Safeguarding & Compliance Centre
We take keeping children safe seriously — and here is the proof
A clear, honest look at how LearnarooHub protects children and their data, written for pupils, parents, schools and auditors alike. This is separate from our formal policies, which you can read in full at any time.
Encrypted in transit & at rest
Two-factor for all staff
Web application firewall
Role-based access
Tamper-evident audit log
UK GDPR & Children’s Code
No matches. Try a different word, or clear the search.
Our safeguarding promise
Children are at the heart of everything we build, so keeping them safe and keeping their information private are not features we added — they are the foundation. This Centre explains, in plain language, exactly how we do that: how we protect children, how we protect their data, and how we hold ourselves accountable. It is written for everyone — pupils, parents and carers, schools and trusts, and the auditors and inspectors who quite rightly ask us to prove it.
Keeping children safe
Every design decision starts with a simple question: is this safe and right for a child? Here is what that means in practice.
Resources are reviewed and published by trusted adults — teachers and our own team — before they appear to a child. There is no open, unfiltered web browsing inside LearnarooHub, so children are not one wrong click away from something inappropriate.
LearnarooHub is not a social network. Children cannot be messaged by, or message, people they are not connected to through their school or family. Accounts are linked deliberately by the adults responsible for that child.
We follow the Information Commissioner’s Children’s Code (the Age Appropriate Design Code). That means privacy-friendly defaults for young users, language pitched at the right age, and no design tricks that pressure children into sharing more than they need to.
Any child, parent or member of staff who is worried about a child can reach our Designated Safeguarding Lead quickly — see the Report a concern section below. Concerns are taken seriously and acted on.
We never show advertising to children, and we never sell or rent children’s data, or use it to target marketing. A child’s data is used to help them learn — nothing else.
For parents and carers
You trust us with your child’s learning and their information. Here is what we hold, how we look after it, and how you stay in control.
Typically your child’s name and a username, their year group and the work they do on the platform, and progress information that helps their teacher support them. We do not require a child’s email address or phone number to use LearnarooHub.
Sensitive details are encrypted when stored, traffic is encrypted in transit, and only the adults connected to your child — their teacher and you — can see their records. More detail is in the “How we protect data” section.
As a parent or carer you can view your child’s information through your family dashboard. If something is wrong, you can ask us to correct it, and in many cases to delete it. See “Your data rights”.
Our Online Safety Framework gives practical, jargon-free guidance you can use at home. Read the Online Safety Framework.
If you have a worry about your child’s safety or their data, contact us using the details in the Report a concern section — a real person will respond.
For schools and trusts
When a school or trust uses LearnarooHub, we act as your data processor. You remain in control of your pupils’ data; we look after it on your instructions.
Your school (or trust) is the data controller and decides how pupil data is used. LearnarooHub is the processor, acting on your documented instructions under UK GDPR. We do not use your pupils’ data for our own purposes.
LearnarooHub is multi-tenant: each school and trust is isolated so that one organisation can never see another organisation’s pupils or staff. Permissions are checked on every request, not just at login.
We make a Data Processing Agreement available that sets out roles, security measures and sub-processors. Our hosting provider (Hostinger) is our key infrastructure sub-processor, engaged under its own data processing terms.
This Centre is designed to give you and your auditors clear, honest evidence of our controls. We also maintain a Data Protection Impact Assessment (DPIA) and a Record of Processing Activities (ROPA), which we can share with you on request.
Please keep your staff accounts secure, use the two-factor authentication we require, only give colleagues the access they need, and tell us promptly if a staff member leaves so their access can be removed.
How we protect data
The technical detail, explained simply. These are controls that are live on the platform today.
All connections to LearnarooHub use HTTPS/TLS, so information is encrypted as it travels between your device and us. We enforce this with HTTP Strict Transport Security (HSTS), which tells browsers to only ever connect securely.
Sensitive pupil, staff and parent information — including special-category welfare data and identifiers such as date of birth and Unique Pupil Number — is encrypted in our database. The encryption key is kept separately from the data, so the stored values are not readable on their own.
Some identifiers still need to be searchable (for example, to find the right pupil record). For these we use a one-way “blind index”: the system can match a record without ever storing the value in readable form. You get the convenience of search without leaving sensitive data lying in the open.
