Last updated 20 October 2026
Privacy policy
RunSheet holds money-related details about real people, so we keep this simple and honest: what we collect, why, who else sees it, and what you can ask us to do.
Some of our business details below are still being added.
Who we are
- Business: Livelihood Ventures Ltd, company number 17496152
- Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
- Email: hello@schoolrunsheet.co.uk
- ICO registration number: [to be added]
Two kinds of data, two roles
Operators’ own accounts. When a transport company signs up, we hold the names, email addresses and passwords of the people who use RunSheet in the office (and their accountant). For this data we are the controller.
Drivers’ and PAs’ data. Operators use RunSheet to hold details about the drivers and passenger assistants who invoice them. The operator decides what is held and why, so the operator is the controller and we are their processor, acting only on their instructions under our data processing agreement. If you are a driver or PA, the company you work for is your first point of contact about your data.
What we collect
About office users and accountants
- Name, email address and company details.
- A password, which is stored only as a one-way hash, so nobody (including us) can read it.
- A record of the actions you take in RunSheet, such as approving or paying an invoice.
- If your company subscribes: the billing name, email, address and VAT number you give at checkout, and your subscription and payment history. Card details go straight to our payment provider, Stripe, and never reach RunSheet.
About drivers and PAs (on behalf of the operator)
- Name, role (driver or PA), mobile number, email address and home address.
- UTR (Unique Taxpayer Reference), where they have one.
- Bank account name, bank, sort code and account number. These are encrypted.
- A PIN for sending invoices, stored only as a one-way hash.
- Invoices: the schools worked, dates and journeys, pay rates, totals and payment dates.
We do not collect any information about pupils. Invoices refer to schools, dates and journeys only.
Technical information
Our hosting provider keeps short-lived server logs, including IP addresses, to keep the service secure and working.
Why we use it, and our lawful basis
- To provide RunSheet to the operators who sign up (contract).
- To keep it secure and prevent fraud, for example locking an account after repeated wrong PINs, and holding payments when bank details are changed until the office has checked (legitimate interests).
- To send emails the service depends on: invoice receipts, payment notices, reminders to the office and account emails (contract, or the operator’s instructions).
- To keep records the law requires, such as invoices and payments for tax purposes (legal obligation).
- To contact businesses about RunSheet, only at work contact details and with an easy way to opt out (legitimate interests).
We never sell personal data, and we never use it for advertising.
Cookies
RunSheet uses only cookies that are strictly necessary for it to work, so there is no cookie banner:
| Cookie | What it does | How long |
|---|---|---|
rs_session | Keeps you logged in. | 14 days for office users, 12 hours for drivers and PAs |
rs_sample | Shows the logins after adding sample data to a test company. | 1 hour |
We do not use analytics, advertising or tracking cookies.
Who else handles the data
We use a small number of trusted providers to run RunSheet. They only process data to provide their service to us:
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the RunSheet website and app | Servers in Dublin, Ireland; global network for delivering pages |
| Supabase Inc. | The database where your data is stored | Ireland (AWS eu-west-1) |
| Resend (Plus Five Five, Inc.) | Sending emails such as invoice receipts and payment notices | United States |
Where data leaves the UK, it goes to the EU (covered by UK adequacy regulations) or to the United States under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. We may also share data if the law requires it, for example with HMRC or the police.
Subscription payments are taken by Stripe Payments Europe, Ltd. (Ireland), which acts as its own controller for payment data under its own privacy policy. Stripe only receives the details of the person paying for the subscription, never drivers’ or PAs’ data.
How long we keep it
- Inside RunSheet, records are not deleted during normal use, so there is always a complete history. Invoices are voided rather than deleted.
- Invoices and payment records should be kept for at least six years for tax purposes. The operator decides how long beyond that.
- When an operator stops using RunSheet, they can download everything, and we delete their data within 90 days of the agreement ending, unless the law requires us to keep it.
- Server logs are kept by our hosting provider for a short period, typically up to 30 days.
How we protect it
Bank details are encrypted, passwords and PINs are hashed, every company’s data is kept separate, and everything travels over HTTPS. The full list is on our security page.
Your rights
Under UK data protection law you can ask to:
- see the personal data held about you;
- have it corrected if it is wrong;
- have it deleted, or its use restricted, where the law allows;
- object to how it is used;
- receive it in a format you can take elsewhere.
Drivers and PAs: please ask the company you work for first, as they control your data. You can also contact us and we will pass your request on and help them answer it. We reply to requests within one month.
Complaints
Please tell us first and we will try to put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Changes to this policy
If we make a significant change, we will tell operators by email before it takes effect. The date at the top shows when it last changed.