Privacy policy

Last updated 2 October 2026

Who we are

Kerbly is a diary, pupil, progress and money manager for UK driving instructors, made up of the Kerbly mobile app, the web-based pupil portal and the services behind them (together, the “Service”). The Service is provided by Kerbly Limited, a company registered in England and Wales (company number 17420300) with its registered office at 82a James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE, England. In this policy “Kerbly”, “we”, “us” and “our” mean Kerbly Limited.

This policy explains what personal data we collect, why, how long we keep it and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to instructors who hold a Kerbly account, to pupils who use a Kerbly pupil portal and to visitors to our website at getkerbly.app.

For questions, requests or complaints about personal data, contact hello@getkerbly.app.

Our website

Our website at getkerbly.app is an information-only landing page. It does not ask you to create an account, contains no forms, sets no cookies of our own and does not use analytics, advertising or social-media tracking. Emailing us from the site uses your own email app.

The website is hosted by Netlify, which keeps short-term server access logs (including your IP address, browser type and the pages requested) to run the service and protect it from abuse. We rely on our legitimate interest in keeping the site secure and available for this; the logs are not used to identify or profile you.

The site may load fonts from a third-party font service. If it does, that service receives your IP address in order to deliver the font files. We do not receive any of that data.

Our role: controller and processor

For your own account and business data — your profile, subscription, device tokens, usage events and support messages — Kerbly is the data controller.

For the pupil records you enter — names, contact details, lessons, progress, test dates and payments — you (the instructor or driving school) are the data controller and Kerbly is your data processor. We only process pupil data on your instructions, as set out in this policy and our Terms of Use, which together form the data processing terms between us.

If you are a pupil, your instructor decides what is recorded about you. Direct access, correction or deletion requests to your instructor first; we will help them respond.

Information you give us

• Account and profile: your name, email address, mobile number, password or Apple / Google sign-in identifier, business name, default hourly rate, profile photo and business logo.
• Payment details you choose to show pupils: account name, sort code, account number and a payment reference. These are optional and only displayed to pupils in your portal so they can pay you. Kerbly never moves money.
• Pupil records: pupil name, phone number, email, pick-up postcode or address, lesson dates and lengths, attendance and cancellations, skill progress, reflective lesson notes, mock test results, theory and practical test dates, payments, credits, block-hour purchases and the date and version of your pupil terms each pupil accepted.
• Business finances: money in, expenses, mileage, receipt photos and the HMRC categories you assign for Making Tax Digital.
• Team: the email addresses of people you invite to your organisation and their role.
• Support and bug reports: your message, your email, app version and device model, and any screenshots you attach.

Information collected automatically

• Push notification tokens for your device, if you turn notifications on.
• Product usage events — for example “lesson booked” or “expense logged” — with a timestamp, app version and platform. These events record what happened, never pupil names, notes, phone numbers, emails or other free text.
• Technical logs needed to run and secure the Service, such as request timestamps, error details and IP addresses for rate limiting of pupil-portal access.

We do not use third-party advertising or analytics SDKs, and we do not track you across other apps or websites.

Device permissions

• Camera and photos: to attach receipts to expenses and to add a profile photo or business logo. Only the images you select are uploaded.
• Contacts: to pre-fill a pupil’s name and number from your address book. We read the single contact you pick; we do not upload or store your contact list.
• Location: to centre the Roadsketch map on where you are teaching. Your location is used on the device at that moment and is not stored or sent to our servers.
• Notifications: to tell you about lesson reminders, payments and portal activity. You can change any permission at any time in your device settings.

How and why we use personal data

• To provide the Service — your diary, pupils, progress tracking, pupil portal, money and tax records, Roadsketch and team features (legal basis: performance of a contract with you).
• To send messages on your behalf that you trigger, such as portal invites, email-change confirmations and lesson or payment notifications to pupils (legal basis: our contract with you; you are responsible for your lawful basis to contact your pupils).
• To pre-fill WhatsApp, SMS or email drafts that open in the relevant app on your device. The message is sent by you from that app, not by Kerbly.
• To manage your subscription, free trial and plan limits (legal basis: contract).
• To send notifications you have opted into (legal basis: consent, which you can withdraw in settings).
• To understand how Kerbly is used, fix bugs and improve features (legal basis: our legitimate interest in running and improving the Service, using minimal, non-identifying event data).
• To keep the Service secure, prevent abuse and enforce our terms (legal basis: legitimate interests and legal obligation).
• To comply with the law, including tax, accounting and regulatory requirements (legal basis: legal obligation).

