Privacy Policy
Opulent Petro Ltd (SC856884), trading as CfE Reports
Last updated: October 21, 2026
Quick Summary
- We collect: Email, name, school name (optional)
- Student data: Names and notes for report generation; saved reports, profiles and imported school data are retained until deleted
- We share with: Google Gemini through Lovable AI Gateway (AI generation), Stripe (payments), Lovable Cloud (account and school data), Lovable (hosting and site analytics)
- Your rights: UK GDPR - access, correct, delete your data anytime
- Contact: hello@cfereports.co.uk or privacy@cfereports.co.uk
Contents
Personal Information
- Email address
- Your name
- School name (optional)
- Local authority (optional)
Pupil Information
- Student names and pronouns (used to generate the report you request and in saved reports or profiles)
- CfE level (P1-S6)
- Subject areas
- Performance notes and goals
- Attendance, attainment, SIMD, ASN, gender and monitoring data imported from SEEMiS
IMPORTANT: Pupil data is stored when you save reports, create student profiles or import school records. ASN and some notes may contain special-category personal data.
Payment Data
Processed securely by Stripe. We never see your card details.
- Provide the AI report generation service
- Manage your account and subscription
- Send service updates and support emails
- Provide class and school analytics using the records you choose to import
- Prevent fraud and abuse
- Account data: Retained while the account is active. Request account deletion through privacy@cfereports.co.uk.
- Saved reports and student profiles: Retained until you or your school delete them or request erasure. Imported attendance, attainment and monitoring records are also retained until deleted. Schools should set and review their own retention schedule; the application does not currently apply an automatic expiry.
- Deletion and backups: A deletion request includes linked pupil records. Backup and processor-log retention depend on the relevant service; contact us for the current retention details before approving school use.
- Payment records: 7 years (UK tax law)
- Support emails: 2 years
- Access your data
- Correct inaccurate data
- Delete your data
- Export your data
- Object to processing
- Withdraw consent
To exercise rights: Email privacy@cfereports.co.uk (we respond within 30 days)
To complain: Contact ICO at https://ico.org.uk
- SSL/TLS encryption
- Secure Lovable hosting and Lovable Cloud storage; encryption in transit and at rest
- Limited access controls
- Regular security reviews
Children's Privacy: CfE Reports is for teachers (18+). Student names are used for your requested reports and retained in saved reports or profiles when you choose those features.
- Essential cookies (for login)
- Lovable hosting analytics measures site usage; Google Analytics is not configured.
You can disable cookies in your browser settings.
Opulent Petro Ltd (SC856884), trading as CfE Reports
Trading as CfE Reports
Scotland, United Kingdom
For pupil data, the school or local authority is the data controller and Opulent Petro Ltd (SC856884), trading as CfE Reports, acts as data processor on its instructions. We are the controller for account administration, billing and support information.
Account and subscription administration relies on performance of a contract; security and service administration rely on legitimate interests; legally required payment records rely on legal obligations. Schools must identify their own lawful basis for pupil data, typically public task or a legal obligation, and an appropriate Article 9 condition where ASN or notes include special-category data. Do not assume parental consent is the correct basis.
A data processing agreement and DPIA support are available to schools on request via privacy@cfereports.co.uk. Schools should approve the processing and relevant agreements before uploading pupil data.
Report generation currently uses Google Gemini through Lovable AI Gateway, not OpenAI's API. The underlying providers may process inputs or operational data outside the UK and EEA, including the United States. Account storage location does not mean all AI processing remains in the same region.
International transfers require an applicable adequacy decision or approved contractual safeguards, such as Standard Contractual Clauses with the UK Addendum or an International Data Transfer Agreement, with a transfer risk assessment where required. We do not represent that a particular mechanism has been verified for every provider here: request the current subprocessor agreements and transfer assessment via privacy@cfereports.co.uk before approving school use.