Privacy Policy

This policy explains what personal information Mini Z and Me collects, why we collect it, who we share it with, how long we keep it, and the rights you have. Mini Z and Me is designed for parents and carers to record and support the play and development of children aged 0 to 5, so most of the information here concerns data about a child that you, the adult account holder, choose to add.

Please read it alongside our Terms of Service. If anything is unclear, contact us at legal@minizandme.com and we will be glad to help.

Who we are

Mini Z and Me is operated by Mini Z and Me Group Ltd, a company registered in England and Wales with company number 17279781, whose registered office is at 181 Walmley Road, Birmingham, B76 1PX. Mini Z and Me Group Ltd is the data controller for the information described in this policy, which means we are responsible for deciding how and why it is used.

You can reach us about anything in this policy, or to exercise any of your rights, at legal@minizandme.com.

Who can hold an account

Accounts are for adults only. When you sign up you confirm that you are at least 18 years old and that you are the parent, legal guardian, or a registered carer of any child you add. Children do not use the app or create accounts themselves.

What we collect

About you (the parent or carer):

• Your first name and email address, given at sign up.
• Payment information if you subscribe to a paid plan. Your card details are handled entirely by Stripe; we never see or store your card number, only a Stripe customer reference and your subscription status.
• A record of your agreement to this policy and our terms, including the date and the version you agreed to.
• An optional rough location, only if you choose to use the weather feature: a postcode you type, or a one-time use of your device location. We use it solely to look up your local weather. Your device location is rounded to a wide area and is never stored; we keep only your postcode (if you enter one) and a simple on or off preference. It is never linked to a child and never shown to anyone.
• Basic technical information needed to keep the app working and secure, such as login session data.

About your child:

• Their name, date of birth, and pronouns.
• The journal entries you write, including notes, the activities you log, reactions, locations, who was present, and milestone or first-time markers.
• Photos you choose to upload.
• Voice memos you choose to record.

Information about other people. If you add details about other people in your entries (for example, naming who was present), you are responsible for making sure you are comfortable recording that information. We treat it with the same care as the rest of your data.

Why we use it, and our lawful basis

We use this information to provide the service you have asked for: personalising activity ideas to your child’s age and interests, keeping your journal and memories, generating AI features you request, and running your account and subscription.

• Performance of our contract with you is our lawful basis for running your account, delivering the service, and processing your subscription.
• Your consent is our basis where you add a child’s photo or voice memo. You can withdraw this at any time by deleting the item or your account.
• Explicit consent is our basis where information you choose to add may reveal something about a child’s health, development, or additional needs (which the law treats as a “special category” of data). You provide this consent by choosing to record that information, and you can withdraw it at any time by deleting the relevant content.
• Our legitimate interests are the basis for keeping the service secure, preventing misuse, and maintaining the reliability of the app, balanced against your rights.

We send you essential service emails (such as sign-up confirmation and password resets) because they are necessary to run your account. We do not currently send marketing email. If we introduce it in future, we will ask for your separate opt-in first, and every marketing message will include a way to unsubscribe.

AI features

Some features use AI provided by Google (Gemini). When you build a custom activity, the text you enter is sent to Google to generate a result. When you record a voice memo, the audio is sent to Google to produce a transcript. We send only what is needed for the feature you have asked for.

These AI features are there to suggest and assist. They are advisory only — they do not make any automated decision about you or your child that has a legal or similarly significant effect, and a human (you) remains in control of what you do with the results.

We use Google’s AI on a paid (billing-enabled) basis, under terms that include a Data Processing Addendum and under which your content and your child’s content are not used to train Google’s models and are not read by Google’s staff for that purpose.

Children’s data

Information about a child is added by you, the responsible adult, not by the child. We follow the UK Children’s Code (Age Appropriate Design Code) in how we build the product. In particular:

• A child’s information is private to your account by default.
• We practise data minimisation — we only collect what the features you use actually need.
• We do not use children’s data for advertising, profiling for marketing, or any “nudge” techniques, and we do not sell it to anyone.
• Photos and audio are stored privately and are not publicly accessible.

