Skip to content
A white cottage in long grass below a mountain under low cloud.

Privacy policy

Last updated 24 September 2026.

This policy explains what information The Story School holds about you, why we hold it, who can see it, and what you can ask us to do with it. We have tried to write it in plain English. If anything here is unclear, email help@projectscotland.info and a person will answer you.

Who we are

The Story School is run by Project Scotland. It is part of The Story churches network, and its aim is to serve our churches and partners. Project Scotland is the data controller for the information described here: we decide what is collected and why, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For any question about your information, or to use any of the rights set out below, email help@projectscotland.info.

What we hold about you

  • Your account: your name, your email address, your password (stored only in a scrambled form that nobody can read back), and your church, if you have one.
  • Your profile picture, if you upload one.
  • Your training record: which classes and courses you have started and finished, how much of each video you have watched (stored as the stretches of video that played, not a recording of you), and each quiz attempt with the answers you chose.
  • Sign-in records: when you signed in, and the IP address and browser details of the device you used, so that we can keep your account secure.
  • Invitations: if a church leader invites you, the email address they invited and whether the invitation was accepted.
  • The notifications we show you in the portal, and a record of each email we send you: the address, the subject and whether it was delivered.
  • A log of important actions taken in the system, such as an administrator approving an account, with the IP address it came from, so that mistakes can be traced and put right.
  • Messages you send through the contact form: your name, your email address, the subject and the message.

We never ask for payment details. The discussion questions in each class are for talking over with other people, and nothing said in those conversations reaches us.

Why we hold it

  • To give you the training you signed up for: your account, your progress, your quizzes and the classes that open as you go. The lawful basis is that this is necessary to provide the service you asked for.
  • To keep the school secure and to put mistakes right: the sign-in records, the email record and the log of actions. The lawful basis is our legitimate interest in running a safe and reliable service.
  • To let your church leader support you, as described below. The lawful basis is our legitimate interest, and your church's, in helping you through the training.
  • To answer you when you write to us. The lawful basis is our legitimate interest in replying to people who contact us.

Every email we send is about your account or your training: confirming your address, resetting a password, an invitation, a decision on your request to join, and a reminder from your church leader if you stall partway through. We do not send marketing email, and we do not sell or share your details for anyone else's marketing.

What your church leader can see

If you belong to a church in the network, that church's leaders can see your name, your email address, how far you have got in each course and when you were last active. They use it to encourage you and to notice when you have stalled, and they can send you a reminder. They cannot see your password.

A leader can also remove you from their church. Your account and your training record are kept, and your access then waits for an administrator to approve it again. The school's administrators can see all the information described in this policy, because they need it to run the school.

Who else receives it

  • Mailgun, which sends our emails. It receives your email address and the content of the emails we send you, and acts only on our instructions.
  • YouTube, which is owned by Google. The class videos are hosted on YouTube and play inside the class page. When a video loads, your browser connects to YouTube, which receives your IP address and browser details and may set its own cookies, under Google's privacy policy. It is the only outside service your browser contacts while you use the school.
  • The company we rent our server from, which stores the information but does not use it.

Nobody else. We do not sell your information, and we do not share it with advertisers.

Where it is kept

Your information is stored on a private server that we rent and manage, and in off-site backups of that server. Only the people who run the school can reach it.

Cookies

We set two cookies of our own. The first is a sign-in cookie that keeps you signed in. The second is a preference cookie that remembers which class messages you have already seen, so the portal does not show them to you again; it holds no personal data and is kept for up to a year. Both are needed for features you use, so we do not ask for your consent to them. There is no analytics and no advertising cookie or tracking anywhere on the site. YouTube may set its own cookies when you play a video, as described above.

How long we keep it

  • Your account and your training record: for as long as your account is open. If an account has not been used for three years, we may email you and then close it.
  • Contact messages, the email record and the log of actions: for two years, then they are deleted.
  • Sign-in records: until the sign-in ends or expires.
  • Backups: they are overwritten as new ones are made, so anything deleted from the school leaves the backups soon after.

When you close your account, we delete your account, your profile picture, your training record and your notifications. We keep the email record and the log of actions for the period above, without your account attached.

Your rights

You have the right to:

  • see the information we hold about you and get a copy of it;
  • have anything wrong corrected;
  • have your information deleted;
  • ask us to limit how we use it, or object to how we use it;
  • have your information given to you in a form you can take elsewhere.

You can change your name and password yourself in your account settings. For anything else, email help@projectscotland.info. We will answer within one month, as the law requires, and we will not charge you.

Age

You must be 16 or over to have an account. If we learn that an account belongs to someone younger, we will close it and delete its information.

Complaints

If you are unhappy with how we have handled your information, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk.

Changes to this policy

When we change this policy, we change the date at the top. If a change affects what we hold about you or who can see it, we will also email everyone with an account before it takes effect.