Legal Documents

Terms of Service

These terms set out the agreement between you — the childminder or setting owner subscribing to NurtureBooks — and DCLowe Labs Ltd, the company that builds and operates NurtureBooks. Please read them before using the service. By creating an account or completing a subscription payment, you agree to be bound by them.

1. Who we are

DCLowe Labs Ltd is a company registered in England and Wales (Company Number 17185013). When these terms refer to “NurtureBooks”, “we”, “us”, or “our”, we mean DCLowe Labs Ltd. When we refer to “you” or “your”, we mean the individual or sole trader subscribing to the service.

2. The service

NurtureBooks is a hosted software-as-a-service (SaaS) platform designed for registered childminders in England and Wales. It provides tools for attendance tracking, invoicing, expenses, activities, parent communication, curriculum observations, and compliance management.

We provide the service on a subscription basis. Access is granted when your subscription is active and payment is up to date. We may update, improve, or change features from time to time. We will give you reasonable notice of any changes that materially affect your use of the service.

NurtureBooks is designed for professional childminding settings. It is not intended for use by nurseries, childcare centres, or organisations with more than a small number of staff. We reserve the right to decline or terminate subscriptions that fall outside our intended use case.

3. Your account

You are responsible for keeping your login credentials secure. Do not share your password with anyone. If you believe your account has been compromised, contact us immediately at help@nurturebooks.co.uk.

You may invite assistants to your account. Assistants have a restricted role — they can access attendance and activities, but cannot see financial information. You are responsible for the actions of anyone you invite to your account.

You may also invite parents to a read-only portal linked to their child's record. Parents can view diary entries, attendance history, and invoices addressed to them. You remain responsible for ensuring parent access is appropriate and that you have the necessary consents under your own data protection obligations as the data controller for that information.

4. Subscription and payment

Subscriptions are managed through Stripe, our payment processor. By completing a subscription payment, you authorise Stripe to charge the payment method you provide on a recurring basis in line with your chosen billing cycle (monthly or annual).

The cost of your subscription is shown at the point of signup. We may change our pricing from time to time. Where we increase prices, we will give you at least 30 days' written notice before the change takes effect for your subscription. You can cancel before the new price applies.

Subscription fees are non-refundable except where required by law or as set out in our Refund Policy below. Please read that policy before subscribing.

5. Cancellation and what happens to your data

You can cancel your subscription at any time. After cancellation, your account enters a 30-day read-only period. During this time you can log in to view and download your records, but you cannot create or edit anything.

After the 30-day read-only period, your account and all associated data is permanently deleted from NurtureBooks within 12 months of your cancellation date. This window exists to allow for reactivation if you change your mind. At the end of the 12-month period, all data is permanently and irreversibly deleted — including children's records, attendance, invoices, observations, care logs, contact details, and any other information entered into the platform. There is no further retention. There is no anonymisation step. The data is gone.

Photographs you have uploaded are stored separately from your other records and are deleted as part of the same process. However, photographs cannot be included in the bulk data export — see the note in our Acceptable Use Policy for the reason. If parents wish to retain photographs shared with them through the portal, they can download these directly from their parent portal at any time while your account is active. Parents are often the natural long-term keepers of these images.

If your subscription lapses due to payment failure, we will notify you and allow a reasonable period to reinstate payment before the read-only period begins. The 12-month deletion clock starts from the date your subscription is confirmed as cancelled, not from the date of the first missed payment.

6. Service availability

We aim to keep NurtureBooks available at all times, but we cannot guarantee uninterrupted access. The service may be temporarily unavailable for planned maintenance, security updates, or due to circumstances beyond our control including failures of third-party infrastructure, internet connectivity issues, or events of force majeure.

We will make reasonable efforts to communicate planned maintenance in advance and to minimise disruption. Where the service is unavailable for a sustained period due to something within our control, we will consider whether a service credit is appropriate.

7. Force majeure

We will not be liable for any failure or delay in providing the service where that failure or delay results from circumstances genuinely beyond our reasonable control. This includes, but is not limited to, natural disasters, acts of government or regulatory bodies, failures of third-party networks or infrastructure, or other events that a reasonable business could not have anticipated or prevented.

Where such circumstances arise, we will make reasonable efforts to keep you informed and to restore service as quickly as possible.

8. Our responsibilities to you

We will provide the service with reasonable care and skill. We will keep your data secure using industry-standard measures, including encryption in transit and at rest, and appropriate access controls. We will notify you without undue delay if we become aware of a security incident that materially affects your data.

We will not sell your data or the data of the children and families in your care to any third party. We will not use your data for advertising purposes.

9. Your responsibilities

You agree to use NurtureBooks only for lawful purposes and in connection with your childminding business. You must comply with these terms, our Acceptable Use Policy, and all applicable law.

You are the data controller for the personal information of children, parents, and other individuals you record in NurtureBooks. This means you are responsible for ensuring you have a lawful basis to collect and process that information, that you have provided appropriate privacy notices to families, and that you comply with UK GDPR and the Data Protection Act 2018 in your use of the platform. Our Data Processing Agreement governs the relationship between us in that context.

You must ensure that information you record in NurtureBooks is accurate and kept up to date, and that you only record information that you have the right to process.

10. Limitation of liability

We are not liable for any loss of profits, business, revenue, or data arising from your use of NurtureBooks, except where such liability cannot be excluded by law.

Our total liability to you under or in connection with these terms — for any reason — is limited to the greater of: (a) the total subscription fees you have paid to us in the 12 months immediately preceding the event giving rise to the claim; or (b) the fees paid in the 3 months immediately preceding that event. In practice this means our liability is capped at the fees you have actually paid us in the relevant period, with a minimum floor of 3 months' fees to ensure the cap is not disproportionately low.

Nothing in these terms excludes or limits our liability for death or personal injury caused by our negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be excluded by law.

11. Intellectual property

NurtureBooks, including all software, designs, and content created by us, is owned by DCLowe Labs Ltd. You are granted a limited, non-exclusive licence to use the service during your subscription period. You may not copy, modify, distribute, or create derivative works from any part of the service.

Your data — all information you enter into the platform — remains yours. We claim no ownership over it.

12. Changes to these terms

We may update these terms from time to time. Where changes are material, we will give you at least 30 days' notice by email. If you continue to use the service after that notice period, you are taken to have accepted the updated terms. If you do not accept the changes, you may cancel your subscription before they take effect.

13. Governing law

These terms are governed by the laws of England and Wales. Any disputes arising from them will be subject to the exclusive jurisdiction of the courts of England and Wales.

14. Contact

For questions about these terms, contact us at help@nurturebooks.co.uk. Our company registration number is 17185013. You can verify our registration at Companies House.

Refund Policy

This policy explains what happens to your subscription fees if you cancel, and your rights under UK consumer law. Please read it alongside the Terms of Service.

1. Your 14-day right to cancel

Under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, you have the right to cancel a digital service contract within 14 days of purchase without giving a reason.

However, because NurtureBooks is a digital service that you can begin using immediately on subscription, we ask for your express consent to begin the service before the 14-day period expires. By proceeding through our checkout and creating an account, you acknowledge that you are requesting immediate access to the service and that you understand this means you will lose your 14-day right to cancel once the service has been substantially performed.

Where you cancel within 14 days and have not yet used the service (that is, you have not logged in or created any records), we will provide a full refund. Where you have used the service during the 14-day period, we may apply a deduction to reflect the portion of service already received.

2. Cancellation after 14 days

After the 14-day cooling-off period, subscription fees are non-refundable. If you cancel, you will retain access to the service until the end of your current billing period. We do not offer partial-period refunds for unused time within a billing cycle.

3. Annual subscriptions

Annual subscriptions are billed upfront for a 12-month period. The same cancellation rules apply: after the 14-day cooling-off period, annual subscriptions are non-refundable. You may cancel at any time to prevent renewal, but no pro-rata refund will be issued for the unused portion of the annual period. Your access continues until the end of the annual term.

4. Payment failures and subscription lapse

If a scheduled payment fails, we will notify you and make reasonable attempts to collect payment before suspending access. We will not apply the 30-day data window described in the Terms of Service until we have given you a fair opportunity to resolve the payment issue.

5. Service credits

Where NurtureBooks is unavailable for a significant period due to a fault on our side, we may offer a service credit at our discretion. Service credits are applied to future subscription payments and are not paid out in cash. We are under no obligation to provide credits for downtime caused by factors outside our control.

6. How to request a refund

To request a refund where you believe one is due, contact us at help@nurturebooks.co.uk with your account email address, the date of subscription, and the reason for your request. We will respond within 5 working days.

