Privacy Policy

Poppins AI Ltd

Last updated: 5 May 2026

Introduction

Poppins is an AI assistant operated by Poppins AI Ltd, a company registered in England and Wales. This Privacy Policy explains what personal data we collect, how we use it, and your rights under the UK GDPR. If you have questions, email paul@itspoppins.com.

Information we collect

When you create a Poppins account, we collect:

- Your name, mobile number, and email address.

- Your children's names and year groups, as you provide them, to help organise school information.

- The contents of WhatsApp messages you forward to Poppins, photos and screenshots you send, and voice notes you record.

- With your explicit consent: the contents of incoming emails in your Google Mail account that we identify as school-related, and entries in your Google Calendar.

How we use information

We use the data above to provide the Poppins service: extracting events and deadlines, writing them to your calendar, drafting replies for your review, and sending you reminders.

Google User Data Policy

Poppins's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We access:

- Gmail messages (read) — to identify school-related emails and extract their content.

- Gmail drafts (create/update) — to save reply drafts to your Drafts folder. Poppins never sends emails on your behalf; you review and send manually.

- Gmail labels (read/write of a single "Poppins / handled" label) — so you can see which emails Poppins has processed.

- Google Calendar (read/write within a dedicated "Poppins / Family" sub-calendar) — to write extracted events.

We do not use this data for AI model training. We do not share it with third parties beyond the named sub-processors below. We do not use it for advertising.

Sub-processors

We share data with the following sub-processors, under signed Data Processing Agreements:

- Anthropic — AI extraction and drafting (EU region where available)

- OpenAI — sender classification (EU region where available)

- Twilio — WhatsApp message handling - Supabase (Frankfurt) — database

- Render — application hosting

- Sentry — error monitoring

- PostHog — product analytics

Data retention

- Raw email and message bodies: retained 30 days, then deleted.

- Structured extractions (events, deadlines, payment reminders): retained for the lifetime of your account.

- Voice profile data: retained for the lifetime of your account.

- Account deletion: send "delete me" to Poppins on WhatsApp, or email paul@itspoppins.com. All data is deleted within 30 days.

Your rights under UK GDPR You have the right to access, correct, delete, and port your personal data, and to object to processing. Contact paul@itspoppins.com to exercise any of these rights. You also have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk).

International transfers

Where possible we use EU-hosted sub-processors. Where data must be transferred outside the UK/EEA, we rely on the UK International Data Transfer Agreement.

Children's data

Poppins does not knowingly process data about children under 13 directly. Information about your children, provided by you as their parent, is processed solely to deliver the service you have requested.

Changes to this policy

We will email you 14 days before any material change takes effect.

Contact Poppins AI Ltd

paul@itspoppins.com