7. How long we keep your data
- Account data — retained for as long as your account is active. Deleted within 30 days of account deletion.
- Key Questions archive — each entry, its PDF and the figures you entered are kept until you delete them or your account is deleted.
- Activity logs — automatically deleted after 90 days.
- Visit-counting identifier — the daily identifier described in section 9 is deleted after 3 days; the counts it produces are aggregate totals with nothing identifying in them and are kept indefinitely.
- Billing records — retained for 7 years as required by HMRC.
- Record of administrator changes — when we change an account (for example approving, editing, disabling or deleting it, or turning on a subscription), we log what kind of change was made, when and by whom. The log holds account numbers and which fields were changed, but not names, email addresses or the new values. Entries are deleted after 2 years, and are kept after an account is deleted so we can show what happened to it.
8. Your rights
Under UK GDPR you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data (subject to legal retention obligations)
- Restriction — ask us to limit how we use your data
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interests
To exercise any of these rights, email info@ofstedinsights.com. We will respond within one month.
9. Cookies
We use cookies in two categories:
- Strictly necessary cookies — a session cookie to keep you logged in, and a small cookie that remembers your cookie preferences. These are always active and do not track you across other websites.
- Analytics and advertising cookies — we use the LinkedIn Insight Tag to measure the performance of our advertising and understand site traffic, and a first-party cookie named
oi_vwhich records how you first reached our site so that we can tell which of our own pages and adverts bring people here. It lasts 30 days and is only ever read by us. Both load only if you select "Accept" on our cookie banner; if you select "Reject", neither is set. You can change your choice at any time by clearing this site's cookies, which will bring the banner back.
We also count visits without using a cookie at all, so that our visitor numbers are not limited to people who accept cookies. To avoid counting the same person twice in a day, we create a one-way identifier from your IP address and browser description using a secret key that changes every day. We never store your IP address, the identifier cannot be turned back into it, and it cannot be matched against any other day because the key has already changed. These identifiers are deleted after 3 days and all that remains is an aggregate count. Nothing is stored on your device for this, so it does not require your consent, and it is not used to build any profile of you or to track you across other websites.
10. Security
We use HTTPS throughout, store passwords as scrypt hashes, and apply rate limiting and security headers to protect the service. Access to production data is restricted to the service operator.
11. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email to registered users. The current version is always available at ofstedinsights.com/privacy.
12. Complaints
If you are unhappy with how we handle your data, please contact us first at info@ofstedinsights.com. You also have the right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint.