Privacy notice
Last updated 3 October 2026 · Version 2026-10-03
This notice explains how we collect and use personal information when you use The Bodhi Bank at bank.bodhi.school, how long we keep it, and the rights you have. How you may use the service and our activity packs is set out separately in our terms of use. Back to sign in
The key points
- Who we are: The Bodhi Bank is run by Sheevam Pattni (also known as Shivam Pattni), trading as Bodhi School, a sole trader based in Nottingham, UK. We are responsible for your personal information (we are its "controller").
- What we collect: your account details (name, email address, username, role, exam boards and subjects), a record of the terms of use you agreed to, the work you save, any feedback you send us, a record of which activity packs you open each day, and basic security records such as IP addresses.
- Why: to run your account and the service, keep them secure, apply the fair use limits in our terms of use, correct and improve our activities and, only if you tick the box, email you news about our apps.
- Who helps us: four service providers (Supabase, Vercel, HighLevel and Resend), under contract. Some are US companies, so when your information leaves the UK it is protected by UK-approved safeguards.
- What we never do: sell your information, show you adverts, or use analytics or tracking cookies. We use cookies only to keep you signed in and to keep your account safe.
- How long we keep it: while you have an account. If you delete your account, we delete your personal information within 30 days. We close accounts that have not been used for 2 years, after sending a reminder. If we close an account because our terms of use were broken, we keep a short record of it for 6 years (see section 7).
- Your rights: you can download, correct or delete your information yourself on your Account page, or ask us to. You can complain to us, and to the ICO.
- Aged 18 or over only: The Bodhi Bank is for teachers, tutors and other education professionals. Please do not add pupils' personal information.
Contents
- Who we are
- What we collect and where we get it
- How we use it and our lawful bases
- Marketing emails and account emails
- Who we share it with
- International transfers
- How long we keep it
- Cookies and similar technologies
- How we keep it secure
- Your rights and how to use them
- Complaints
- Age limit
- Changes to this notice
1. Who we are
The Bodhi Bank is provided by Sheevam Pattni (also known as Shivam Pattni), trading as Bodhi School, a sole trader based in the UK. In this notice, "we", "us" and "our" mean Sheevam Pattni, trading as Bodhi School. We decide how and why your personal information is used, which makes us its controller under UK data protection law.
- Postal address: Unit 3C, Oldknows Factory, Egerton Street, Nottingham, NG3 4GQ
- Email for privacy questions, requests and complaints: privacy@bodhi.school
- Registered with the Information Commission (ICO) under registration number ZB721881
2. What we collect and where we get it
When you sign up
- your full name and email address;
- a username of up to 6 characters, which you see when you are signed in (other users do not see it);
- your password. It travels to us over an encrypted connection and our server passes it straight to our sign-in provider, which stores it only in scrambled form (a salted hash). We never store, log or look at it;
- your role: Teacher, Tutor, or Other with your own short description;
- the exam boards and subjects you teach;
- whether you ticked the box to receive news about our apps;
- your confirmation that you are 18 or over, which version of our terms of use you agreed to and when, and which version of this notice you confirmed you had read, and when.
When you use The Bodhi Bank
- the activities you star;
- the last 20 activity packs you viewed;
- lessons you build from activities;
- your own edited versions of activities;
- your scheme-of-work mapping;
- the thumbs-up and thumbs-down ratings you give (other users only ever see anonymous totals);
- comments you send with the "Spotted an error/improvement?" button, together with the pack and activity they relate to and your username;
- a record of which activity packs your account opens each day, and counts of how often it saves, searches, sends feedback or downloads its data, so that we can apply the fair use limits in our terms of use and protect our materials from bulk copying. We do not keep these as a readable list: each entry is a scrambled code made from your account and the action (for packs, also the UK date and which pack it was), with the time it was made. This lets us tell whether you have already opened a pack that day and how many different packs you have opened. Section 7 explains how soon we delete them.
