Draft. This page describes how Ravenclerk is designed to handle data. It is not yet a final legal privacy notice and should be reviewed before launch. [placeholder: data controller details, ICO registration and contact for privacy queries]
This website
This website has no forms. If you email us at hello@ravenclerk.com, we use your details only to reply and to arrange any call you ask for. Please don't send personal data about pupils, customers or staff.
The Ravenclerk service
When a business or school uses Ravenclerk, that organisation is the data controller and Ravenclerk acts as a data processor on its instructions. Our approach:
- Your tenant. Ravenclerk connects to the organisation's own Microsoft 365 tenant through Microsoft Graph, using permissions approved by its administrator and limited to the chosen mailboxes.
- UK hosting. The Ravenclerk service is being set up for UK hosting. We'll confirm where processing takes place, including by any AI provider, before an organisation starts.
- AI providers. We use AI services on terms where email content is not retained by the provider or used to train models.
- Data minimisation. We process only what is needed to decide where an email should go.
- Short retention. Working data is kept for a short, defined period. [placeholder: retention periods]
- Audit log. Routing decisions are logged so the school can see what happened to each email.
- Paperwork. Pilot organisations receive a Data Processing Agreement and a DPIA template for their DPO to review.
Your rights
Under UK GDPR you have rights including access, correction and erasure of your personal data. For data processed on behalf of a business or school, please contact that organisation first. For anything else, contact us at [placeholder: privacy contact email].