Is it safe to forward school emails to Penny?

Yes. Penny is built to UK GDPR and the Data Protection Act 2018, with the ICO's Age Appropriate Design Code in mind since she handles children's information. Your data is stored in the EU on infrastructure independently certified to SOC 2 Type II and ISO 27001, it is never sold, and you can delete it at any time.

Does Penny sell my family's data?

No. Penny does not sell data, aggregated or otherwise, and does not use family information to train advertising or build a marketing profile.

Where is Penny's data stored?

Penny's data is stored securely in the European Union. Some processors are based in, or process limited data in, the United States under recognised UK data transfer safeguards.

Can I delete my data from Penny?

Yes. You can ask Penny to forget a specific thing, or say 'delete everything' to remove your family's information from the service entirely.

← Back to the blog

Safety & privacy

Is it safe to forward school emails to an AI assistant?

21 August 2026 · 5 min read

What "safe" should actually mean here, and how Penny handles your family's school data in practice.

In short

Yes, provided the assistant is built to the right legal standard, collects only what it needs, never sells data, and gives you a clear way to delete it. Penny, the school admin assistant, meets that bar: built to UK GDPR and the Data Protection Act 2018, with the ICO's Age Appropriate Design Code in mind since she handles children's information, running on infrastructure independently certified to SOC 2 Type II and ISO 27001, data stored in the EU, nothing sold, and full deletion on request. The fair question isn't just "is AI safe", it's "does this specific provider meet the bar for a product that handles children's data", and that's answerable by checking their privacy policy, not by trusting a badge.

Where data is stored	The European Union
Legal framework	UK GDPR, Data Protection Act 2018, ICO Age Appropriate Design Code
Infrastructure certifications	SOC 2 Type II, ISO 27001 (hosting, database, AI processing)
Is data sold	No, never, aggregated or otherwise
Used to train ad models	No
Can you delete your data	Yes, ask Penny to forget something, or say "delete everything"
Who processes messages	Meta (WhatsApp), OpenAI, Supabase, Vercel, Stripe, listed in full in the privacy policy

1. The short answer

Yes, forwarding school emails to a well-built AI assistant is safe, in the same way that using any cloud-based service responsibly is safe: it depends on how that specific provider handles your data, not on AI as a category. The right question isn't "is AI safe", it's "does this provider meet a reasonable bar for security, minimal collection, and control", and that's something you can check directly rather than take on faith.

2. What "safe" should actually mean

Real legal compliance, not just a badge on a landing page — UK GDPR, the Data Protection Act 2018, and, for anything touching children, the ICO's Age Appropriate Design Code — backed by infrastructure that's independently security-certified (SOC 2 Type II, ISO 27001).
Minimal collection: only what the service needs to function, not everything it could gather.
No resale: your family's information isn't a product being sold on to third parties.
A real deletion path: a clear, working way to remove your data, not a support ticket that goes nowhere.
Clear processors: knowing which companies actually touch your data, and why.

3. How Penny handles school data

Penny is built to UK GDPR and the Data Protection Act 2018, with the ICO's Age Appropriate Design Code in mind since she handles children's information. Data is stored securely in the European Union, on infrastructure independently certified to SOC 2 Type II and ISO 27001. Messages are processed by a small, named set of processors, Meta for WhatsApp delivery, OpenAI for understanding messages and transcribing voice notes, Supabase for storage, Vercel for hosting, and Stripe for payment, each acting only on Penny's instructions. None of them are permitted to use your family's information for their own purposes, and OpenAI does not train its models on data sent through its business API. Full detail is in the privacy policy.

4. What you're in control of

You can ask Penny to forget one specific thing at any time, or say "delete everything" and your family's information is removed from the service. Nothing requires a support ticket or a wait. Penny also collects only what she needs to do her job, your children's first names, school, class, and the admin itself, not a wider profile.

5. When you shouldn't forward something

Use ordinary judgement: Penny is built for school and family admin, reminders, deadlines, kit lists, and schedules, not for highly sensitive documents unrelated to that purpose, such as medical records or financial statements. Treat her the way you'd treat any admin assistant: give her what she needs to help, and keep anything unrelated out of the conversation.

Try it yourself with your next school email. Free for the first 30 days. For the complete detail on data handling and your rights, read the full privacy policy.

Start on WhatsApp