Last updated 21 July 2026 · Pre-launch notice

Arrival privacy notice

Pre-launch controller notice: Arrival’s final legal entity and business address must be published before public registration is enabled. Privacy requests: support@arrival.family.

Arrival brings information chosen by an adult account owner into one private family view. This can include account details, family display names, calendar events, lessons, homework, booked meals, balances and school announcements.

Why we use information

We use adult account and subscription information to provide the contracted service. We propose legitimate interests for children’s schedule and school information because the service helps the family organise school life; this remains subject to a documented child-focused balancing assessment and independent review before public launch. We use limited security records to protect families and meet legal obligations where applicable. Optional adult marketing requires separate consent. Child data is never used for advertising, price-setting or marketing profiles and is not sold.

Where information comes from

Information comes from the account owner, calendar feeds and only those school services the owner deliberately connects. Connection secrets are encrypted at rest and are not included in mobile or Board payloads, exports, support logs or analytics. API permissions are read-only where available. A connector cannot run in production until its fields, authority, provider terms, security and retention have an approved assessment.

Children’s information and shared screens

An adult owns the household and decides what is connected and displayed. Nicknames are encouraged. Arrival Board starts in privacy mode: descriptions and locations are hidden, quiet hours are enabled and unused devices expire. The original school service remains authoritative, particularly for urgent or safety-critical messages. Read the child-friendly privacy guide.

Retention

Automated daily retention applies to the live database. Production backups must be encrypted, access-controlled and expire after 30–35 days before launch; restored data must be re-subjected to deletion suppression and retention.

Who receives information

Expected recipients are the hosting/database and backup provider, transactional email provider, Stripe for billing, Google where its OAuth APIs are chosen, and tightly controlled support staff. Arrival does not store card numbers. The final provider list, locations, contracts, transfer safeguards and deletion terms must be published before public launch.

Your rights and choices

Account owners can correct profiles and mappings, disconnect a source, revoke a Board, download a machine-readable export, revoke other sessions and schedule household deletion in the in-app Privacy & data controls centre. Deletion disables connections immediately and normally completes after a 28-day grace period. You may also object, restrict processing, withdraw marketing consent or complain to the ICO. Children can ask the household adult or contact us for help; we consider the child’s interests and verify the requester appropriately.

Security and incidents

Arrival uses tenant-scoped access controls, encryption for connector secrets and sessions, strong passwords, two-step verification for owners and administrators, hashed Board tokens, rate limits, restrictive browser headers, secret-redacted logs and audit records. Independent security testing remains a launch gate. If an incident risks people’s rights, Arrival follows its breach plan and makes required notifications.

Contact and complaints

Email support@arrival.family. We normally respond to rights requests within one month. You can also complain to the Information Commissioner’s Office.