Privacy Policy
Last reviewed: 17 June 2026 · Version 1.0
This policy explains what personal data Little Orchard Publishing Ltd, trading as Sparklemuffin ("we", "us"), collects when you and your child use the service, why we collect it, and what rights you have. It is written to align with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the ICO's Age Appropriate Design Code (the Children's Code).
- Data controller: Little Orchard Publishing Ltd
- Data Protection Officer: Aaron Asadi — help@sparklemuffin.ai
- ICO registration number: ZB823859
1. Our privacy promise
Sparklemuffin is built privacy-first, on purpose. No child's real name is ever shown publicly — children, parents and mentors all appear as handles. Children sign in with a handle and a passcode set by their parent; we do not collect a child's email address. We do not collect date of birth, location data, or behavioural profiling data. Discovery is curated, never algorithmic. Nothing a child shares becomes visible to others until their linked parent approves it, and parents can see everything their child posts.
2. The data we collect
Parent / account holder: email address (for your account, important notices, and, where you have opted in, marketing communications); a handle you choose; and your real name and payment details, collected only for billing, processed by our payment provider, and never displayed on the site.
Child: a handle and passcode set by the parent; and content they create and share, including builds, descriptions, comments, and club messages.
Everyone (technical): essential session cookies required for sign-in and security (see our Cookie Notice); and standard server logs retained for security purposes.
3. Why we use it and our legal basis
We use this data to provide the service, keep children safe through moderation and parental oversight, and take payment. Our legal bases under UK GDPR are: performance of a contract with the parent (Article 6(1)(b)); compliance with our legal obligations, including safeguarding duties (Article 6(1)(c)); our legitimate interests in operating a safe and secure service (Article 6(1)(f)); and, for marketing communications, your consent (Article 6(1)(a)).
4. Marketing communications
Where you have opted in, we may use your email address to send you news, updates, and information about Sparklemuffin. Occasional emails may include content or messages from trusted partners whose products or services we believe are relevant to our community. We will never share your personal data with those partners or any other third party for marketing purposes — partner content is included by us, in our emails, on their behalf. You can withdraw your consent and unsubscribe at any time using the link in any marketing email, or by contacting us at help@sparklemuffin.ai.
5. Children's data and parental consent
Accounts for children are created and controlled by a parent or guardian. A parent must register and approve the child's account before any content created by the child is shared. Parents can withdraw consent and delete a child's account at any time from the dashboard, which permanently removes the associated data.
6. Who we share data with
We use the following trusted processors to run Sparklemuffin: Supabase — database, authentication, and storage, hosted in the EU; and Stripe — payment processing, with card details passed directly to Stripe and never stored by us.
We do not sell personal data. There is no advertising on Sparklemuffin.
7. How long we keep it
Account and content data is retained for as long as the account is active. On deletion of an account, personal data is permanently removed within 30 days. Billing records are retained for 7 years as required by UK tax law. Server logs are retained for 90 days.
8. Your rights
Under UK GDPR you have the right to access, correct, export, or erase your family's data; to restrict or object to processing; and to withdraw consent where consent is the legal basis, including for marketing at any time. You can delete a child or the whole account at any time from your dashboard. To make any other request, contact us at help@sparklemuffin.ai. You have the right to lodge a complaint with the ICO (ico.org.uk).
9. Changes
We will post changes here and, for significant changes, notify parents by email.
10. Contact
Data controller: Little Orchard Publishing Ltd. DPO: Aaron Asadi — help@sparklemuffin.ai. ICO registration: ZB823859.