Data Protection Notice

UK GDPR / GDPR privacy notice · Effective date: 2 November 2026

Launch blocker: This draft needs the controller identity, address, privacy contact, retention schedule and transfer details completed and reviewed before launch.

Controller and contact

[INSERT LEGAL BUSINESS NAME AND POSTAL ADDRESS] is the proposed controller for data processed through this service. Contact [INSERT PRIVACY EMAIL] for data protection questions or rights requests. Confirm the controller and any representative or data protection officer details that apply to the business before publication.

People and data covered

This notice applies to purchasers and people whose name, phone number, or message content is entered by a purchaser. Purchasers must be 18 or older. Minor recipient data may be submitted only by their parent or legal guardian with appropriate authority and permission. We process recipient details to prepare and deliver the purchaser's clearly identified MockMate educational-game order.

Purposes, data, and proposed lawful bases

To create an order, verify payment, submit a message, and handle support: purchaser and recipient details, message or selected voice template, channel, schedule, and transaction identifiers. For voice orders, recipient name and fixed script are also processed by Google Cloud Text-to-Speech, and the resulting MP3 is temporarily stored in Cloudflare R2. The proposed basis is contract performance for the purchaser and legitimate interests in providing the service to the intended recipient; the controller must verify the appropriate basis for each person's data.
To maintain accounts, refunds, and legally required records: payment amount, currency, status, refund, and order references. The basis may be legal obligation and legitimate interests, as applicable.
To secure the service and prevent abuse: limited technical, transaction, and delivery information. The proposed basis is legitimate interests, subject to the required assessment.

We do not use recipient numbers for unrelated marketing. The purchaser's permission confirmation is a service safeguard and does not by itself establish the recipient's consent for every data-protection purpose.

Recipients, processors, and international transfers

Data is shared with Stripe for checkout/payment, Twilio for SMS/WhatsApp delivery, Google Cloud for voice synthesis, Cloudflare R2 for temporary audio storage, and the configured hosting/database provider. Website assets are currently loaded from Google Fonts, cdnjs, and jsDelivr, which receive browser requests. Confirm subprocessors, processing locations, contracts, and transfer safeguards before launch. See the Privacy Policy for further detail.

Retention

Voice audio links expire after 7 days, and the corresponding Cloudflare R2 objects must be automatically deleted after 7 days by a configured bucket lifecycle rule. [INSERT SPECIFIC RETENTION PERIODS AND DELETION RULES FOR ORDER, FULFILMENT, PROVIDER, AND HOSTING RECORDS]. The current application does not automatically delete database records. Retain information only for as long as needed for the stated purpose or legal obligations.

Your rights and complaints

Subject to applicable law, you may request access, rectification, erasure, restriction, portability, or object to processing. Where a lawful basis is consent, you may withdraw it. Contact [INSERT PRIVACY EMAIL]; we may ask you to verify your identity. You may complain to the UK Information Commissioner's Office (ICO) or another competent supervisory authority. You also have rights to seek a judicial remedy where provided by law.

Automated decisions and changes

The service does not currently make decisions with legal or similarly significant effects solely by automated processing. We may update this notice when the service or law changes; the effective date will be revised.