Privacy Policy

1. Who we are and what this policy covers

Scoutworks is operated by Seventeen Things Ltd (“we”, “us” or “our”), a company registered in England and Wales under company number 16620173, with its registered office at Bartonbury House, GL71UZ.

This policy explains how we collect, use and protect personal data when you use:

• the Scoutworks web application at my.scoutworks.app, including the Parent Portal, Youth Member Portal and District Portal, and Young Leaders’ access to the leader app;
• this marketing website at scoutworks.app, including the knowledge base and the free tools;
• our support channels — the contact form and live chat, which run on a Chatwoot instance we host ourselves at support.scoutworks.app;
• the shared demo sandbox at demo.scoutworks.app; and
• our website analytics (see section 10).

Many of the people whose data passes through Scoutworks are under 18. We treat that as a design constraint, not a footnote: section 4 sets out exactly what young people’s accounts can and cannot do.

2. Controller and processor

Who is responsible for personal data depends on where it comes from.

• Member data entered into the app — names, contact details, medical information, attendance, badge progress and so on — belongs to the Scout group (or district) that entered it. The group is the data controller and Seventeen Things Ltd is the data processor, acting only on the group’s instructions and the terms of our Terms of Service.
• Everything else — the account details of the adults who sign up, billing records, messages sent to our support team, and data about visits to this website — is data for which we are the data controller.

As controller of member data, the group decides what is collected and why, must have a lawful basis for processing it, is responsible for informing parents and members, and handles their requests to see, correct or delete it. We help with those requests (section 9) and we never use member data for our own purposes.

3. Information we collect

3.1 Account information (we are the controller)

• Name, email address and role of adult users — leaders, group admins, trustees and parents
• Sign-in credentials. Passwords are stored only as a one-way hash; if you sign in with Google or Microsoft we receive your name and email address from them
• Subscription and billing records. Card details are collected and held by Stripe, our billing provider; we store only Stripe’s reference identifiers, never card numbers

3.2 Member information (we are the processor)

Groups may enter the following about their members and volunteers:

• Names, dates of birth, section membership and contact details
• Parent and guardian contact details, and emergency contacts
• Medical, dietary and additional-needs information, where the group records it
• Attendance, badge and award progress, and event participation
• Consent forms, signed by parents, with a point-in-time snapshot of medical information against the event
• Payment records for subscriptions, camps and events (bank details are held by GoCardless, not by us)
• Photographs and files, where the group uploads them
• Accident and incident records

3.3 Young people’s accounts

Where a parent or the group has enabled an account for a young person (section 4), we also process the credentials for that account and what the young person does with it: activity suggestions made through Youth Voice, answers to surveys sent by their leaders, and badge evidence they submit for a leader to review.

3.4 Support conversations (we are the controller)

• Contact form: your name, email address, the category you choose and your message. Submitting the form starts a conversation in our self-hosted Chatwoot instance and, where you give an email address, sends you a confirmation receipt via Resend.
• Live chat: the chat widget loads only when you open it. It stores a token in your browser so your conversation can continue, and we see the messages you send plus basic browser and page information.
• In-app support tickets and bug reports include a screenshot and diagnostic context, attached automatically so we can reproduce the problem.
• Where a support request needs engineering work, a summary is escalated to Linear, our issue tracker.

3.5 Technical information

• Server and security logs, including IP addresses, request paths and browser details. Medical, dietary and credential fields are automatically redacted from logs
• Aggregate, cookieless website analytics from Umami (section 10)
• Aggregate website analytics from Google Analytics, and only where you accept analytics cookies (section 10)
• Product analytics inside the web application, which we use to understand which features are used and to manage feature roll-outs
• Browser push notification subscriptions, only where you switch them on

4. Young people’s data

Scoutworks gives young people a login of their own — the Youth Member Portal (“My Scouting”) for Scouts and Explorers, and Young Leader accounts for Young Leaders aged 14 and over. These accounts are deliberately limited:

• Young people cannot create their own account. A Youth Member Portal account is created by a parent or guardian, who can reset or remove it at any time. A Young Leader account is created by the group’s leaders from the Young Leader’s existing member record.
• No peer-to-peer messaging. Young people cannot message each other through Scoutworks.
• No leaderboards. Progress is shown to the young person, not ranked against others.
• Moderated Youth Voice. Activity suggestions are reviewed by a leader before other young people can see or upvote them.
• Leader-led surveys. Surveys are created and sent by leaders and answered in the app; responses go back to the leaders.
• Badge evidence goes to a leader. Anything a young person submits lands in the same review queue as evidence submitted by parents.
• Young Leaders see a tailored view limited to the sections they volunteer with, with personal information about other members protected.

