How we protect mailbox information

1. Information collected

We collect your role, message category, subject, message, requested outcome, privacy choices and service security records. For confidential named submissions, you may also provide a name, email address or phone number.

The first release does not accept identity documents, attachments, financial account details, audio or video.

2. Purpose and access

Information is used only to receive, review, respond to, follow up and securely document your message. It is not published. “Principal only” messages are restricted to the Principal and essential system operations.

For ordinary messages not marked Principal only, the notification sent to the Principal may include the subject and message. Complaints, safeguarding matters and Principal-only messages are notified by case metadata and a secure link only. The service does not send automatic email to correspondents; use the case code and query key to view replies.

3. No-name submissions

If you select no-name submission, name and contact fields are discarded. The service does not promise absolute anonymity: necessary technical security records may still exist, and information may need to be handled as required by law or to protect someone from serious harm.

4. Retention and deletion

Closed suggestions, questions and appreciation messages are normally scheduled for deletion after 180 days. Complaints and safeguarding matters are not automatically deleted on that schedule; they are reviewed under safeguarding, legal and dispute-handling requirements. An active record hold pauses deletion. Backups expire on a controlled cycle.

5. Your choices

• Choose confidential named or no-name submission.
• Mark sensitive content as Principal only.
• Use the private conversation to correct or supplement your message.