Privacy Policy

1. Who Controls Your Data

For the purposes of UK data protection law, the data controller is Raised by Design Limited, a company registered in England and Wales under company number 17402515, registered office 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ, registered with the Information Commissioner's Office (ICO), registration number [ICO registration number — pending]. Contact for data protection queries: hello@raisedbydesign.co.

2. What Data We Collect

About you, the account holder

• Name and email address
• Account and subscription information
• Payment information — processed by our payment provider, Paddle; we do not store your full card details
• Communications you send us
• Usage data — pages visited, features used, device and browser information

About your child, entered by you

• First name and date of birth
• Design Profile responses — your observations of your child across developmental areas
• Evidence Bank entries — text, and where enabled, photographs you choose to upload
• Protocol and workspace activity

We collect data about your child only because you, as their parent or guardian, choose to enter it. You control what is entered and can request its deletion at any time.

3. Why We Process This Data

• To provide the Service — generating your Blueprint, storing your Evidence Bank, running the community forum
• To process payments and manage your subscription
• To communicate with you — service emails, and, where you have opted in, marketing emails
• To maintain the security and proper functioning of the platform
• To comply with our legal obligations

Our lawful bases for processing are: performance of a contract (providing the Service you have signed up for), consent (for marketing communications and, where applicable, photo uploads), and legitimate interests (for security, fraud prevention, and service improvement).

4. Children's Data Specifically

Raised by Design is intended for use by parents and guardians on behalf of their children. Children do not create their own accounts and do not directly provide data to us. All data about a child is entered by the parent or guardian who holds the account.

We treat data relating to children with particular care, in line with the ICO's Age Appropriate Design Code, including by:

• Collecting only what is needed to provide the Service
• Never using children's data for third-party advertising or profiling for marketing purposes
• Encrypting stored data and restricting access to authorised systems only
• Giving parents the ability to review, edit, export, or delete their child's data at any time through account settings, or by contacting us directly

5. Photographs

Where photo upload is enabled within the Service, any photograph you upload is stored securely, is visible only to your account, and is never shared publicly or with other users. You may delete an uploaded photograph at any time. Photo upload is optional and requires your explicit action to use.

6. Who We Share Data With

• Payment processing — Paddle.com Market Limited, acting as our payment processor / Merchant of Record
• Infrastructure and hosting — our database, authentication, and application hosting providers
• Email communications — our transactional and marketing email providers

We do not sell personal data. We do not share your or your child's data with third parties for their own marketing purposes.

Some of our service providers may process data outside the UK/EEA. Where this happens, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses.

7. How Long We Keep Data

We retain account and child data for as long as your account remains active. If you close your account, we will delete or anonymise your personal data and your child's data within 30 days, except where we are required to retain certain records for legal, tax, or accounting purposes.

8. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you or your child
• Correct inaccurate data
• Request deletion of your data or your child's data ("right to be forgotten")
• Object to or restrict certain processing
• Receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, contact us at hello@raisedbydesign.co. We will respond within 30 days. You also have the right to complain to the ICO (ico.org.uk) if you believe we have not handled your data properly.

9. Marketing Communications

We only send marketing emails to those who have opted in at signup or elsewhere. You can unsubscribe at any time using the link in any marketing email, or via your account settings. Opting out of marketing does not affect service emails necessary to operate your account.

10. Cookies

We use essential cookies necessary for the Service to function, and, where you consent, analytics cookies to help us understand how the Service is used. See our Cookie Policy for details.

11. Security

We use industry-standard measures to protect personal data, including encryption in transit and at rest, access controls, and regular review of our data handling practices. No system is completely secure, and we cannot guarantee absolute security, but we take this responsibility seriously — particularly given the nature of the data we hold.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or a prominent notice on the Service before they take effect.

13. Contact

Questions or requests relating to this Privacy Policy or your data can be sent to hello@raisedbydesign.co.