The work you save is private to your account. Other users cannot see it. We do not routinely look at it, but we may look at a particular account's saved work to help with a problem you ask us about, or to check a report that it breaks our terms of use, for example that it contains pupils' information.
Collected automatically
- Sign-in cookies: cookies that keep you signed in, protect a password reset, and remember a browser you have signed in from (see section 8).
- Security records: a count of recent attempts to sign in, sign up or reset a password, so that we can limit repeated attempts and stop misuse. We count them against a scrambled code made from the IP address or account, not the IP address itself, and delete the counts within 30 days.
- Session records: while you are signed in, our sign-in provider keeps the IP address, browser type and start time of your session, and the date you last signed in.
- Server logs: our hosting providers keep standard logs of requests to the website, which include IP addresses, times, the pages requested and browser type.
- Email delivery records: whether the emails we send you were delivered or bounced.
From other places
If you are already in Bodhi School's contact records, for example because you have been in touch with us before, we add your account details to that existing record in our customer relationship management system (CRM) instead of creating a second record. We do not buy personal information, and we do not collect it from social media.
What you need to give us
We need the details marked as required on the sign-up form to create and run your account and to show you resources that suit what you teach. Without them we cannot create an account for you. Signing up for news emails is optional, and saying no does not affect your account.
Please do not add pupils' information
The Bodhi Bank does not need any information about pupils or students. Please do not type pupils' names or other details about them, or anyone else's personal information, into activities you edit, lessons you build, scheme-of-work mappings or feedback comments. If we find information like this, we will delete it. We do not ask for sensitive information, such as details of health, religion or ethnicity, so please do not include any.
3. How we use it and our lawful bases
The law says we must have a lawful basis for each way we use your personal information. We rely on:
- Contract (UK GDPR Article 6(1)(b)): we need the information to provide the account and the service you have asked for;
- Legitimate interests (Article 6(1)(f)): we have a genuine reason to use the information, and we have checked that this reason is not outweighed by your interests and rights;
- Consent (Article 6(1)(a)): you have given us clear permission, which you can withdraw at any time;
- Legal obligation (Article 6(1)(c)): we need the information to comply with the law.
| What we do | Information we use | Lawful basis |
|---|---|---|
| Create your account, sign you in, confirm your email address and reset your password | Name, email address, username, password (as a salted hash), role, exam boards, subjects, sign-in cookies, session records | Contract |
| Provide the features of The Bodhi Bank: starring, recently viewed, lessons, edited activities, scheme-of-work mapping, and remembering your Foundation or Higher choice | The work and settings you save | Contract |
| Show you resources that suit your role, exam boards and subjects | Role, exam boards, subjects | Contract |
| Send account emails (see section 4) | Name, email address | Contract. Legitimate interests: keeping accounts secure and telling users about important changes |
| Record your ratings and show anonymous totals to other users | Your ratings, linked to your account | Contract, to provide ratings. Legitimate interests: showing which activities work well, and improving the rest |
| Read and act on your feedback, and contact you about it if we need more detail | Your comment, the pack and activity it relates to, your username, and your email address if we need to reply | Legitimate interests: correcting errors and improving activities |
| Keep a copy of your account details in our CRM, so we can manage accounts and answer your questions | Name, email address, username, role, exam boards, subjects, sign-up date, marketing preference | Legitimate interests: running accounts and support efficiently in one place |
| Send you news and updates about The Bodhi Bank and our other apps | Name, email address, role, exam boards, subjects | Consent |
| Keep records showing that you confirmed you are 18 or over, which version of our terms of use you agreed to, which version of this notice you read, and your marketing choices | Those records, with dates and times | Legitimate interests: showing that we run the service properly and only for people aged 18 or over, and showing what you agreed to. Legal obligation: being able to show that we have your consent to marketing |
| Keep the service and your account secure, limit repeated attempts and look into misuse | IP addresses, times, session records, server logs | Legitimate interests: the security of our service, our systems and your account |
| Apply the fair use limits in our terms of use, including the daily limit on activity packs | Usage counts and the record of packs opened each day | Contract. Legitimate interests: protecting our materials from bulk copying |
| Look into and act on breaches of our terms of use, including suspending or closing accounts | Account details, saved work, usage counts, security records | Legitimate interests: protecting our materials, our users and the service |
| Improve The Bodhi Bank and plan new content using totals and summaries, for example which activities are starred most, or which exam boards to add next | Saved work, ratings, role, exam boards and subjects, combined across users | Legitimate interests: improving the service |
| Deal with requests to use your rights, complaints and legal claims, and comply with the law | Any relevant information, and our correspondence with you | Legal obligation. Legitimate interests: establishing, exercising or defending legal claims |
Where we rely on legitimate interests, you have the right to object (see section 10). You can ask us how we weighed our interests against yours.