We do not send marketing to young people, and we do not use their data for advertising or profiling.

4.1 Parental rights and consent

As the data controller, the group must:

• Obtain appropriate parental consent before recording a child’s personal data, and before enabling a Youth Member Portal account
• Tell parents what is collected and why — we suggest linking to this policy
• Give parents access to their child’s data (the Parent Portal shows parents their own children’s records)
• Act on parental requests to correct or delete information

4.2 Data minimisation

We encourage groups to record only what Scouting activities need, to avoid sensitive data unless it is essential (medical information for an event, for example), and to review and delete out-of-date information regularly.

5. How we use information

5.1 Providing the service

• Running your group’s membership, events, badges, communications and finances
• Enabling communication between leaders and parents, and delivering notifications you have switched on
• Generating reports, board packs and census returns

5.2 Accounts, billing and support

• Creating and securing user accounts
• Taking subscription payments and keeping the accounting records we are legally required to keep
• Answering support requests and fixing bugs
• Sending service messages — for example about renewals, security or changes to these terms. We do not send marketing email to people who have not asked for it

5.3 Security, safety and legal obligations

• Detecting and preventing abuse, fraud and unauthorised access
• Responding to safeguarding concerns and legal requests
• Complying with tax, accounting and other legal obligations

5.4 Lawful bases

Where we are the controller, we rely on performance of a contract (running your account and subscription), legitimate interests (keeping the service secure, answering support requests, understanding in aggregate how the website is used) and legal obligation (accounting records). Where we are the processor, the group determines the lawful basis.

6. Sharing, sub-processors and transfers

6.1 We never sell data

We do not sell, rent or commercially share personal data, and we do not share it with advertisers.

6.2 When we share

We share personal data only:

• with the service providers listed in section 6.4, who process it on our behalf under written data-processing terms and only for the purpose stated;
• where the group, as controller, instructs us to (for example, sharing a member record with another group after a parent has consented);
• where the law requires it — a court order, or a request from a child-protection authority; or
• in an emergency involving someone’s safety.

6.3 Where data is stored

The application, its database and file storage are hosted in the European Union (Amsterdam, the Netherlands). A small number of providers marked with an asterisk in the table below are based in the United States; transfers to them are protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

6.4 Our sub-processors

This is the complete list of third parties that process personal data on our behalf, last reviewed on 7 October 2026. We update it whenever a provider is added or removed.

* Based outside the UK and EU; transfers are protected as described in section 6.3.

6.5 AI features and AI providers

Some Scoutworks features use an AI provider to produce a draft: a term programme in the programme planner, a draft or check of an email in the composer, and suggested hazards and control measures in the risk assessment wizard and the trustee strategic risk register. Every one produces a draft that a leader edits and approves. No AI feature runs on its own.

Receipt scanning. When a leader adds a photo of a receipt to an expense claim, the photo is sent to the AI provider, which reads the shop, the date and the total and fills in the fields the leader left blank. The photo is sent to Google (the Gemini API) on our account, or to the group’s own AI account if it has connected one that can read images. A PDF receipt with a text layer is read on our own servers, with no AI call. The leader checks every filled-in field and can change it.

What is sent. Only the context of the job — the activity, the venue type, the age sections, how long your meetings run, the term dates, the badge requirements in the group’s goal, and any notes the leader typed. Names, email addresses and telephone numbers are removed from typed notes before they are sent. For receipt scanning, the photo of the receipt.

What is never sent. No young person’s name, address, date of birth, medical condition, dietary need, photograph or contact detail. No parent or volunteer contact detail. We do not permit the provider to use your group’s data to train its models.

If your group connects its own AI account. A group admin can enter an API key for the group’s own OpenAI, Anthropic, Google or xAI account, after which every AI feature runs on that account instead of ours. In that case the group, as controller, has appointed that provider itself, on the terms it agreed with them; the provider is not our sub-processor and does not appear in the table above. The key is encrypted at rest with AES-256-GCM, is never returned to a browser, and is shown only as its last four characters. Removing the key returns the group to our default provider, Google, in the table above.