Who we share it with

We do not sell your data. We use a small number of trusted providers to run the service, each acting as our processor under a written contract that requires them to protect your data and use it only on our instructions:

• Supabase — secure database, account login, and file storage for your photos and audio.
• Stripe — subscription payments.
• Google (Gemini) — AI features, as described above.
• Resend — sending essential account emails such as confirmation and password reset.
• Vercel — hosting the app, plus anonymous, aggregated visit counts (Vercel Web Analytics). This uses no cookies, stores nothing on your device, and cannot identify you.
• PostHog — privacy-focused product analytics, only if you consent (see the Analytics section below). Hosted in the European Union; no information about a child is ever sent to it.
• OpenWeather — your local weather, only if you use that feature. We send it a coarse, area-level location that is never tied to a child; OpenWeather is a UK company and does not store it.

We may also share data where we are legally required to do so, or to protect the rights and safety of people using the service.

Where your data is processed (international transfers)

We aim to keep your data within the UK and Europe wherever possible. Your account data, journal, photos, and audio are stored by Supabase in the European Union (Ireland), which UK law recognises as providing an equivalent level of protection, so no additional transfer safeguard is needed for that storage. Our analytics provider (PostHog) processes data in the European Union, and our weather provider (OpenWeather) is a UK company, so those stay within the UK and Europe as well.

Some of our other providers are based in, or may process data in, the United States — including Google (AI features), Stripe (payments), Vercel (hosting), and Resend (email). Where data is transferred outside the UK, we make sure it is protected by an appropriate legal safeguard:

• For transfers to US providers certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US Data Bridge”), we rely on that framework.
• For all other transfers, we rely on the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses, together with any additional measures needed to keep your data safe.

You can ask us for more detail about the safeguards in place for a particular provider at any time.

How long we keep it

• We keep your account information and your journal for as long as your account is active.
• When you delete an individual entry, photo, audio recording, or child profile, we remove it from our live systems. When you delete your whole account, we remove your account and associated data within 30 days, and it is overwritten in our routine backups within a further 90 days.
• We keep payment and transaction records (such as invoices and Stripe references) for 6 years after the relevant tax year, because UK accounting and tax law requires us to.
• We keep a record of your consent and policy agreements for as long as needed to show we have met our legal obligations.

How we protect your information

We take the security of your data, and especially your child’s, seriously. Our measures include:

• Encryption of data in transit (TLS) and at rest.
• Access controls that isolate your data to your own account.
• Private storage for photos and audio, which are not publicly accessible.
• Restricting access to your data to those who genuinely need it to operate or support the service.

No service can be completely secure, but we work to protect your information and to respond promptly if anything goes wrong.

What we store on your device

We use a small amount of browser storage that is strictly necessary to run the app: to keep you signed in, to remember simple preferences (such as which child is selected and whether you have seen the welcome message), and to record your analytics choice below. This essential storage does not require consent.

Analytics

With your consent, we use PostHog, a privacy-focused analytics tool, to understand how the app is used (for example which pages are visited and which features are used) so we can improve it. PostHog stores a small identifier in your browser and records usage events; once you are signed in, these are linked to your account, including your email address. Analytics data is processed on servers in the European Union. We do not use advertising cookies or tracking pixels, we do not record your screen, and we do not sell your data.

Analytics only runs if you accept it in the cookie banner. You can decline, and the app works exactly the same. Nothing about your child (their name, photos, or voice recordings) is ever sent to our analytics. You can withdraw your consent at any time by contacting us at legal@minizandme.com. We keep analytics data for 24 months.

Your rights

Under UK data protection law you have the right to:

• Access the data we hold about you,
• Correct it if it is wrong,
• Delete it,
• Export a copy in a portable format,
• Object to or restrict certain processing, and
• Withdraw consent where we rely on it.

You can delete individual entries, photos, audio, a child profile, or your whole account, yourself at any time from your dashboard. To get a copy of all the data we hold about you, or to exercise any of your other rights, contact us at legal@minizandme.com and we will action your request within one month.

There is no charge for exercising your rights in most cases. We may need to confirm your identity before acting on a request, to keep your data safe.

Changes to this policy

We may update this policy from time to time. When we make a significant change, we will update the version and date at the top and, where appropriate, let you know in the app or by email. Continuing to use the service after a change means you accept the updated policy.

How to contact us, and how to complain

For any question or request about your data, contact us at legal@minizandme.com.

If you are unhappy with how we have handled your data, you have the right to complain to the UK Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

We would, however, appreciate the chance to address your concerns first.