AnySchool

AnySchool Privacy Policy

Effective date: 13 October 2026

1. Who we are

AnySchool runs the AnySchool platform (any.school), Schoolipedia (wiki.any.school) and the AnySchool connector for AI chat apps. AnySchool is the controller of the personal data described in this policy. For any question or request about your data, write to support@any.school.

2. Who this policy covers

  • People who use AnySchool: account holders at suppliers, schools and other organisations, parents who use Schoolipedia, and visitors to our websites (section 3).
  • People who work at schools and whose professional contact details are in our school-contact database (section 4).

3. AnySchool users and website visitors

What we collect

  • Account: name, email address, password (stored only as a one-way hash), account type, your school or company, details you add to your profile, your language preference, and the organisations you belong to and your role in them.
  • Sign-in with Google or Microsoft: if you choose it, the provider sends us your name and email address. We never see your password for that provider.
  • Billing: payments are processed by Stripe. We keep your plan, subscription and payment records. We do not receive or store full card numbers.
  • Use of the service: the filters and searches you run, the questions you ask in Brief and Compare and the answers, your Lead Finder answers and results, saved lists, the contacts your organisation unlocks and the credits spent, exports, and how much of your plan you have used.
  • Security: your IP address, the approximate location derived from it (MaxMind), the IP address's abuse reputation (AbuseIPDB), and a record of each sign-in. If a sign-in looks suspicious, for example from an IP address with a poor reputation or from two places too far apart for the time between them, we email you a confirmation link before letting it through.
  • Product analytics: our own event tracking records which features are used, on which page and when, together with a random device ID and session ID kept in your browser. We do not use third-party analytics or advertising trackers. It runs only if your analytics choice allows it (section 10).
  • Website visits: when you open our public marketing pages, and your analytics choice allows it (section 10), we record the page, your IP address shortened (its last part removed) and its approximate location.
  • Schoolipedia: parent accounts and shortlists and, if your analytics choice allows it (section 10), which school profiles are viewed, with the approximate location derived from the IP address.
  • Messages you send us.

Why we use it

  • To provide the service you signed up for, including your plan's limits and credits (performance of our contract with you).
  • To bill you and keep accounting records (our contract with you and our legal obligations).
  • To keep accounts secure and prevent abuse (our legitimate interests).
  • To understand which features and which school data matter most, so we can improve AnySchool and decide which data to gather next (our legitimate interests).
  • To send service emails: account confirmation, password resets, security alerts and the notifications you turned on.

4. People who work at schools

AnySchool is a database of schools and of the people who work at them. If you work at a school, we may hold your professional contact details so that organisations that work with schools can reach the right person.

What we hold

Your name, job title, department, the school you work at, work email address, work phone number, LinkedIn profile URL and public professional profile information (such as your headline and current role), and data-quality information such as when your email address was last checked.

Where it comes from

  • Schools' public websites and other public sources, read by our own data-gathering software, which can use AI models (including OpenAI's) to read web pages.
  • Public LinkedIn profile information obtained through data providers (Apify, LinkdAPI).
  • Commercial contact-data providers (RocketReach).

We check whether an email address can receive mail by asking the receiving mail server, without sending an email.

Who sees it

Contact details are hidden by default. A customer sees your name, email address, phone number or LinkedIn URL only after spending a credit to unlock your record, and may then export it or copy it into their own CRM. School accounts cannot unlock contacts. Our AI features may use your job title and department, but not your name, email address or phone number, to suggest whom a customer should contact.

Our own emails

We may email school staff about AnySchool, for example news, surveys or a sales message. Every such email has an unsubscribe link. We record delivery, opens and clicks; these detailed events are deleted after 90 days. If you exchange emails with our sales team, we keep that correspondence in our sales tools.

Legal basis

Our legitimate interest, and our customers', in business-to-business contact with schools in a professional context. You can object at any time.

Your choices

Ask us to remove your details at any.school/gdpr/remove-data. We send a confirmation link to the address we hold; once you confirm, your record is suppressed, which means it is no longer shown to customers or used for our emails. If that page does not accept your request, write to support@any.school. Customers who unlocked your details before then may have kept a copy in their own systems, which we cannot delete; you can contact them directly.

5. Schoolipedia

Schoolipedia (wiki.any.school) is free and public. It shows information about schools that is useful to parents. It does not publish the staff contact details described in section 4.