7. Security

Scoutworks holds the UK Government-backed Cyber Essentials certification, reassessed annually, and a cyber insurance policy is in place. The measures below are in place today:

• Encryption in transit — every connection uses TLS 1.2 or higher
• Encryption at rest — AES-256 at the infrastructure level, with sensitive credentials additionally encrypted at the application level
• Passwords are stored only as a one-way bcrypt hash and screened against known-breach databases using a k-anonymity check, so the password itself never leaves our servers
• Access controls — each group is an isolated tenant; every request passes identity, group-membership, subscription, role and section-level checks; parents have read-only access to their own children only
• Sessions are short-lived, and authentication and other sensitive endpoints are rate-limited
• Backups of the database and uploaded files are taken automatically every day. File backups are held with a separate provider
• Log hygiene — medical, dietary and credential fields are redacted from system logs
• Secure development — every code change is reviewed, scanned for vulnerable dependencies and leaked secrets, and deployed to a staging environment before a human-confirmed production release
• Monitoring — structured logging, metrics and real-time alerting around the clock

Two-factor authentication and passkeys are available to every account. For transparency: independent penetration testing is on our roadmap and not yet in place. We publish a fuller description on our security page.

8. Data retention

8.1 While your subscription is active

We keep account and member data for as long as your group uses Scoutworks. The group, as controller, decides how long individual member records are kept and can delete them at any time; we recommend following your Scouting organisation’s guidance. Accident and incident records are retained for 20 years, in line with safeguarding good practice.

8.2 After your subscription ends

• If your subscription ends — because you cancel or do not renew — your group’s data is retained for 90 days, during which you can export it or reactivate. After 90 days it is deleted.
• If you delete your group yourself, its data enters a 30-day recovery window and is then permanently and irreversibly removed by an automated process.
• Groups can export their member data at any time.

8.3 Other records

• Server and security logs: no longer than 12 months
• Backups: when data is deleted, copies stay in our backups for up to 27 days (database) and 30 days (files), and are then removed automatically
• Support conversations: 24 months
• Billing and accounting records: six years after the end of the financial year they relate to, as required by UK law

9. Your rights

Under UK data protection law you have the right to:

• Access — a copy of the personal data held about you
• Rectification — correction of inaccurate information
• Erasure — deletion of your personal data, where there is no overriding reason to keep it
• Portability — your data in a machine-readable format
• Objection and restriction — to object to, or limit, certain processing

If your request concerns member data held by a Scout group, please contact the group first: it is the controller and can see and change your record directly. We will assist the group, and we will forward any request we receive to the relevant group. Parents can exercise these rights on behalf of their children, and we will take a young person’s own views into account where they are old enough to express them.

For anything else, email [email protected] or use the contact form. We respond within one month.

10. Cookies and analytics

10.1 Strictly necessary cookies only

This website sets only cookies that are needed for it to work:

• cc_cookie — remembers that you have seen the cookie notice, so it is not shown again (expires after six months)
• The live-chat widget, if you open it, stores a token in your browser so your conversation can continue

We set analytics cookies (_ga and _ga_*, for Google Analytics) only after you accept them in the cookie notice. You can change your mind at any time from the same notice.

The web application uses session cookies to keep you signed in. There are no advertising or cross-site tracking cookies anywhere on Scoutworks.

10.2 Analytics

To understand which pages are useful we use two tools on this website.

• Umami, an open-source analytics tool that we host ourselves at umami.scoutops.work. Umami is cookieless: it sets no cookies, stores no personal data, does not track you across other sites, and reports visits only in aggregate. Because it collects no personal data, there is nothing to consent to.
• Google Analytics 4, which does set cookies. It runs only where you accept analytics cookies in our cookie notice. Until you accept, Google Consent Mode keeps all of its storage switched off, so it writes nothing to your device. We never switch on its advertising or remarketing features, and we do not use advertising pixels anywhere.

Google Analytics is provided by Google Ireland Limited and may transfer data to the United States; those transfers are protected as described in section 6.3.

11. Changes to this policy

We will post any changes on this page and update the dates at the top. If a change materially affects how we handle personal data — and in particular young people’s data — we will email account holders before it takes effect. Each version carries a short note of what changed.

12. Contact and complaints

Please mention “Youth Data” in your message if your enquiry concerns a young person, so we can prioritise it.

If you are not satisfied with our response you have the right to complain to the Information Commissioner’s Office: ico.org.uk or 0303 123 1113.

13. Your responsibilities as a data controller

If you run a group on Scoutworks, you should:

• Keep valid consent records for youth members and their parents
• Tell parents and members what you collect and why
• Handle data-subject requests promptly, and ask us if you need help
• Report any suspected data breach to us immediately at [email protected]
• Follow your Scouting organisation’s safeguarding and data policies
• Review member information regularly and delete what you no longer need

Should we become aware of a personal-data breach affecting your group, we will notify you without undue delay so that you can meet your own obligations.