Privacy Policy
DRAFT - NOT YET REVIEWED BY A SOLICITOR. DO NOT PUBLISH.
Last updated: [DATE]
Who is responsible for your data
Hero Marketer Limited, a company registered in England and Wales (company number [NUMBER]), registered office [ADDRESS], is the data controller for personal data collected through ticksprout.com.
Contact us about anything in this policy at [EMAIL].
[SOLICITOR: confirm whether an ICO registration is required and whether a DPO must be appointed. We do not believe we meet the DPO threshold but want that confirmed.]
What we collect and why
If you visit without an account
| What | Why | Legal basis |
|---|---|---|
| Pages you visit, roughly where you are (country), device and browser | To run the site, measure performance, and prevent abuse | Legitimate interests |
| Your chosen language and currency | To show you the right version | Legitimate interests |
| Analytics data | To understand what is useful and what is not | Consent, via the cookie banner |
| Advertising identifiers | To show and measure advertising | Consent, via the cookie banner |
If you create an account
| What | Why | Legal basis |
|---|---|---|
| Email address, name if you give one | To create and run your account | Performance of a contract |
| Authentication details, held by Clerk | To sign you in securely | Performance of a contract |
| Lessons you complete, save, and your quiz results | To show your progress and let you pick up where you left off | Performance of a contract |
| Forum posts, if you use the community | To run the community | Performance of a contract |
If you subscribe
| What | Why | Legal basis |
|---|---|---|
| Billing details, held by Stripe | To take payment | Performance of a contract |
| Country, for tax | To charge the correct VAT | Legal obligation |
| Subscription history, invoices, refunds | To run your subscription and meet our accounting obligations | Legal obligation |
| Cancellation reason, if you choose to tell us | To improve the service | Consent |
We never see or store your card details. Stripe handles those directly.
Who we share it with
We use these companies to run the service. Each processes data on our instructions.
| Who | What for | Where |
|---|---|---|
| Clerk | Authentication and account security | [SOLICITOR: confirm data location and transfer mechanism] |
| Stripe | Payments, subscriptions, tax calculation | UK, EU and US |
| Neon | Database hosting | UK (London) |
| Vercel | Website hosting | UK (London) for compute |
| Resend | Transactional email | [CONFIRM] |
| Fish Audio | Generating lesson audio, if you use it | [CONFIRM] |
| [Advertising network] | Serving advertising | [CONFIRM] |
| [Analytics provider] | Site analytics | [CONFIRM] |
Some of these transfer data outside the UK. Where they do, we rely on [SOLICITOR: confirm mechanism - UK adequacy regulations, the UK International Data Transfer Addendum, or standard contractual clauses as applicable to each].
We do not sell your personal data.
Affiliate links
If you click through to a broker from our site, that broker may know you came from us, and we may be paid a commission. What the broker does with your data after that is governed by their privacy policy, not ours. We do not pass them your personal data.
How long we keep it
| What | How long |
|---|---|
| Account and learning data | While your account is open, then [X] months |
| Billing and invoice records | 6 years, to meet HMRC requirements |
| Forum posts | While your account is open, then anonymised |
| Analytics | [X] months |
| Support emails | [X] months |
If you delete your account, we remove or anonymise your personal data except where we must keep it, principally billing records for tax purposes.
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct it if it is wrong
- Delete it, subject to records we must keep by law
- Restrict how we use it
- Object to processing based on legitimate interests
- Portability, receiving your data in a machine-readable format
- Withdraw consent at any time, where consent is the basis
To exercise any of these, email [EMAIL]. We will respond within one month.
If you are unhappy with how we handle it, you can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
We use:
- Essential cookies to sign you in, remember your language and currency, and keep the site secure. These do not need consent.
- Analytics cookies to understand how the site is used. Consent required.
- Advertising cookies to show and measure advertising. Consent required.
You can accept or decline non-essential cookies through the banner, and change your mind at any time from [LINK].
Declining non-essential cookies does not restrict your access to anything.
Children
Tick Sprout is not for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will remove it.
Changes
We may update this policy. If a change is material we will tell you by email or a notice on the site.
Notes for the solicitor are in solicitor-brief.md.