6. AI features

Brief, Compare, Lead Finder and the Schoolipedia search assistant use OpenAI. When you use them, your question, your answers and the data needed to respond (mostly school data) are sent to OpenAI to generate the reply. Lead Finder sends the job titles and departments of school staff, not their names, email addresses or phone numbers.

7. Using AnySchool from AI chat apps

You can connect your AnySchool account to AI chat apps such as Claude, ChatGPT, Gemini and Grok. You sign in to AnySchool and approve access; the chat app receives a AnySchool access token, never your password.

  • What the chat app gets: only the results of the AnySchool tools it calls for your account, within your plan, limits and credits. These can include:
    • your account type, plan name, remaining credits and usage limits;
    • school profile data (such as location, size, fees, curriculum and facilities) and summary statistics for groups of schools;
    • for supplier accounts, hidden contacts at schools: job title, department, school, a partly hidden name and email address, a data-quality score, and whether an email address, phone number or LinkedIn profile is on file;
    • for supplier accounts, only after your organisation spends a credit to unlock a contact: that person's name, work email address, phone number and LinkedIn URL;
    • your Lead Finder answers (for example what you sell and who buys it) and its ranked schools and suggested contacts.
    School accounts get no contact tools.
  • What we get: each tool call and its inputs (for example filters, school names or a question). We use them to answer, to meter your use (credits spent are recorded for billing and audit), and to record which filters and schools were requested.
  • What we store: only SHA-256 hashes of the tokens, and one log line per call with the tool, your user ID, the chat app, whether the call succeeded and how long it took.
  • You can disconnect an app at any time in My Account > Connected apps.

What happens to your conversation inside the chat app is governed by that app's provider and its privacy policy.

8. Service providers

We share personal data with providers that help us run AnySchool, only for the purposes above:

  • Microsoft Azure: hosting of our servers and database.
  • Amazon Web Services (Amazon SES): sending email.
  • Stripe: payments.
  • Spaceship (Spacemail): our support@any.school mailbox.
  • OpenAI: AI features and data gathering.
  • MaxMind: IP geolocation. AbuseIPDB: IP address reputation.
  • Google and Microsoft: sign-in, if you choose it. Microsoft 365 also hosts our sales email.
  • Apify, LinkdAPI and RocketReach: sources of school staff contact details (section 4).

We also make school staff contact details available to customers as described in section 4, and we may disclose data where the law requires it.

9. International transfers

Our providers, including Amazon Web Services, OpenAI and Stripe, process data in the United States and in other countries, which may be outside the country where you live.

10. Cookies and browser storage

  • We do not use advertising or third-party analytics cookies.
  • Analytics (the product event tracking, website visit records and Schoolipedia view statistics in section 3) run only if you allow them. Visitors in the European Union, the EEA and the UK, and visitors whose location we can't determine, are asked first; elsewhere analytics are on unless you turn them off. You can change your choice at any time with "Cookie settings" at the bottom of our pages.
  • We set one cookie: a short-lived, HttpOnly cookie while you sign in with Google or Microsoft, which ties the sign-in to your browser. It expires after 10 minutes.
  • Local storage on your device holds your sign-in token, your language choice, display preferences (such as currency, dark mode and table layout), your cookie choice and the random analytics IDs from section 3.
  • Session storage holds temporary values during sign-up and sign-in; the browser removes it when you close the tab.

11. How long we keep data

  • Account data: as long as your account exists, and afterwards only as needed for legal obligations such as billing records.
  • Accounts whose email address is never confirmed: deleted after 90 days.
  • Detailed email delivery, open and click events: deleted after 90 days.
  • Chat connector: authorization codes expire after 5 minutes, access tokens after 1 hour and refresh tokens after 30 days.
  • School staff contact details: while they are used to provide the service. We re-check them periodically and suppress them on request.
  • Everything else: only as long as needed for the purpose it was collected for.

12. Security

We use encrypted connections (HTTPS), store passwords and access tokens only as hashes, restrict staff access by role, and check sign-ins for suspicious activity. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

13. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its use (you can always object to direct marketing), receive it in a portable format, and withdraw consent you have given. Write to support@any.school; we may need to confirm your identity first. Account holders can update their details in My Account. You can also complain to the data protection authority where you live or work.

14. Children

AnySchool is a business service and is not directed at children; Schoolipedia is for parents. We do not knowingly collect children's personal data. If you believe we have, contact us and we will delete it.

15. Changes

We will post any changes to this policy on this page and update the effective date at the top.