Privacy Policy

This policy explains how DCLowe Labs Ltd (trading as NurtureBooks) handles personal information. We are registered with the Information Commissioner's Office under registration number ZC144470. This policy is written in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Two roles, clearly separated

UK data protection law requires that anyone handling personal data has a clearly defined role. We operate in two roles depending on whose data is involved, and it is important to understand the difference.

When we are the data controller

We act as the data controller for information we collect directly from you as a subscriber — your name, email address, billing details, and support communications. As controller, we decide why and how this information is processed.

When we are the data processor

We act as the data processor for all personal information you enter into NurtureBooks about children, parents, and other individuals connected to your setting — including attendance records, observations, care logs, invoices, and contact details. In this role, you are the data controller. You decide what data to collect and why. We process it only on your instructions, under our Data Processing Agreement.

2. Information we collect about you (controller role)

As your subscription provider, we hold:

• Your name and email address
• Your setting name (if provided)
• Billing information — all payment card data is held and processed directly by Stripe. We do not store your card number, expiry date, or security code. Stripe returns a payment method token to us, which we use to manage your subscription without ever seeing your full card details.
• Support ticket content and correspondence with us
• Subscription status and payment history

3. How we use your information (controller role)

We use this information to:

• Set up and maintain your account
• Process subscription payments via Stripe
• Send transactional emails — account setup, subscription confirmations, renewal notices
• Respond to support queries (which may involve AI-assisted triage — see sub-processors below)
• Communicate changes to the service or these terms
• Investigate and resolve technical issues

The lawful basis for processing your information is performance of our contract with you, and our legitimate interests in operating, securing, and improving the service. We do not use your information for marketing to third parties. We do not sell your data. We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

4. Special category data

NurtureBooks allows you to record care logs that may include medicine records (medication name, dose, time administered). Under UK GDPR, information about a person's health is special category data and carries a higher level of protection.

As the data controller, you are responsible for ensuring you have an appropriate lawful basis to record health-related information — typically Article 9(2)(h) UK GDPR. We process this data solely on your instruction and do not use it for any purpose of our own.

Children's data more broadly — including date of birth, attendance patterns, observations, and photographs — requires particular care. You must ensure that families have been given appropriate privacy notices covering the recording of this information in a digital system. You should also consider whether a Data Protection Impact Assessment (DPIA) is appropriate — your regulator (CIW or Ofsted) may have guidance on this.

5. Data about children and families (processor role)

The personal data you enter about children, parents, and other individuals in NurtureBooks is processed by us on your behalf. We do not access this data except where necessary to provide the service, troubleshoot a technical issue at your request, or comply with a legal obligation.

If a parent or other individual makes a data subject rights request directly to us about information you hold in NurtureBooks, we will forward that request to you as the data controller. We will not respond to such requests directly on your behalf. Our Data Processing Agreement sets out this arrangement in full.

6. How long we keep information

Subscriber data (controller role)

We retain your account information for as long as your subscription is active and for up to 12 months after your cancellation date to allow for reactivation. After 12 months, all account data is permanently deleted. We retain billing and transaction records relating to subscription fees paid to DCLowe Labs Ltd for up to 6 years for our own legal and tax compliance purposes in line with HMRC requirements. These are DCLowe Labs' own financial records and are held separately from your NurtureBooks data — they are not the invoices you raise to parents through the platform.

Childminding data (processor role)

All personal data you have entered into NurtureBooks — children's records, attendance, invoices, observations, care logs, and contact details — is permanently and irreversibly deleted 12 months after your cancellation date. There is no anonymisation step and no further retention after this point.

The invoices and payment records you create in NurtureBooks are your business records, raised by you to parents. NurtureBooks does not process or take any share of those payments and has no independent financial obligation to retain them. They are deleted with everything else at the end of the 12-month period. If you need to retain these records for tax or compliance purposes — which you likely do — export them before your account closes.

Photographs are stored separately from your structured records and are deleted as part of the same process. They cannot be included in the bulk data export for technical reasons explained in our Acceptable Use Policy. Parents can download photographs directly from their portal at any time while your account remains active.

7. Who we share data with — sub-processors

We use a small number of trusted third-party services to operate NurtureBooks. Full details are in the Data Processing Agreement below. In summary:

We do not share your data with anyone else, except where required by law.

