Privacy Policy

1. Introduction

Kiddy Compass™ is operated by KIDDYCOMPASS LTD, a company registered in Scotland (Company Number: SC873998). We are the data controller for the personal information we collect through our website and services.

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your personal data.

For any data protection queries, please contact us at: [email protected]

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name
• Email address
• Authentication credentials (managed securely by our authentication provider, Supabase)

2.2 Family & Preference Information

During onboarding and through your account settings, you may provide:

• Your postcode or location area
• Number of adults and children in your family
• Children's first names and dates of birth (used to personalise age-appropriate recommendations)
• Transport preferences (car, public transport, or both)
• Budget preferences
• Indoor/outdoor activity preferences
• Preferred venue and event categories
• Accessibility requirements
• Whether you have a dog

Children's data: We collect children's first names and dates of birth solely to provide personalised, age-appropriate activity recommendations. This data is stored securely and is never shared with third parties for marketing purposes. Only the parent or guardian who created the account can view or modify this information.

2.3 Contact & Communication Data

When you contact us or subscribe to communications, we collect:

• Contact form submissions (name, email, subject, message)
• Newsletter subscription status and preferences
• Newsletter feedback (ratings and comments)
• Push notification subscription data (device endpoint and encryption keys)

2.4 Venue Submission Data

If you submit a venue suggestion, we collect the submitter's name, email address, and phone number, along with the venue details you provide.

2.5 Usage & Analytics Data

With your consent, we automatically collect certain information when you use our Service:

• Browser type and version
• Device information and screen size
• IP address (anonymised where possible)
• Pages visited, features used, and time spent
• Search queries and filter selections
• Interaction events (clicks, form submissions, venue views)
• Session recordings (with all form inputs and sensitive data masked)

This data is collected through Google Analytics 4 (GA4) and PostHog, and is only activated if you consent to analytics cookies. See our Cookie Policy for details.

3. How We Use Your Information

We use the information we collect for the following purposes and legal bases under UK GDPR:

4. AI-Processed Content

Some content on our platform, such as parent review insights and age suitability information, is generated by processing publicly available reviews using artificial intelligence. This processing is performed on aggregated, anonymised review data and does not involve processing of our users' personal data.

5. Information Sharing & Third-Party Processors

We do not sell, trade, or rent your personal information to third parties. We share your data only with the following trusted service providers who process data on our behalf:

We may also disclose your information when required by law, to protect our rights, or in connection with a business transfer such as a merger or acquisition.

6. International Data Transfers

Some of our service providers may process data outside the UK. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the Information Commissioner's Office (ICO), or that the receiving country has an adequate level of data protection as determined by the UK government.

PostHog is configured to use EU-based servers. For information about other providers' data locations, please contact us.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Retained while your account is active. After account deletion, personal data is removed within 6 months, except where retention is required for legal or regulatory purposes.
• Contact form submissions: Retained for up to 12 months after the enquiry is resolved.
• Analytics data: Retained in accordance with our analytics providers' retention policies (typically 14–26 months), in anonymised or aggregated form.
• Newsletter subscription data: Retained until you unsubscribe, after which it is deleted within 30 days.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure authentication managed by Supabase with industry-standard encryption
• Input masking on session recordings to protect sensitive data
• Access controls limiting who can view personal data
• Regular review of our security practices

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data (subject to legal obligations)
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Request your data in a structured, commonly used, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent (e.g., analytics cookies, newsletter)

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month.

Right to complain: If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

10. Children's Privacy

Our Service is designed to help families find family-friendly activities. While we provide information about venues suitable for children, our website and accounts are intended for use by adults aged 18 and over.

We do not knowingly collect personal information directly from children. The children's data we store (first names and dates of birth) is provided by the parent or guardian account holder for the purpose of personalised recommendations, and can be modified or deleted by the account holder at any time.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page, updating the "Last updated" date, and where appropriate, notifying registered users by email.

We encourage you to review this page periodically to stay informed about how we protect your data.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at:

KIDDYCOMPASS LTD (Data Controller)

Company Number: SC873998

Email: [email protected]