Last updated: 1 September 2026
Operator: People Building Ltd Company number: 06969239 Address: 15 Queensway, Hemel Hempstead, Hertfordshire, HP1 1LS, United Kingdom Email: info@peoplebuilding.co.uk ICO registration: Z2203181
1. Scope and controller
People Building Ltd is the controller for personal information processed through Tupolis unless another arrangement is expressly stated. Tupolis is primarily a UK service but may be accessed internationally.
2. Who uses Tupolis
Tupolis is not an unrestricted public-registration service. Access may be provided to people enrolled in People Building, NLP4Kids, mental-health, DBT, Overcome Anxiety or other authorised programmes; practitioners/licensees/franchisees; employees; and parents or guardians accessing child programmes.
Children do not independently create ordinary Tupolis accounts under the current model. A parent or guardian creates or controls the account through which child content is accessed.
3. Information we may process
Depending on the feature used, this may include name, email address, optional phone number where genuinely required, optional profile image, account identifiers, IP/device/browser information, login/security information, course activity, progress, completed modules, quiz or assessment answers and scores, comments/forum contributions, support communications, and practitioner uploads in authorised practitioner areas.
We do not require a child's date of birth, postal address, gender or personal email merely so that the child can access learning content through a parent-controlled account.
4. Why we use information
We may process personal information to create and administer accounts; provide programme access; record learning progress; operate quizzes/assessments; provide support; secure and maintain Tupolis; communicate about the service; manage authorised practitioner areas; comply with legal obligations; establish or defend legal rights; and improve the service where lawful.
The lawful basis depends on the activity and may include performance of a contract, legitimate interests, legal obligation, consent, or another basis available under UK data-protection law.
5. Health and other sensitive information
Tupolis contains content about mental health, behaviour, wellbeing, psychology and related subjects. Merely accessing that content does not mean People Building automatically infers that a user has a particular diagnosis or health condition.
Tupolis is not intended to be the routine repository for therapy notes, medical records or safeguarding case files. If special-category information is processed, an appropriate lawful basis and additional condition must apply.
6. Children
We take particular care with children's information and aim to apply high-privacy, data-minimising defaults. Child information should not be made visible to unrelated users. Child data should not be used for behavioural advertising. Additional child-facing functionality requires privacy and safeguarding review before launch.
7. Cookies and similar technologies
Tupolis may use cookies, web storage and similar technologies. Technologies that are not exempt from consent requirements must not be activated before valid consent. See the Cookie Policy and Cookie Preferences.
8. Third-party services
Tupolis may rely on providers for hosting, delivery, security, development and embedded content, including AWS, Amazon SES, Cloudflare, GitHub and YouTube/Google. Programme purchases may take place externally using payment services such as Stripe or PayPal. The actual production provider list must be kept under review and is described further in the Data Processing & Third-Party Services Notice.
9. AI
No integrated Tupolis AI assistant is currently live. If one is introduced, this notice will be reviewed before launch. The current intention is to use AI mainly for navigation, resource discovery and appropriate signposting, not as a therapist, doctor or emergency service.
10. International transfers
Where information is processed outside the UK, People Building will consider the applicable transfer requirements and use appropriate safeguards where required.
11. Retention
We retain information only for as long as reasonably needed for the purpose for which it is held, legal obligations, security, disputes or other legitimate purposes. There is no single blanket retention period for all Tupolis data. See the Account Deletion & Data Retention Notice.
Clinical, therapy and safeguarding records held separately by People Building are not ordinary Tupolis learning data and may have different retention rules.
12. Security
We use proportionate technical and organisational measures designed to protect information. No online service can guarantee absolute security. See the Security Statement.
13. Your rights
Depending on the circumstances, rights may include access, correction, erasure, restriction, objection, portability and withdrawal of consent. Rights are not always absolute. Requests can be made to info@peoplebuilding.co.uk. See the Data Access & Export Notice.
14. Embedded and external content
Tupolis may embed or link to third-party services. Interaction with those services may also be governed by the provider's privacy terms and browser/account settings.
15. Changes and contact
We may update this policy where the platform, providers, law or processing changes. Contact info@peoplebuilding.co.uk with the subject Tupolis Data Request for privacy matters.