8. International transfers

Your data is primarily stored and processed within the European Economic Area (EEA). Where we use sub-processors outside the EEA — specifically Stripe (for some processing) and Anthropic — appropriate safeguards are in place in the form of Standard Contractual Clauses (SCCs) recognised under UK GDPR and the UK International Data Transfer Agreement framework.

9. Your rights under UK GDPR

Under UK GDPR and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you as a subscriber
• Correct inaccurate information
• Erase your data, subject to our legal retention obligations
• Restrict or object to processing in certain circumstances
• Data portability — receive your subscriber data in a structured, commonly used, machine-readable format (such as JSON or CSV)
• Withdraw consent where processing is based on consent (though most of our processing is based on contract or legitimate interests)

To exercise any of these rights in relation to your subscriber data, contact us at help@nurturebooks.co.uk. We will respond within one calendar month.

For rights requests relating to data you hold about children and families in NurtureBooks — for example, a parent requesting access to their child's records — please contact the childminder who manages your child's record. They are the data controller for that information, and requests must go to them directly. We will support them in responding where we can.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would always prefer you contact us first so we can try to resolve the issue.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include encryption in transit (TLS), encryption at rest, row-level security policies in our database that prevent one childminder's data being accessible to another, access controls, and session management including inactivity timeouts. We keep these measures under regular review.

No system can guarantee absolute security. If you believe your account has been compromised, contact us immediately at help@nurturebooks.co.uk.

11. Changes to this policy

We may update this policy from time to time. Where changes are material, we will notify you by email with at least 30 days' notice. The current version is always available at nurturebooks.co.uk/legal.

Data Processing Agreement

This Data Processing Agreement (DPA) forms part of the Terms of Service between you (the data controller) and DCLowe Labs Ltd (the data processor). It governs how we process personal data on your behalf when you use NurtureBooks, and is intended to comply with Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Definitions

• Controller — you, the childminder or setting operator, who determines the purposes and means of processing personal data about children, parents, and others connected to your setting.
• Processor — DCLowe Labs Ltd, operating NurtureBooks on your instructions.
• Data subjects — the individuals whose personal data is processed, primarily children in your care, their parents or guardians, and assistants you invite to your account.
• Personal data — any information relating to an identified or identifiable living individual, as defined in UK GDPR.
• Special category data — personal data within Article 9 UK GDPR. Health data recorded in care logs, including medicine administration records, falls within this category.
• UK GDPR — the UK General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018.
• Processing — any operation performed on personal data, including collection, storage, use, disclosure, and deletion.

2. Subject matter and nature of processing

We process personal data on your behalf solely to provide NurtureBooks. The categories of personal data processed include:

• Children: name, date of birth, attendance records, care logs (including medicine administration records), curriculum observations, photographs (where uploaded), diary notes
• Parents and guardians: name, contact details, address, portal access credentials, invoice records
• Assistants: name, email address, role, DBS information (where entered by you)
• Household members: name and DBS information (where entered by you)

The duration of processing is the term of your subscription, plus the 30-day read-only period, plus up to 12 months from your cancellation date, after which all personal data is permanently deleted.

3. Your obligations as controller

By using NurtureBooks, you confirm that:

• You have a lawful basis under UK GDPR to collect and process each category of personal data you enter
• You have provided appropriate privacy notices to families and individuals whose data you record
• Where you record health data, including medicine administration records, you have an appropriate basis under Article 9 UK GDPR — typically Article 9(2)(h) for health or social care purposes, supported by explicit parental consent where required
• You have considered whether a Data Protection Impact Assessment (DPIA) is appropriate for your setting, particularly given that you are processing personal data relating to children
• You will comply with your obligations as a data controller, including responding to subject access requests from data subjects
• You will ensure that data you enter is accurate, relevant, and limited to what is necessary
• You will notify us promptly if you become aware of any issue affecting the accuracy or integrity of data held in the platform

4. Our obligations as processor

We confirm that we will:

• Process personal data only on your documented instructions, and only for the purpose of providing NurtureBooks
• Not process personal data for any purpose of our own, including marketing, analytics, or product development using data entered by you or the families in your care
• Ensure that staff with access to personal data are bound by appropriate confidentiality obligations
• Implement appropriate technical and organisational security measures (detailed in clause 6)
• Not engage any new sub-processor without giving you prior notice and the opportunity to object
• Assist you, where reasonably practicable, in responding to requests from data subjects exercising their rights under UK GDPR
• Assist you in meeting your obligations under Articles 32–36 UK GDPR in relation to security, breach notification, and data protection impact assessments
• Permanently delete all personal data at the end of the 12-month post-cancellation retention period, with no further retention thereafter
• On your request, make available to you such information as is reasonably necessary to demonstrate our compliance with this DPA

5. Sub-processors

We engage the following sub-processors. By accepting these terms, you authorise us to use them. We remain responsible to you for their performance.

