How The Arena Hub Ltd collects, uses, and protects your family's information.
The Arena Hub Ltd ("Arena Hub", "we", "us") is a company registered in England and Wales. We provide Arena Hestia, a cloud-based daily planning and evidence platform designed for parents and carers of SEMH (Social, Emotional and Mental Health) children learning at home. Company No. CH#1708605. Our contact address for all data-related matters is data-protection@thearenahub.co.uk. For general Hestia queries: hestia@thearenahub.co.uk.
Under UK GDPR, the legal roles are important to understand clearly:
Your child's data — including plan entries, evidence records, routine and mood check-ins, and safeguarding entries — is processed and stored exclusively within your own Google Workspace account. Arena Hub never accesses, stores, or processes your child's personally identifiable information (PII) on our own systems at rest.
A note on how this differs from a school-based product: unlike Arena Lite (used by practitioners acting in a professional capacity on behalf of a school), Arena Hestia is used by you, personally, for your own family. UK GDPR's "household exemption" (Article 2(2)(c)) can mean your own day-to-day use of the app for purely personal or family purposes falls outside GDPR's scope entirely. That exemption does not extend to us — Arena Hub Ltd remains fully bound by UK GDPR as a commercial provider of the service regardless of how the exemption applies to your own use. We describe our obligations in full below.
When you subscribe to or use Arena Hestia, we collect and hold the following information about you as the subscribing parent or carer:
Account data: Your email address, your full name, and your household or family name. This is provided by you during the subscription checkout process.
Licence data: Your unique Arena Hestia licence key, subscription plan, subscription start date, and subscription status.
Payment data: Payment processing is handled entirely by Stripe, Inc. We do not store payment card numbers or full payment details on our systems. Stripe retains payment data in accordance with their own privacy policy and PCI DSS obligations.
In full and open terms — what the app itself touches: when you use Hestia's features (Plan the Day, Add Evidence, Routine and Mood, Child Card, Safeguarding), the content you enter — including your child's name, date of birth, key stage, plan entries, evidence photos/videos/audio, routine and mood check-ins, and safeguarding notes — passes through our Cloud Run infrastructure as part of writing it to your own Google Workspace. We do not retain a copy of this content on our own systems once that write completes (see Section 7). We are describing this plainly rather than narrowly, because it involves your child's data and we think you're entitled to the fullest picture, not the minimum required disclosure.
We use your account data for the following purposes only:
Licence validation: To verify that you hold a valid, active Arena Hestia subscription when you activate or use the platform.
Account management: To manage your subscription, process renewals, and handle requests to change or cancel your account.
Product and service communications: To notify you of important updates to the platform, changes to these terms, or critical security notices. We do not send marketing emails without your explicit opt-in consent.
We rely on the following lawful bases under UK GDPR:
Contract (Article 6(1)(b)): Processing your account and licence data, and providing the platform's core functionality, is necessary to perform the subscription contract you have entered into with us.
Consent (Article 9(2)(a)): Where content you enter about your child constitutes special category data (health, SEMH, or safeguarding-related information), our processing of it as it passes through our systems on the way to your own Google Workspace relies on your explicit consent, given at signup and exercised each time you choose to enter that information into the platform.
Legitimate interests (Article 6(1)(f)): We have a legitimate interest in maintaining the security and integrity of our platform and preventing fraudulent licence use.
Your account and licence data is stored on Google Cloud infrastructure within the United Kingdom (London, europe-west2 region).
Payment transaction data is stored by Stripe, Inc., subject to Stripe's privacy policy and data residency commitments. Stripe is certified under the EU-US Data Privacy Framework and complies with GDPR requirements for international data transfers.
We do not use any other third-party data processors for your account data. There are no analytics trackers, advertising networks, or external marketing databases involved in the operation of Arena Hestia.
This is the most important data protection principle underpinning Arena Hestia. All data about your child — every plan entry, every evidence record, every routine and mood check-in, every safeguarding note — is written directly to a Google Spreadsheet within your own Google Workspace account (your Google Drive). This data is governed by your Google Workspace terms of service and your own data protection choices.
Arena Hub's Cloud Run functions act as a transient processing layer: they receive a request, write data to your Drive, and return a response. No child data is retained by Arena Hub at rest.
Sharing (SECO): Hestia includes a sharing tool that lets you prepare a record for a Local Authority, mainstream school, awarding body, social worker, or in response to a Subject Access Request. Nothing is shared automatically — every share is a deliberate action you take, sending a specific record to a destination you choose. Arena Hub is not a party to what you choose to share or with whom.
We retain your account data (email, name, household name, licence record) for the duration of your active subscription. Following cancellation or expiry, account data is retained for a maximum of 30 days for the purpose of subscription recovery or query resolution, after which it is deleted from our systems. You may request earlier deletion by contacting data-protection@thearenahub.co.uk.
Your child's data held within your Google Workspace is entirely your responsibility as Data Controller. Arena Hub has no role in its retention or deletion.
As a data subject, you have the following rights in relation to the personal data we hold about you:
Right of access: You may request a copy of the personal data we hold about you.
Right to rectification: You may ask us to correct inaccurate data.
Right to erasure: You may ask us to delete your account data, subject to any legal obligations to retain it.
Right to data portability: You may request your account data in a structured, machine-readable format.
Right to object: You may object to processing based on legitimate interests.
To exercise any of these rights, please contact us at data-protection@thearenahub.co.uk. We will respond within 30 days. If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
The Arena Hestia platform uses session cookies solely to maintain your authenticated state during a Google OAuth login session. These cookies are essential for the platform to function and are not used for tracking, advertising, or analytics purposes.
Our public marketing website (thearenahub.com) does not deploy any analytics, tracking, or third-party advertising cookies. No cookie consent banner is displayed because we do not use non-essential cookies.
We may update this Privacy Policy from time to time. Where changes are material, we will notify active subscribers by email before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision.
All data protection enquiries should be directed to:
The Arena Hub Ltd
Email: data-protection@thearenahub.co.uk