Limelight was built with safeguarding leads, DPOs and school bursars in the room - because in 2026 nobody gets to deploy a comms app to under-18s without proving it stands up to scrutiny. Here's how we prove it.
WhatsApp, email, Messenger and SMS replaced by one sanctioned, in-app channel between teachers, leaders and cast - inside a system you control, on infrastructure you can audit.
Cast comms run through Stream Chat under the hood. Every message - DM or group - is timestamped and retained server-side. If a safeguarding lead ever needs to review or retrieve a conversation, get in touch and we'll help.
We process personal data under UK GDPR and EU GDPR. Lawful basis documented per processing activity. DPA available on request. Subject access requests handled within one calendar month as standard.
Five distinct roles with scoped permissions. Cast see only their own shows. Teachers see only the productions they direct. Org admins see the whole school. Enforced in Firestore security rules, not just hidden in the UI.
A small studio means a real human picks up - in our case, the founder. For school deployments, we provide a direct line for safeguarding leads and DSLs to flag issues outside the normal support queue.
Encryption in transit and at rest. Hashed passwords (never stored in plain text). Firestore security rules enforce per-role access. Annual security review planned ahead of broader rollout.
A simplified view of the role model enforced at the database layer. Permissions are not UI conveniences - they are enforced server-side, with audit trails on changes.
| Action | Student | Leader | Teacher | Org admin |
|---|---|---|---|---|
| See own cast page & chat | ✓ | ✓ | ✓ | ✓ |
| Send to whole-cast channel | - | ✓ | ✓ | ✓ |
| Upload scripts, scores & audio | - | - | ✓ | ✓ |
| Add / remove cast members | - | - | ✓ | ✓ |
| Create & manage shows | - | - | ✓ | ✓ |
| Manage organisation settings | - | - | - | ✓ |
| Change role assignments | - | - | - | ✓ |
The documents your DPO, safeguarding lead and bursar will ask for. Email the founder and we'll send across what's relevant to your setup, with anything commercially sensitive sent under NDA.
The fact every message is logged server-side - in one channel, not seven - was the bit that finally got our safeguarding committee on side. Cleaner than any school comms tool we'd reviewed.
Bring your DSL, your DPO and your toughest question. A 20-minute walkthrough is usually enough.