We will notify you of any intended change to this sub-processor list by updating this DPA and notifying you by email at least 30 days before the change takes effect. If you object to a new sub-processor and we cannot reasonably accommodate that objection, you may terminate your subscription.

6. Security measures

• Encryption in transit: All data transmitted between your browser and our servers uses TLS encryption
• Encryption at rest: Data stored in our database is encrypted at rest by Supabase
• Tenant isolation: Row-level security policies ensure that each childminder's data is accessible only to users within their account
• Role-based access: Assistants cannot access financial data; parents can only see records for their own child
• Authentication: Account access requires email verification; invite and password-reset flows use one-time tokens that expire after use
• Inactivity timeout: Childminder-side sessions expire after a defined period of inactivity
• Staff access: Limited to what is strictly necessary for operating and supporting the service

7. Personal data breach notification

If we become aware of a personal data breach affecting data we process on your behalf, we will notify you without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Our notification will include the nature of the breach, the likely consequences, and the measures we have taken or propose to take to address it.

You are responsible for notifying the ICO and affected data subjects where required by UK GDPR. We will assist you in this process as reasonably practicable.

8. Data subject rights requests

Where a data subject makes a request to us directly to exercise their rights under UK GDPR in relation to data held in your NurtureBooks account, we will forward that request to you promptly. You are the data controller and are responsible for responding. We will not respond to such requests directly on your behalf.

If a data subject makes a request in relation to information we hold as part of our controller role — for example, a subscriber's own account data — we will handle that request ourselves.

9. Audit and compliance

You have the right to request information from us to satisfy yourself that we are complying with this DPA. We will respond to reasonable requests within a reasonable timeframe and provide documentation and written confirmations as reasonably required.

10. Duration and termination

This DPA remains in force for the duration of your subscription, the 30-day read-only period, and the 12-month retention window following cancellation. After permanent deletion of your data is complete, our obligations as processor in respect of that data cease, except for obligations that survive by their nature, including confidentiality.

11. Governing law

This DPA is governed by the laws of England and Wales. Any disputes arising from it will be subject to the exclusive jurisdiction of the courts of England and Wales.

Cookie Policy

This policy explains how NurtureBooks uses cookies and similar browser technologies. The short version: we use only what is strictly necessary to make the service work. We do not use advertising cookies, analytics cookies, or tracking technologies of any kind.

What are cookies?

Cookies are small text files placed on your device by a website. They are commonly used to keep you logged in, remember preferences, or track behaviour across sites. The Privacy and Electronic Communications Regulations 2003 (PECR) govern how cookies may be used in the UK.

What we use — and what we don't call a cookie, but functions like one

NurtureBooks does not set traditional cookies on your device. Instead, we use browser local storage — a similar technology that stores session information directly in your browser rather than in a cookie file. The practical effect is the same: it keeps you logged in as you navigate the application.

Specifically, we store:

• A childminder session token in local storage — set when you log in to the NurtureBooks app, and cleared when your session ends or you log out
• A parent portal session token — a separate token stored independently, so the parent portal and childminder app sessions are completely isolated from each other

These are strictly necessary for the application to function. Without them, you would need to log in on every page navigation.

No analytics, no advertising, no tracking

We do not use:

• Analytics tools (no Google Analytics, Plausible, Matomo, or similar)
• Advertising or retargeting cookies
• Social media tracking pixels
• Any technology that tracks your behaviour across websites other than NurtureBooks

Because we use only strictly necessary local storage tokens, no cookie consent banner is required or displayed.

Your choices

You can configure your browser to block or delete local storage data. Doing so will prevent you from remaining logged in between page loads, but will not affect your ability to use NurtureBooks if you log in again. The session tokens are essential to how the application works and cannot be declined while still using the service.

