Privacy Policy

Last updated: 10 November 2026

1. Who we are

UDoodle is an online notebook service made by Guernsey Audiovisual, Forest Road, St Martins, Guernsey, Channel Islands (“UDoodle”, “we”, “us”). This policy explains what personal data we hold when you use udoodle.co.uk and the UDoodle app, why we hold it, who else handles it, how long we keep it and what your rights are.

We follow the Data Protection (Bailiwick of Guernsey) Law, 2017, which is modelled on the GDPR. Guernsey is a British Crown Dependency, and the UK and the European Union both recognise its law as giving personal data an adequate level of protection.

For questions about this policy or your data, email [email protected] or use our contact form.

2. Who is responsible for the data

For adults with their own UDoodle account (owners, co-teachers, parents and guardians invited to see a member’s work, and people invited to shared whiteboards), we are the controller: we decide how their data is used, as this policy describes.

When a school, nursery, club, care home or other organisation uses UDoodle, it is the controller for the pupils, residents and staff it adds, and we are its processor. We use their data only to run UDoodle for the organisation, on its instructions. The organisation’s own privacy notice explains why it uses UDoodle, and questions from those people should go to the organisation first; we will help it answer. Section 7 of our Terms sets out our commitments as a processor.

When a parent or guardian sets up a Family plan, they choose who to add, and we look after family members’ data as this policy describes.

3. What we collect

We only collect what UDoodle needs in order to work:

Your account: your name, email address, preferred language, your plan and its status, and the name and sign-in link of your class, family or group.
Signing in: instead of a password, we email you a one-time code. We keep a scrambled copy of each code, when it was requested, and a scrambled form of the network (IP) address that requested it, to stop misuse.
Members (pupils, family members, residents): the display name the adult gives them, the picture and colour chosen for them, their 4-digit sign-in code, and a count of wrong codes typed (after too many, the account locks for a while). Members don’t need an email address and never receive email from us.
Notebooks and shared whiteboards: your drawings, page thumbnails, notebook names, covers and settings. On shared whiteboards we also record who drew each line, who is looking at the whiteboard at the moment and who holds the pen.
Class tablets: the name given to each tablet, which classes it is set up for, when it was set up and last used, and the type of browser it reported. The tablet keeps a random key for each of its classes. A tablet asking to be let into a class also sends the number it shows and its type of browser.
Sign-in cards and remembered devices: for each member, a scrambled copy of the key in their sign-in card’s QR code (to recognise the card) and an encrypted copy (so the same card can be printed again). When a member chooses to be remembered on a device, such as a home tablet, we keep when it was first and last used and the type of browser it reported, and the device keeps a random key.
Old class links: when a class’s link is changed, the old link, so that it keeps leading to the class.
Payments: PayPal takes payment, and we never see card or bank details. We keep the PayPal reference, plan, amount, dates and status, and the messages PayPal sends us about the subscription, which include the payer’s name and email address.
Invitations and sharing: the email addresses of co-teachers you invite and of parents or guardians invited to see a member’s work, and records of shared-whiteboard invitations and of notebooks sent from one account to another.
Messages to us: what you write in the contact form, your name and email address, and a scrambled form of your network address (to limit spam).
Visits to the website: a random number stored in your browser, the first page you opened and the date, so that we can count visitors. It isn’t linked to your account, and we don’t record your browser or device details.
Security records: a log of important account events (such as plan changes, account closure, and notebooks created and deleted), scrambled network addresses used to limit repeated sign-in and set-up attempts, and the short-term technical logs our providers keep.

The notebook on our home page, for visitors without an account, stays in your browser. It is never sent to us and is removed after 24 hours without use.

4. Why we use it

The law requires a lawful reason for each use of personal data. Ours are:

To provide UDoodle (accounts, signing in, saving and syncing notebooks, class tablets, shared whiteboards, and the emails the service needs, such as sign-in codes, receipts, renewal reminders and invitations): this is necessary for our contract with you, or with the organisation that set you up.
To take payment and keep financial records: our contract with you, and our legal duty to keep tax and accounting records.
To keep UDoodle and your data safe (limits on repeated attempts, security logs, backups, investigating misuse): our legitimate interest in running a secure service.
To answer your messages: our legitimate interest in helping you, or steps you ask us to take before you buy.
To count visits to the website: our legitimate interest in knowing how the site is used. You can opt out (section 12).
Members added by an organisation: we act on the organisation’s instructions, and the organisation decides its own lawful reason.

