Legal
Privacy Policy
Last updated: 11 October 2026.
Information we collect from parents
Your full name, email address, residential address, country of residence, country of citizenship, your consent records (what you agreed to, when and which wording), and your registration and payment status. We do not store card details; payments are handled by the payment provider.
Information we collect about children
For each child: a display name (a first name or nickname is enough), date of birth, and participation records — which challenge codes were released and redeemed, whether each challenge was accepted, completed or declined, the recorded score, and timestamps. We do not ask for a child’s email address, phone number, home address, social media accounts, photographs, videos, location or school.
Why we use it
- To provide the programme you registered for (contract).
- To confirm age eligibility and parental consent (consent and legal obligation).
- To send programme emails: verification, codes, reports and certificates (contract).
- To keep the service secure and prevent abuse, and to keep accounting records (legitimate interests and legal obligation).
Parental consent and withdrawal
A parent or legal guardian gives consent when registering. You can withdraw consent or ask us to delete your family’s information at any time from the parent dashboard or by emailing us. Withdrawing consent ends participation.
Who we share information with
Service providers acting on our behalf: our hosting and database provider (Cloudflare), our email delivery provider, our payment provider, and Google (Google Sheets, used for internal operational records with restricted access and minimal data — no payment data, no challenge text, and masked access codes). We do not sell personal information and do not use it for advertising.
Cookies and analytics
We use only essential cookies: a sign-in cookie for parents, a short-lived cookie that keeps a child’s unlocked challenge on their device, and a security cookie for administrators. We do not use advertising or cross-site tracking cookies.
Retention
Account and participation records are kept for the membership and a reasonable period afterwards so that you can retrieve reports and certificates. Payment and consent records are kept as long as accounting and legal rules require. When you ask for deletion we remove personal details (names, email, address, date of birth) and keep only anonymous aggregate and legally required records.
Security
Access codes are stored hashed and encrypted; sessions use signed, HTTP-only cookies; sign-in is by emailed single-use link; staff access is restricted and logged; connections are encrypted in transit.
Your rights
Depending on where you live you may have the right to access, correct, export, delete or restrict the use of your information, and to complain to your data protection authority. Use the parent dashboard (export and deletion requests) or email us.
International transfers
Our providers may process data in several countries. We rely on provider safeguards appropriate to the law that applies to you.
Contact and complaints
Write to hello@suprmindhq.com. We will respond as soon as we can.