Last updated 30 September 2026
This policy explains how personal data is handled when people visit Skull OS or use a Skull OS service provided to a school.
Who we are
Skull OS is provided by NorthCode Digital LTD, company number SC864258. Our registered address is 8 Frazer Street, Glasgow, G40 3QT, Scotland.
You can contact us at [email protected].
Our role and the school role
Each school decides why and how it uses member, parent, child, instructor and staff information. The school is normally the data controller for that information. NorthCode Digital LTD normally acts as the data processor when Skull OS stores or uses it for the school.
NorthCode Digital LTD is the controller for information used to run our own website, manage Skull OS accounts, provide support, protect the service and meet our legal duties.
If your question is about information entered by your school, contact the school first. We will help the school answer requests where needed.
Information we use
The information used depends on how a school configures Skull OS. It may include:
- Names, contact details, dates of birth and household relationships.
- Account roles, login records and security information.
- Memberships, bookings, attendance, grading and training progress.
- Payment status, invoices and provider references. Skull OS does not store full card details.
- Forms, consent records, messages, support requests and uploaded content.
- Device, browser, network and activity records used for security and reliability.
- Information a school asks people to provide, which may include health or support information where the school has a lawful reason to collect it.
Connected AI assistants
You can choose to connect an AI assistant, such as ChatGPT, to your Skull OS account. During sign in, you choose which gyms it can access. Access is limited by your current permissions at each gym.
The assistant may receive the class and booking information needed to answer your request. A member connection can find classes, read your bookings and make a booking change when you ask. Staff connections may have more tools based on their gym permissions.
The AI provider receives the tool requests and results used in your conversation. Its own privacy policy and account settings apply to that information. Skull OS does not store your full AI conversation in its action audit.
Skull OS keeps action audit records for 180 days to check what happened and help protect the service. These records include the action, resource identifiers, result and timing. Passwords, tokens, contact details and free text are removed from the action audit.
You can revoke a connection through the connection management link on Connect your AI in the gym app. This stops further access through that connection. It does not remove information already received by the AI provider. Contact that provider about its stored conversations.
Why we use information
We use personal data to provide and secure Skull OS, manage accounts, process support requests, send service messages, improve reliability, prevent misuse, meet legal duties and handle payments for the service.
Our lawful basis may be a contract, a legal duty, consent or legitimate interests. The school is responsible for choosing and recording the correct lawful basis for the information it controls. Where special category data is used, the school must also identify a valid condition for that use.
We do not use Skull OS to make decisions about people based only on automated processing where those decisions have legal or similarly serious effects.
Retention and security
We keep information only for as long as it is needed for the service, the school instructions, security, disputes, accounting and legal duties. The exact period depends on the type of record and why it is held. Schools control their own retention choices where Skull OS provides those settings.
We use access controls, encryption, backups, monitoring and other technical and organisational measures designed to protect personal data. No online service can promise complete security.
Your rights
Depending on the circumstances, you may have rights to access, correct, erase, restrict or move your personal data, and to object to some uses. Where consent is used, you can withdraw it at any time.
You have the right to object to processing based on legitimate interests and to direct marketing.
For school controlled information, contact the school. You may also contact us at [email protected]. We may need to verify your identity before acting.
You can complain to the UK Information Commissioner at ico.org.uk. We would like the chance to address your concern first.
Connected social platforms
A school may choose to connect a business account from services such as Facebook, Instagram, Google, LinkedIn, TikTok, YouTube or X. Skull OS may then receive account and page identifiers, page names, granted permissions, access tokens, posts, publishing results, comments, reviews and owner replies where the provider allows this.
We use this information only to provide the connection chosen by the school. Draft posts and review replies require approval from an authorised person before they are sent. Skull OS does not create customer reviews for people.
A school can remove a connection through Skull OS when that feature is available, revoke access through the provider, or ask us to remove the connection data.