We do not sell personal data and we do not use pupil data for marketing or advertising.

The pupil portal

You can give each pupil a private portal link. Anyone with the link can see that pupil’s upcoming lessons, progress, mock tests, payments, your reflective notes from their last lesson, your contact details and any payment details you have chosen to show. Share links only with the pupil (or their parent or guardian) and revoke them from the pupil’s page if a link is shared further than intended.

Before using the portal, pupils are shown your pupil terms and conditions and asked to accept them. We record the date and version accepted so you can evidence it.

Pupils can add or change the email address we hold for them through the portal; changes are confirmed by email. We rate-limit portal access attempts to protect against guessing.

The portal uses only strictly necessary technical storage. It does not set advertising or tracking cookies.

Who we share data with

We use a small number of service providers who process data for us under written contracts and only on our instructions:

• Supabase — database, authentication, file storage and server functions that host the Service.
• Resend — delivery of transactional emails to you and to pupils.
• RevenueCat — subscription and entitlement management. It receives an anonymous app user ID and store purchase receipts, not your pupils’ data.
• Apple and Google — sign-in (if you choose Sign in with Apple or Google), push notification delivery, in-app purchase billing and map tiles for Roadsketch. Their handling of that data is governed by their own privacy policies.
• Expo — relay of push notifications to Apple and Google.

We may also share data where the law requires it, to protect the rights and safety of Kerbly, our users or others, or as part of a merger, acquisition or sale of assets (in which case this policy continues to apply).

International transfers

Our providers may store or process data outside the United Kingdom, including in the European Economic Area and the United States. Where personal data leaves the UK we rely on adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with the providers’ own security commitments.

How long we keep data

Account and business data is kept for as long as your account is active. You can edit or delete individual pupils, lessons, payments and expenses at any time in the app.

If you delete your account, your organisation’s data is deleted from our live systems promptly and removed from encrypted backups within 35 days. UK tax law may require you to keep your own financial records for at least five years after the 31 January filing deadline (six years for companies) — export them before deleting your account.

Portal links stop working as soon as you revoke them or delete the pupil. Push tokens are removed when you sign out or turn notifications off.

Usage events and technical logs are kept for up to 24 months in a form that does not identify pupils. Support emails are kept for as long as needed to resolve the issue and for our records.

We may keep limited information for longer where required by law or to establish, exercise or defend legal claims.

Security

All data travels over encrypted connections and is encrypted at rest. Every record is scoped to your organisation and protected by row-level access controls, so an instructor can only ever see their own records.

Uploaded files such as receipts, logos and photos live in private storage and are served through short-lived, signed links. You can add two-factor authentication to your account in Settings.

No system can be guaranteed completely secure. Keep your sign-in details and portal links private and tell us straight away at hello@getkerbly.app if you suspect unauthorised access. Where a personal data breach is likely to put people at risk we will notify you, and the Information Commissioner’s Office where required, without undue delay.

Your rights

Under UK GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to certain processing, to data portability, and to withdraw consent where consent is our basis. Most of this you can do directly in the app: edit your profile, export your records as CSV and delete your account from Settings.

Pupils have the same rights. Because your instructor controls your records, we will pass requests we receive from pupils to the instructor and help them respond within one month.

To exercise a right, email hello@getkerbly.app. We may ask you to confirm your identity. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, though we would welcome the chance to resolve any concern first.

Children

Kerbly accounts are for driving instructors and schools aged 18 or over. Pupils can be 17 or older (16 if they receive the enhanced rate of the mobility component of PIP). Pupil information is entered and controlled by the instructor, who is responsible for having an appropriate basis to hold it and for involving a parent or guardian where appropriate. We do not knowingly collect data from anyone under 16.

Changes to this policy

We may update this policy as Kerbly and the law change. We will update the date at the top and, for material changes, tell you in the app or by email before they take effect. The current version is always available at the link below and in Settings.

Contact

Questions about privacy or this policy? Email us at hello@getkerbly.app and we’ll help.

Kerbly Limited, company number 17420300, registered in England and Wales. Registered office: 82a James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE, England.