Privacy notice

The short version

This site and the season keep almost nothing, watch nobody, and never sell or share anything. What little exists, you gave us on purpose, and one email removes it. The rest of this page is that sentence, made precise.

Who we are

[OPS: company name, company number and registered address — entered when the registration completes]. We are the data controller — legal English for: the responsibility is ours. Write to us about anything on this page: [SUPPORT ADDRESS — P9]. A person answers.

What we keep — the whole list

About you, the account holder: your name, email address and delivery address; your order (which way in, when, and what has been posted); and anything you write to us, kept so the conversation makes sense next time.

About your child: a first name and the initial of a surname (the archive writes members as ‘Isla C.’), the creature’s working name, and the committed decisions — because the parts and letters need them. That is the whole list.

If you buy a gift: your name, your message (exactly as you wrote it), and the receiving household’s adult email address, used once for the invitation.

If you join the waitlist: an email address, and the optional preference and gift-flag you may have given it.

The machinery: server logs, kept briefly for operation and security; and aggregate visitor counts — numbers, not people.

What we deliberately never keep

Prediction answers — your child’s private intuition, used in the moment and never recorded. Exploration behaviour: pushes, runs, scrubs, slider positions, visit counts, durations. Anything about any other child. No birthdate, no photograph, no school, no location beyond the delivery address you gave us. No advertising cookies, no third-party trackers, no analytics scripts, no pixels — on this site or in the workbench. This is not a setting; it is the architecture, and the workbench cannot record what it was never built to see.

Why we are allowed to keep it

The season you bought is a contract, and running it — cutting the parts, writing the letters, posting the parcels, answering your emails — is what the law calls performance of that contract. Keeping the service safe and honest (brief server logs, fraud prevention, aggregate counts) rests on legitimate interests, the modest legal basis for housekeeping. A gift invitation is sent once because the giver asked us to send it, and a reply removes the address. We rely on nobody’s consent for anything, because nothing optional is collected.

Your child, specifically

The season is designed for children aged 10 to 12, and the service is built to the ICO’s Age Appropriate Design Code — the Children’s Code. The account is yours, not your child’s; children are never emailed, never profiled, never shown to anyone. The letters know what your child decided only because the committed decision is itself the one thing the Guild keeps.

Who else ever touches it

Payment happens on Stripe’s own secure page — card details never touch our systems. The workshop that prints and posts parts receives the part order and, for the name plate, the plate text — never your child’s name alongside it. Our hosting sits in the UK/EEA. And that is the entire list: nothing is sold, nothing is shared for advertising, nothing goes anywhere else — except that if the law ever required a safeguarding disclosure to the proper authority, we would make it.

How long we keep it

The order’s financial record stays for the six years tax law requires. The manufacturing and dispatch record — which parts were cut, for which order, and what was posted — stays for as long as safety law expects us to be able to recall a part. Support correspondence stays while it is useful to you and goes on request. Server logs are kept briefly — weeks, not years. The waitlist keeps an address until the invitation is sent or you ask us to remove it, whichever comes first.

Your rights, and the route

Write to [SUPPORT ADDRESS — P9] for any of these, and it is done without ceremony: a copy of everything we hold about you or your child (free, within one month, usually much sooner); a correction; a deletion. Deletion means everything goes except what the paragraphs above are honest about: posted parcels are physical facts, and the bare manufacture record stays for recall-readiness. If we ever disappoint you, the Information Commissioner’s Office (ico.org.uk) is the regulator and takes complaints — though we would rather you wrote to us first, and we will not make you regret it.

Changes

This notice changes only by dated amendment, with the version number above moving when it does.