Automated decisions
We do not make decisions about you by purely automated means that have legal effects or similarly significant effects on you. If there are many failed attempts to sign in or reset a password, our systems may pause further attempts for a short time. This is a security measure. In the same way, when an account reaches the daily limit on activity packs, the service does not open any more new packs for it until midnight UK time, as our terms of use explain. If either causes you a problem, please contact us.
4. Marketing emails and account emails
News about our apps
We only email you news and updates about The Bodhi Bank and our other apps for teachers and tutors if you agree. You can agree by ticking the box when you sign up (it is never ticked for you) or by switching on email news on your Account page. We ask for your consent whether you use a personal or a work email address.
- These messages are sent by Bodhi School, by email only. We may use your role, exam boards and subjects to choose which news is relevant to you.
- You can withdraw your consent at any time, as easily as you gave it: use the unsubscribe link in any of these emails, switch off email news on your Account page, or email us at privacy@bodhi.school. The unsubscribe link and the Account page setting take effect straight away. If you email us, we will act on it promptly.
- Withdrawing your consent does not affect your account.
- We keep a record of what you agreed to and when, so that we can show we had your consent.
- We never pass your details to other organisations for their own marketing.
Account emails
We send everyone with an account the emails needed to run it: confirming your email address, password resets, security notices, a reminder before we close an unused account, notice of important changes to the service, to our terms of use or to this notice, and other notices our terms of use promise, such as if we suspend or close your account, transfer the service or stop providing it. These emails are part of the service, not marketing, so we send them whether or not you have asked for news. They do not contain promotional content.
Our emails do not contain tracking pixels or tracked links, so we do not record whether you open them or which links you click.
5. Who we share it with
We use the service providers below to run The Bodhi Bank. They act only on our instructions, under contracts (data processing agreements) that require them to keep your information secure and do not allow them to use it for their own purposes.
| Provider | What they do for us | Where your information is |
|---|---|---|
| Supabase | Sign-in (including storing passwords in scrambled form) and the database that holds accounts and saved work | Our database is in London, UK. Supabase is a US company, and its staff and subcontractors may access information from the US and other countries to support and maintain the service. |
| Vercel | Hosts the website and runs our server functions | Vercel is a US company with a global network. Each request is handled at a location near you, and our server functions run in London. Vercel may also process information, such as logs, in the US. |
| HighLevel (also known as GoHighLevel) | Our CRM: holds a copy of your account details so we can manage accounts, and sends news emails if you have opted in | United States. HighLevel's staff and subcontractors may also access information from other countries to provide support. |
| Resend | Sends account emails, such as email confirmation and password resets, from apps@bodhi.school | Emails are sent from Resend's service in the EU (Ireland). Resend is a US company and stores email records in the US. |
We also use an email provider for our own business mailbox, which stores any emails you send us. Our providers use their own subcontractors, such as cloud hosting companies, under contracts with similar protections.
