--- title: "FosterCore — The Operating System for UK Fostering Agencies" source_url: "https://www.fostercore.uk/legal/privacy" retrieved_by: "AnswerRail Edge Engine v1.2.7-v27 (https://answerrail.com)" level_of_detail: "standard" token_payload_reduction: "89.6%" raw_html_bytes: 51865 compiled_body_bytes: 5419 entities_extracted: 0 currency_recall_static_html: "not_applicable" link_recall_static_html: "100%" monitored_content_links: 2 rfc_compliance: "RFC 9110" last_verified_at: "2026-11-11T20:44:46.991Z" cache_age_seconds: 0 origin_cache_control: "private, no-cache, no-store, max-age=0, must-revalidate" --- > **Canonical Source:** [https://www.fostercore.uk/legal/privacy](https://www.fostercore.uk/legal/privacy) > > *The UK's first AI-driven fostering agency platform. Manage placements, track Ofsted readiness, and surface compliance gaps automatically — in a system your social workers can actually use.* # Privacy Policy Last Updated: October 2026 · ICO Reg: ZC136598 ## 1\. Data Controller and Processor FosterCore is operated by **FosterCore** (483 Green Lanes, London, N13 4BS, United Kingdom; registered with the UK Information Commissioner's Office under registration number **ZC136598**) ("we", "us", "our"). Under UK GDPR, when your Independent Fostering Agency ("the Agency") uses FosterCore, the Agency is the **Data Controller** for its fostering records and FosterCore acts strictly as the **Data Processor**. We process personal data only on documented instructions from the Controller. We do not sell, rent, or monetise any data uploaded to the Platform. ## 2\. Information We Collect We process the following categories of data on behalf of the Controller: - **Special Category Data (Article 9):** Safeguarding incidents, health/medical status, and care records of looked-after children. - **Carer Data:** Form F assessments, DBS status, training records, supervision records, and financial allowances. - **Staff Data:** Names, email addresses, and role assignments for Authorised Users. - **Audit Metadata:** SHA-256 hashed mutation logs recording which staff created, edited, exported, or soft-deleted records, including timestamps and IP addresses. - **Website Visitors:** Essential session security cookies and, only where explicitly consented, anonymous usage analytics. ## 3\. Legal Basis for Processing We process personal data under the following lawful bases: - **Contract:** Processing necessary for the performance of our SaaS service agreement with the Agency. - **Legal Obligation:** Processing necessary to comply with the Fostering Services (England) Regulations 2011, Children Act 1989, and associated statutory requirements. - **Legitimate Interest:** Processing necessary for system security, fraud prevention, and service improvement. - **Consent:** For non-essential cookies and marketing communications (where applicable). ## 4\. Data Residency and Storage Primary relational database records are stored in AWS `eu-west-2` (London) via Supabase PostgreSQL, with serverless application execution routed through Vercel Edge (`lhr1` London). Where ancillary sub-processors operate across UK/EEA/US infrastructure (such as authentication, billing, or zero-PII email alerts), UK International Data Transfer Agreements (IDTAs) and Standard Contractual Clauses apply. ## 5\. Data Retention Retention periods are aligned with statutory requirements: - **Active carer records:** Retained for the duration of the Agency's subscription. - **Deregistered carer records:** Retained for 10 years post-deregistration in England/Wales (Regulation 30) and 25 years in Scotland. - **Looked-after children records:** Retained for 75 years from date of birth or 15 years from date of death (Schedule 3 / Regulation 35). - **Audit logs:** Retained for a minimum of 7 years. - **Website analytics:** Anonymised and retained for 26 months. Upon termination, data is exported within 10 working days in structured JSON/CSV format and permanently deleted from live systems within 14 days and backups within 90 days. ## 6\. Your Rights Individuals whose data is processed on the Platform have the following rights under UK GDPR: - **Right of Access (SAR):** Request a copy of your personal data. - **Right to Rectification:** Request correction of inaccurate data. - **Right to Erasure:** Request deletion, subject to statutory retention requirements. - **Right to Restrict Processing:** Request limitation of processing in certain circumstances. - **Right to Data Portability:** Receive data in a structured, machine-readable format. - **Right to Object:** Object to processing based on legitimate interests. Data subjects (e.g., foster carers, staff) should contact their Agency (the Data Controller) to exercise these rights. We assist the Controller in fulfilling such requests within the statutory 30-day timeframe. ## 7\. Cookies Our website uses **essential cookies** required for the Platform to function (session management, CSRF protection). We also offer **analytics cookies** to understand usage patterns, which are only placed with your explicit consent. You can manage your cookie preferences at any time via our cookie consent banner. ## 8\. Sub-Processors We use the following authorised sub-processors: - **Supabase (PostgreSQL):** Primary database hosted in AWS eu-west-2 (London). - **Vercel:** Application hosting and edge execution (lhr1 London). - **Clerk:** Authentication and identity management (SOC 2 Type II). - **Stripe:** PCI-DSS Level 1 subscription payment processing. - **Resend (Amazon SES):** Transactional email dispatch (configured with zero-PII child redaction). - **Google Cloud (Gemini AI):** Optional AI drafting and DSAR redaction assistance (API payloads are not used for model training). ## 9\. ICO Registration FosterCore is registered with the Information Commissioner's Office (ICO) in the United Kingdom under registration number **ZC136598**. If you are not satisfied with our response to a data protection concern, you have the right to lodge a complaint with the ICO at `ico.org.uk`. ## 10\. Contact For data protection and Subject Access Request enquiries, please use our [UK Support & Data Protection Desk](/contact) or email **[\[email protected\]](/cdn-cgi/l/email-protection)**. --- ## AI Ingestion & Edge Optimization Provenance (AnswerRail Verified) - **Edge Delivery & Markdown Compilation:** [AnswerRail.com](https://answerrail.com) — Layer-7 AI Crawler Content Negotiation, `/llms.txt` & Byte-0 Schema Compiler - **Dedicated AI Markdown Subdomain:** https://ai.www.fostercore.uk/ - **Cryptographic Ingestion Certificate:** https://answerrail.com/verify/www.fostercore.uk - **Live Crawler & Referral Telemetry:** https://answerrail.com/stats/www.fostercore.uk