We set modern security headers including X-Frame-Options (to prevent clickjacking), X-Content-Type-Options, a Referrer-Policy, and a policy that upgrades insecure requests — reducing common web attack routes.
Data minimisation is built in. For example, children do not need an email address to use the platform, and we only collect what is needed to help a child learn and to keep their account safe.
Accounts, sign-in and access control
Strong access control keeps the wrong people out and limits what any one account can reach.
Every staff and administrator account is required to use two-factor authentication (2FA) — a second check at sign-in, on top of the password, using a code from an authenticator app. Even if a password is guessed or stolen, an attacker still cannot get in. Staff can set this up from their own Account settings. Open Account settings.
People only see what their role allows. A teacher sees their own pupils; a school leader sees their school; a trust leader sees their trust. Permissions follow the principle of least privilege.
Combined with role-based permissions, our multi-tenant design means access is scoped to a single school or trust. There is no shared view across organisations.
Anyone cannot simply register an account. Self-registration is disabled, so accounts are created only through trusted, controlled routes — reducing the risk of fake or malicious accounts.
Passwords are stored using strong one-way hashing (never in plain text), and sensitive account changes require you to re-confirm it is really you.
Infrastructure, hosting and firewall
Where your data lives and how the platform underneath is protected.
LearnarooHub runs on Hostinger Business hosting on high-performance LiteSpeed servers. Hosting is a core part of our security, not an afterthought.
Our hosting provides a web application firewall (WAF) that filters malicious web traffic, together with distributed denial-of-service (DDoS) protection to keep the service available even under attack.
The hosting platform includes automated malware scanning, helping detect and stop malicious code.
The platform is backed up regularly so data can be restored if something goes wrong. In addition, we take our own backup of any file or setting before we change it, so changes can be reversed quickly.
Changes to the platform are checked for errors before they go live and are made with a backup in place. This reduces the chance of an update causing an outage or data problem.
Governance and compliance
The laws and codes we work to, and the records we keep to prove it.
Our complete, versioned Child Safety & Safeguarding Policy is available as a PDF for parents, schools, trusts and auditors — it covers roles, the reporting procedure, online safety, data protection and our review cycle. Download the Safeguarding Policy (PDF).
We align to the UK GDPR and the Data Protection Act 2018, the ICO’s Children’s Code (Age Appropriate Design Code), and the safeguarding expectations of Keeping Children Safe in Education (KCSIE).
Because we process children’s data, we maintain a DPIA that identifies risks to children and the steps we take to reduce them. It is reviewed as the platform changes.
We keep a ROPA — a clear record of what data we process, why, the legal basis, who it is shared with, and how long we keep it — as required by Article 30 of the UK GDPR.
Important administrative actions are recorded in an audit log designed to be tamper-evident, so there is an accountable trail of who did what.
We are actively working towards Cyber Essentials certification. We believe in being honest about where we are: the controls above are live now, and formal certification is a goal we are pursuing, not a claim we make prematurely.
Humaira Ahmed is our Data Protection Officer and Designated Safeguarding Lead. You can reach the DPO at support@learnaroohub.com.
Your data rights
You have rights over the information we hold, and we make them straightforward to use.
You can ask to see the data we hold about you or your child, to correct anything that is wrong, and in many cases to have it deleted. We will respond within the timescales the law requires.
We keep a pupil’s records for as long as they are at the school and for six years after they leave. Financial records are kept for six years. After that, data is securely deleted or anonymised.
Email support@learnaroohub.com for the attention of our Data Protection Officer, Humaira Ahmed. If your child is at a school that uses LearnarooHub, the school is the data controller, so we may work with them to handle your request.
You can complain to us at any time, and you also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator, at ico.org.uk.
Report a concern or contact us
If something is wrong, please tell us — a real person will respond.
Email support@learnaroohub.com with “Safeguarding” in the subject line, for the attention of our Designated Safeguarding Lead, Humaira Ahmed. If a child is in immediate danger, call 999.
Contact our Data Protection Officer, Humaira Ahmed, at support@learnaroohub.com.
For anything else, email support@learnaroohub.com and we will point you to the right place.
One promise, in plain words: we will only ever use a child’s information to help them learn and to keep them safe, we will protect it properly, and we will be honest with you about how we do it. If we can improve, tell us — email support@learnaroohub.com.