Other people we may share it with
- Other users never see your personal information. They only see anonymous rating totals.
- Authorities and professional advisers: if the law requires it (for example, a court order), where it is needed to protect the rights, property or safety of our users, the public or us, or to get professional advice, such as legal advice.
- A new owner: if The Bodhi Bank or the Bodhi School business moves to another organisation (for example, a company that Shivam sets up), your information may move with it. We will tell you before that happens, and the new owner must use your information in line with this notice.
We never sell your personal information.
6. International transfers
Some of our providers are based in the United States or use services in other countries, so your information may be stored in, or accessed from, places outside the UK. UK law only allows this when your information stays protected. We rely on:
- UK adequacy regulations for countries that the UK has approved as protecting personal information to a standard that is not materially lower than the UK's. These include the countries of the European Economic Area, such as Ireland, where Resend sends our emails from.
- The UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework) for US providers that are certified under it.
- UK-approved contract terms: the ICO's International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, which are part of our providers' data processing agreements.
| Provider | Safeguards we rely on |
|---|---|
| Supabase | The database stays in London. Any access from outside the UK is covered by the UK Addendum to the EU Standard Contractual Clauses in Supabase's data processing agreement. |
| Vercel, HighLevel and Resend | The UK-US data bridge, where the provider is certified under it, and the UK transfer terms (the IDTA or the UK Addendum) in each provider's data processing agreement. |
We check these safeguards whenever we review this notice. You can ask us for more information about them, or for a copy of the relevant terms, by emailing privacy@bodhi.school.
7. How long we keep it
We keep personal information only for as long as we need it for the purposes in this notice.
| Information | How long we keep it |
|---|---|
| Account details | While your account is open. Deleted within 30 days after you delete your account, or after we close an unused account. If we close your account because our terms of use were broken, we delete it in the same way, except for the short record described in the last row of this table. |
| Sign-ups that are not confirmed | 7 days. If you do not confirm your email address within 7 days, we delete the details. |
| Saved work: starred activities, lessons, edited activities and scheme-of-work mapping | While your account is open. Deleted with your account. |
| Recently viewed packs | Only the last 20. Older entries are replaced automatically. Deleted with your account. |
| Ratings | While your account is open. When your account is deleted, we delete your individual ratings. Anonymous totals do not identify anyone. |
| Feedback comments | Kept with your username while your account is open. When your account is deleted, we remove your username and anything else that identifies you, and keep the comment only for as long as it helps us keep the activities accurate. |
| Records of your age confirmation, the terms of use you agreed to and the version of this notice you read | While your account is open. Deleted with your account, unless we closed it because our terms of use were broken. |
| Record of your marketing consent | While your account is open. If you unsubscribe, we keep a note of that for as long as we hold your email address, so that we do not send you news by mistake. |
| Contact record in our CRM | While your account is open. Within 30 days after your account is deleted, we delete the contact record or, if you are in our contacts for another reason, remove the details we copied from your account. |
| Security records of sign-in, sign-up and password reset attempts | 30 days, unless we need them for longer to look into a specific security incident. |
| Usage counts and the record of packs opened each day | Each entry in the record of packs opened each day is only checked on the UK day it was made, and is ignored after 2 days at most. Our system then deletes it automatically, always within 30 days. Usage counts are also deleted within 30 days. We keep any of them for longer only if we need them to look into a specific case of misuse. |
| Session records | While you are signed in. Deleted within 30 days after the session ends. |
| Hosting providers' server logs | Short periods set by each provider, usually between 1 and 30 days. |
| Email delivery records | Up to 30 days for account emails. For news emails, kept with your CRM contact record. |
| Emails with us, requests to use your rights, and complaints | 2 years after we close the matter, unless we need them for longer because of a legal claim. |
| Browser storage on your device | Until you clear it (see section 8). |
| Accounts we close because our terms of use were broken | We keep your name, email address, username, the version of our terms of use you agreed to and a short note of what happened, for 6 years after closing, so that the account is not created again and so that we can deal with any legal claim. This does not apply to anyone under 18, whose information we delete. |
When you delete your account
When you use Delete my account, we close your account straight away. Within 30 days we:
- delete your account details and everything saved in your account;
- delete your contact record from our CRM or, if you are in our contacts for another reason, remove the details we copied from your account;
- remove your username and any other link to you from feedback comments you sent. We keep the comment text without them, so that we can keep the activities accurate.