We don’t sell personal data. We don’t show adverts, don’t send marketing emails, don’t use your drawings to train artificial intelligence, and don’t make automated decisions that have legal or similarly significant effects on anyone.

5. Who can see what

Your own notebooks are private to you.
Members’ notebooks can be seen by the account owner and co-teachers, unless the owner turns this off for a member. Members can’t see each other’s notebooks.
Teachers’ marks: when a class teacher marks a pupil’s page, the marks and which teacher made them are kept with that page, can be seen by whoever can see the page, and are deleted with it.
Shared whiteboards: everyone on a shared whiteboard sees everything drawn on it and who else is on it. The owner can remove anyone’s lines, and anyone, from the whiteboard.
Members’ sign-in codes are stored encrypted. The owner and co-teachers can show or print them, to help members sign in.
Co-teachers see the class’s members, notebooks, tablets and sign-in codes, just as the owner does.
Parents and guardians can be invited by a member’s teacher (up to two per member, on Class and Site plans). Once they accept, they can see that member’s notebooks, except ones put away, but can’t change anything and can’t see other members, the class list or shared whiteboards. The teacher can remove them at any time, and access pauses while the member is archived.
Our team: only the people who run UDoodle can reach account data, and only to provide support, fix problems, keep the service secure or meet a legal duty. They sign in with one-time codes, and changes they make to accounts are logged.

6. Who else handles data

We use a few providers to run UDoodle. Each handles personal data only to provide its service, under its own published terms:

Our own servers: UDoodle’s database, sign-in system, server functions and live drawing run on servers that we own and run ourselves, kept in the Channel Islands. No outside company hosts this data for us.
Cloudflare: connects visitors to our servers and protects them from attacks. Connections are encrypted; Cloudflare handles the traffic as it passes through its network (including your device’s network address) only to deliver and protect it.
Resend: sends our emails, which go only to adults. An invitation for a parent or guardian names the member whose work they are invited to see, and their class or group.
PayPal: takes payments. PayPal is also responsible for its own use of payment data, under its own privacy notice.
Our backup server: each night a copy of UDoodle’s data is saved to a second storage server that we own and run, also kept in the Channel Islands (section 9).

We may also share data with professional advisers who have a duty of confidentiality, with a buyer if UDoodle is ever sold (we would tell you first), and with the police, courts or regulators when the law requires it.

7. Data outside the Channel Islands

UDoodle’s data, and its backups, are kept on our own servers in the Channel Islands, under Guernsey law (section 1). Because the UK and the European Union recognise that law as adequate, personal data can come to us from the UK and the EU without any extra transfer safeguards. Some of our providers (Cloudflare, Resend and PayPal) are based in, or handle data in, other countries, including the United States. When personal data goes to a country that the Bailiwick of Guernsey does not recognise as having adequate protection, we rely on safeguards the law allows, such as the standard contractual clauses in the provider’s data processing agreement.

8. How long we keep it

Your account and notebooks: for as long as the account exists. If a paid plan ends, nothing is deleted: the account has 30 days’ grace and then becomes read-only (see our Terms).
A closed account: when you close your account, we keep everything for 30 days in case you change your mind, then permanently delete the account, its members, notebooks and shared whiteboards. Copies remain in our backups for up to 30 more days.
Free trials: a trial class becomes read-only the day after the 30-day trial ends. Unless it is upgraded, it is permanently deleted 90 days later, with its members and their work (see our Terms). So that each email address has only one trial, we keep a one-way code made from the address (not the address itself) for two years after the trial ends.
Members: a member removed from a class is archived first, so their notebooks can still be read and the member can be put back. Deleting an archived member removes them and their notebooks permanently.
Sign-in codes and attempts: sign-in codes for 30 days; counts of repeated attempts, and tablets’ requests to join a class, for one day.
Class tablets and remembered devices: a class tablet is deleted after 120 days without use. A device that remembers a member forgets them 120 days after it was last used, or straight away when the teacher signs it out or makes the member a new card. A sign-in card lasts until the teacher makes a new one or the member is deleted.
Payment and account history: six years, as tax and accounting rules require. After an account is deleted, we keep only what those rules need.
Checkout records: six months, unless a payment is still being resolved.
Messages to us: two years.
Website visit counts: 12 months.
Technical logs kept by our providers: a short period set by each provider.
Backups: each is kept for 30 days, and the 7 most recent are always kept.
Parents and guardians: an invitation lapses after 14 days if it isn’t accepted. An accepted link lasts until the teacher or the parent removes it, or the member’s or the parent’s account is deleted.

