Parvani Ltd, trading as 123 Organiser, is the data controller for the personal data described in this policy. We're registered with the Information Commissioner's Office, registration number ZC230228. Registered office: 4 Cornfield Terrace, Eastbourne, East Sussex, BN21 4NN.
We do not collect anything directly from children. Children never register, log in, or interact with the service. All information about a child is provided by their registered parent/guardian.
We have no visibility into, and do not record, who you have given your forwarding email to — we only see what actually arrives at it. See "Your forwarding email" below and Section 4 of our Terms of Service for how responsibility for that email works.
Emails sent to your 123 Organiser address may contain personal information about other people — for example other parents, staff, or anyone else named in a school, club, or activity email. We process that information only as necessary to provide the service to you — the same AI extraction and 72-hour deletion described throughout this policy applies to it, with no separate use.
School, club, and activity email content is sent to Anthropic's Claude API to extract dated events and generate a summary. Under Anthropic's commercial API terms, this data is not used to train Anthropic's models, and Anthropic automatically deletes API request/response logs within 30 days of receipt (see Anthropic's data retention policy). We only send what's necessary for extraction — we do not send your account details, payment information, or unrelated personal data to this processor.
If you use "Draft a reply" on a message (only available within 72 hours of it arriving, the same window we keep the original for), the email it's replying to, its summary, and anything you type or dictate for your intended reply are sent to Claude the same way, purely to generate that draft. The draft is shown to you to review, edit, and send yourself, from your own email address — we never send it, and nothing about your reply is stored on our servers beyond the same 72-hour window everything else in this section is kept for. AI-generated drafts can contain mistakes, so always review one before sending it, the same as with any other AI output described in this policy.
Free and Unlimited plan accounts see advertising within the app; Ad-free plan accounts do not.
The forwarding email we generate for your family is a normal email address like any other — mail sent to it is received by our email provider (see "Who we share data with") and passed to our systems for processing, in exactly the same way as any address handles incoming messages.
We do not maintain, and cannot provide you with, a record of who you have given the email to. That is a decision you make and manage yourself — see Section 4 of our Terms of Service for what that means for your responsibilities, and for what we can and can't do if you want a sender to stop using the email.
If you choose to enable backup, your message history can be stored centrally in encrypted form, protected by a passphrase only you know, with a one-time recovery code issued at setup as a second way to restore it. We cannot read this data — the encryption key is derived from your passphrase on your own device and never sent to us. If you lose both your passphrase and your recovery code, this data cannot be recovered by us or anyone else.
The encrypted backup is kept for as long as backup remains enabled and your account remains active. If you disable backup, it's deleted from our systems straight away; if your account ends instead, it's deleted along with everything else once the applicable deletion period above has passed.
If you get a new phone, reset it, or clear your browser, you can get back into your account by confirming your name, email, and phone number, verified with a one-time SMS code sent to the phone number already on your account — the same way you verified when you first signed up. This uses only the same account details already described above; nothing new is collected.
If your email address or phone number has changed since you signed up, this can't verify you automatically, and our team reviews the request directly instead. We may decline to update these details where we have genuine grounds to be concerned the request isn't really from you, as a safeguard against someone else trying to access your account.
We use a small number of specialist service providers to run the service, each bound by a data processing agreement and given only the minimum data needed to do their job:
We do not sell personal data, and do not share children's data with any third party for marketing purposes.
We are based in the UK. Some of the service providers we use may process personal data outside the UK, including in the United States.
Where personal data is transferred outside the UK, we use the safeguards required by UK data-protection law. Depending on the provider and destination, these may include the UK's own adequacy regulations — such as the UK Extension to the EU-US Data Privacy Framework, where the receiving organisation is certified under it — or approved contractual safeguards such as the UK International Data Transfer Addendum together with the EU Standard Contractual Clauses, as set out in each provider's own data processing agreement. You can contact us if you'd like more information about the safeguard used for a particular provider.
We use encryption in transit and at rest for stored data, automated (not manual) deletion of time-limited data, and access controls limiting who can view family or child data.
Under UK GDPR, you have the right to:
Complain to the ICO if you believe we've mishandled your data — though we'd appreciate the chance to resolve it directly first.
To exercise any of these rights, get in touch via our contact page. A request to access, correct, or delete your account's data is handled directly by our team on request — this is separate from, and faster than, the general data-deletion timeline described above under "How long we keep data" (which applies automatically once your account has actually ended, per that section): a rights-based request is actioned within the statutory timeframe, normally one calendar month from when we receive it.
Although children never use this service directly, we recognise their data deserves particular care. We collect the minimum needed (name, year/class, school), never use it for marketing, never share it with advertisers, and apply the same retention limits described above. A parent or guardian can request access to, correction of, or deletion of their child's data at any time.
We'll update this policy as the service evolves, and notify you of material changes by email or in-app notice.
Get in touch via our contact page.
Parvani Ltd, registered in England and Wales, company number 11572665. Registered office: 4 Cornfield Terrace, Eastbourne, East Sussex, BN21 4NN.
ICO registration: ZC230228
Last updated 10 September 2026. For any privacy question or request, get in touch via our contact page.
123 Organiser is a product of Parvani Ltd. · How it works · Pricing · FAQs · Troubleshooting · Contact · Terms · Privacy