Deleted information can remain in our providers' routine backups for a short time until those backups are overwritten in their normal cycle. We only restore from backups to recover from a technical problem, and if that ever brings back your information, we delete it again.
Unused accounts
If you have not signed in for 2 years, we will email you. If you do not sign in within 30 days of that email, we will delete your account as described above.
8. Cookies and similar technologies
We only use cookies and browser storage that are strictly necessary to provide the service you ask for. We do not use analytics, advertising or social media cookies, tracking pixels or any other third-party trackers. Our fonts and other files are served from our own website, so your browser does not request them from other companies. That is why there is no cookie banner.
| Name | Type | Why we use it | How long it lasts |
|---|---|---|---|
| __Host-bank_at | Cookie set by us, only after you sign in | Shows that you are signed in (an access token), so each page can show your account | Up to 1 hour. Renewed automatically while you use the service. Deleted when you sign out. |
| __Host-bank_rt | Cookie set by us, only after you sign in | Lets us renew your sign-in securely without asking for your password again (a refresh token) | Up to 30 days. Deleted when you sign out. |
| __Host-bank_rec | Cookie set by us, only when you use a password reset link | Proves that you opened a genuine reset link, so that only you can choose the new password. It does not sign you in. | Up to 15 minutes. Deleted once your new password is saved. |
| __Host-bank_dev | Cookie set by us after you sign in | Remembers that this browser has signed in to your account before, so that if someone else keeps guessing your password, you can still sign in from here. It holds a scrambled code, not your email address. | Up to 1 year, or until you clear your cookies. |
| bodhibank.tier | Browser storage (localStorage) on your device | Remembers whether you chose Foundation or Higher | Until you change it, sign out, another account signs in on this browser, or you clear your browser storage |
| bodhibank.feedbackDraft | Browser storage (localStorage) on your device | Keeps a comment you have started in the "Spotted an error/improvement?" box, so you do not lose it before you send it | Until you send the comment, empty the box, sign out, another account signs in on this browser, or you clear your browser storage |
| bodhibank.tray | Browser storage (localStorage) on your device | Remembers the activities you have picked for a lesson you are building, until you save it to your account | Until you save or clear the lesson, sign out, another account signs in on this browser, or you clear your browser storage |
| bodhibank.scheme | Browser storage (localStorage) on your device | Remembers whether the topic list follows the AQA specification or one of your saved schemes of work | Until you change it, sign out, another account signs in on this browser, or you clear your browser storage |
| bodhibank.owner | Browser storage (localStorage) on your device | Your username, so that the items above are only ever shown to the account that saved them: when another account signs in on this browser, they are removed first | Until you sign out or clear your browser storage |
| bodhibank.dyslexia | Browser storage (localStorage) on your device | Remembers whether you turned on Dyslexia mode | Until you change it or clear your browser storage |
All our cookies are "HttpOnly", which means code running in the page cannot read them, and they are only ever sent over a secure connection to bank.bodhi.school. All our browser storage items have names starting with "bodhibank.". They only record choices and text that you enter, they stay on your device, and they are not sent to us, except the text of a feedback comment when you choose to send it.
Because these cookies and storage items are strictly necessary for the service you have asked for, the law does not require your consent for them, but we still want you to know about them. You can delete them at any time in your browser settings. If you do, you will be signed out and the service will forget your Foundation or Higher choice and any lesson you had not yet saved.