9. How we protect it

Everything travels over an encrypted connection (HTTPS).
The database checks every request, so each person can reach only what they are allowed to.
Nobody needs a password: adults sign in with one-time codes; members tap their name on tablets their teacher or organiser has set up, or elsewhere use their sign-in card or their 4-digit code.
Each sign-in code allows only a few guesses, repeated wrong member codes lock the account for a while, and a tablet only joins a class with a code from the class’s teacher or organiser, or when they let it in.
Members’ sign-in codes, and the keys of their sign-in cards, are encrypted (AES-256).
Nightly backups are stored on our own server, which only we can sign in to.

No system is completely secure. If a breach puts personal data at risk, we will tell the Office of the Data Protection Authority within 72 hours where the law requires it, tell the people affected without undue delay when there is a high risk to them, and tell any organisation whose members are affected straight away, so that it can meet its own duties.

10. Children

Children use UDoodle only as members of an account run by an adult: a teacher, a parent or a guardian. Children can’t sign up or pay, don’t need an email address and never receive email from us. Anyone who creates an account must be 18 or over.

Members see only their own notebooks and the shared whiteboards they have been added to. We don’t show them adverts, and we don’t count visits from class tablets.

Adults who add children, or invite a parent or guardian to see a child’s work, confirm that they are entitled to do so, for example as the child’s school or as their parent or guardian.

11. Your rights

Under Guernsey law you have the right to:

ask for a copy of the personal data we hold about you;
have inaccurate data corrected;
have your data deleted;
restrict or object to how we use it, including where we rely on legitimate interests;
receive your data in a portable form (you can also download your notebooks as PDFs yourself);
withdraw your consent, where we rely on it;
not be subject to decisions made purely by automated means that significantly affect you (we don’t make any);
complain to the Office of the Data Protection Authority (section 13).

You can do many of these yourself: change your name and language in your account, download notebooks, delete members or close your account. For anything else, email [email protected]. We will reply within one month, free of charge in most cases, and we may need to check who you are first.

If you are a pupil or a member added by an organisation, please ask that organisation first; we will help it respond. A parent can ask us about their child’s data in a Family plan.

12. Cookies and browser storage

We don’t use advertising or tracking cookies. UDoodle keeps these in your browser:

Needed for UDoodle to work: your sign-in session; on class tablets, a key for each class (also kept in a cookie, in case the browser clears one of them); on a device where a member chose to be remembered, a key for each member (also kept in a cookie); drawings not yet uploaded, until they reach us; details you are part-way through typing at checkout or sign-in; and the home-page notebook.
Preferences: your language, whether finger drawing is on, and small reminders such as hints you have already seen.
Counting visits: a random number, used only to count visitors (section 3).

To opt out of the visit count, switch on Global Privacy Control or Do Not Track in your browser, and UDoodle won’t count your visits. Visits from class tablets are never counted. Clearing your browser’s storage removes everything above (on a class tablet, that also means setting it up again).

13. Complaints

If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You can also complain to the Office of the Data Protection Authority, St Martin’s House, Le Bordage, St Peter Port, Guernsey GY1 1BR (www.odpa.gg). If you live in the UK or the European Union, you can also complain to the data protection authority where you live.

14. Changes to this policy

We update this policy when UDoodle or the law changes. The date at the top shows the latest version. If we make a significant change, we will email account owners before it takes effect.