Future changes

If we ever introduce analytics or any non-essential technologies, we will update this policy, add a consent mechanism, and ask for your permission before setting anything non-essential.

Acceptable Use Policy

This policy sets out what you may and may not do when using NurtureBooks. It supplements the Terms of Service. By using the service, you agree to abide by it.

1. Who this applies to

This policy applies to all users of NurtureBooks — account owners (childminders), assistants invited to an account, and parents accessing the parent portal.

2. Permitted use

NurtureBooks is designed for use by registered childminders in England and Wales in the operation of their childminding settings. Permitted use includes:

• Recording attendance, care logs, observations, and activities for children you are registered to care for
• Generating and managing invoices for childminding services
• Tracking expenses and maintaining financial records for your setting
• Communicating with parents through the portal
• Managing compliance-related records such as DBS information and qualifications
• Sharing diary entries, photographs, and invoices with parents who have been invited by you

3. What you must not do

You must not use NurtureBooks to:

• Record personal data about children who are not in your registered care
• Record information about individuals that you do not have the right to process
• Use the service for purposes unrelated to your childminding setting
• Upload content that is unlawful, offensive, defamatory, or that infringes any third party's rights
• Attempt to access another childminder's data, or circumvent the access controls within the platform
• Use the service in any way that could compromise its security, performance, or availability for other users
• Resell, sublicence, or make the service available to third parties
• Share your login credentials with individuals who are not authorised users of your account
• Upload or record false, misleading, or fabricated information

4. Health and medicine records

NurtureBooks allows you to log medicine administration and other care information that may constitute health data under UK GDPR. When recording health-related information, you must:

• Ensure you have explicit parental consent and an appropriate lawful basis under Article 9 UK GDPR
• Record only what is necessary for the safe day-to-day care of the child
• Ensure families are aware that this information is stored in a digital system

5. Photographs and children's images

Photographs uploaded to NurtureBooks should only include children who are in your registered care and whose parents have given appropriate consent for digital record-keeping and, where applicable, for sharing via the parent portal.

Do not upload photographs that include children who are not in your care, or images taken in contexts unrelated to your setting. Photographs shared with parents through the portal are accessible only to the parent linked to that child. You remain responsible for ensuring that the appropriate consents are in place.

6. Storage, file sizes, and fair use

There are no fixed storage limits at this time. We ask that you use the platform in a way that is proportionate to the needs of a childminding setting. Particular care should be taken with photograph uploads — photos are the primary driver of storage volume, and we ask that you upload images at a reasonable resolution appropriate for sharing with parents and for record-keeping, rather than uncompressed originals or bulk photo libraries.

We reserve the right to apply reasonable per-account limits to:

• Individual file sizes for uploaded photographs and documents
• Total storage volume per account
• The number of photographs that can be uploaded within a given period

Any such limits will be set at levels that a typical childminding setting operating normally would not approach. If your usage reaches a level we consider disproportionate, we will contact you before taking any action and give you at least 30 days' written notice before enforcing any new limit. Limits may be reviewed from time to time and communicated to subscribers in advance of any change.

Photographs and the data export

When you export your data from NurtureBooks, photographs are not included in the export file. This is intentional and for a specific security reason: photographs in NurtureBooks are accessed via individually generated, time-limited URLs rather than fixed public addresses. This means a photograph cannot be accessed simply by knowing a file path — each access is controlled. Including photograph URLs in a data export would undermine this protection, as the exported file could circulate beyond your control.

If you need to retain photographs after leaving NurtureBooks, you can download individual images directly from within the app while your account is active. Parents who have portal access can also download photographs shared with them directly from their parent portal — and in practice, parents are often the natural long-term keepers of these images. We recommend encouraging parents to download any photographs they wish to keep before your account closes.

7. Consequences of breach

If you breach this policy, we may suspend or terminate your account. Where the breach is capable of remedy, we will generally give you written notice and a reasonable opportunity to correct it before taking action. Where a breach poses an immediate risk to the security or integrity of the platform or to other users' data, we reserve the right to suspend access immediately and investigate.

Suspension or termination for breach does not entitle you to a refund of subscription fees.

8. Reporting concerns

If you believe another user is breaching this policy, or if you identify a security vulnerability in the platform, please contact us at help@nurturebooks.co.uk. We take all such reports seriously and will investigate promptly.