9. How we keep it secure
We use industry-standard measures such as encryption in transit and at rest, access controls and rate limiting. In particular:
- the website only works over a secure (HTTPS) connection;
- each account can only reach its own saved information;
- only Shivam has administrator access, protected by two-step verification;
- passwords are stored by our sign-in provider only in scrambled form, and we never store or log them;
- repeated attempts to sign in or reset a password are limited, and password reset links work only once and expire after a short time;
- secret keys are kept on our servers and never included in the code sent to your browser;
- our providers are bound by contracts that require them to keep your information secure.
No website or online service can be guaranteed to be completely secure. Please use a strong password that you do not use anywhere else, and tell us straight away if you think someone else has used your account. If a security incident is likely to cause a high risk to your rights and freedoms, we will tell you without undue delay, and we will report incidents to the ICO when the law requires us to.
10. Your rights and how to use them
You have the right to:
- access your information: ask for a copy of the personal information we hold about you;
- correct it: ask us to correct information that is wrong or incomplete;
- delete it: ask us to delete your information;
- restrict it: ask us to pause using your information in some situations, for example while we check whether it is accurate;
- object: object to us using your information where we rely on legitimate interests. You can always object to marketing, and we will stop;
- data portability: receive the information you gave us in a format a computer can read, so that you can reuse it elsewhere;
- withdraw consent: where we rely on your consent (news emails), withdraw it at any time;
- complain: to us and to the ICO (see section 11).
Some of these rights have conditions and exceptions. If one applies to your request, we will explain it.
Do it yourself on your Account page
- Download my data: a file (in JSON format) containing the information linked to your account, including your details and your saved work. For anything not in the file, such as security records, ask us.
- Edit my details: change your name, role, exam boards and subjects. To change your email address, contact us. Usernames cannot be changed.
- Email news: switch news emails on or off.
- Delete my account: close your account and delete your personal information as described in section 7.
Or ask us
For anything else, email privacy@bodhi.school or write to us at the address in section 1. It is free of charge.
- We will reply without undue delay and within one month. If your request is complex, or you make several requests, we may extend this by up to two further months, and we will tell you within the first month.
- We may ask you to confirm your identity, usually by replying from the email address on your account. In that case, the month starts when we have confirmed it.
- If we need to ask what information or processing your request is about, the time limit pauses until you reply.
- If a request is clearly unfounded or excessive, we may charge a reasonable fee or refuse it, and we will explain why.
11. Complaints
Complain to us
If you are unhappy with how we have used your personal information, or you think we have not followed data protection law, you have the right to complain to us. Email privacy@bodhi.school with "Data protection complaint" in the subject line, or write to us at Unit 3C, Oldknows Factory, Egerton Street, Nottingham, NG3 4GQ. Please tell us what happened and what you would like us to do. We will accept your complaint however you send it.
When we receive your complaint, we will:
- acknowledge it within 30 days of receiving it;
- look into it without undue delay, ask you for more information if we need it, and keep you updated on our progress;
- tell you the outcome, and what we will do about it, without undue delay.
Complain to the ICO
You also have the right to complain to the Information Commission, the UK's data protection regulator, whose office is known as the ICO. The ICO usually expects you to raise your concern with us first and give us a chance to put things right, but you can contact it at any time.
- Online: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commission's Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL
12. Age limit
The Bodhi Bank is only for teachers, tutors and other education professionals aged 18 or over, and you must confirm your age when you sign up. The service is not designed for children, and we do not knowingly collect personal information from anyone under 18. If we learn that someone under 18 has an account, we will close it and delete their information. If you think this has happened, please tell us.
13. Changes to this notice
We review this notice at least once a year, and whenever we change how we use personal information, for example when we add a feature, change provider or change the name of the service. The date and version at the top show when it last changed. If we make an important change, we will tell you by email or when you next sign in, before the change takes effect. You can ask us for earlier versions.