Privacy Policy

1. Information we collect

• Account details: your name, email address, and password (stored securely, never in plain text).
• Dependant profiles you create: a child's name, date of birth, medical notes, emergency contact details, and photo consent preference.
• Booking and attendance history, and subscription/payment status.
• Payment information: card payments are handled entirely by Stripe. We receive confirmation that payment succeeded, never your full card number.
• Messages you send us, and broadcast/news messages we send you.
• If you enable notifications, a device push-notification identifier (not your location or contacts).

2. Why we collect it

• To create and run your account, and to take and manage bookings (performance of a contract).
• To keep your child safe during a session, including in a medical emergency (vital interests / contract).
• To send booking confirmations and essential service communications (contract / legitimate interest).
• To send news, broadcasts, and optional notifications you can opt out of at any time (consent).
• To meet our legal and accounting obligations, for example keeping payment records.

3. Children's information

Dependant profiles are created and managed by a parent or guardian, not by the child. We only use a child's information to run the sessions and camps they're booked into and to keep them safe while they're with us - never for marketing directed at children.

4. Who we share information with

• Stripe - to process card payments.
• Resend - to deliver account and booking emails.
• Vercel and Neon - our hosting and database providers, who store data on our behalf and don't use it for their own purposes.
• Coaches and staff, limited to what they need to run a session safely (for example a child's medical notes and emergency contact, not your payment details).

We don't sell personal information to anyone.

5. How long we keep it

We keep account and booking records for as long as your account is active, plus a reasonable period afterwards to meet accounting and legal obligations. You can ask us to delete your account and associated dependant profiles at any time, subject to what we're legally required to retain.

6. Cookies

We use a single essential cookie to keep you signed in. We don't use advertising or analytics cookies.

7. Your rights

Under UK data protection law, you can ask us to:

• give you a copy of the personal information we hold about you or your child;
• correct anything that's inaccurate or out of date;
• delete your account and associated information;
• restrict or object to certain uses of your information;
• provide your information in a portable format.

To do any of these, email camps@captiv8life.com. You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you're unhappy with how we've handled your information.

8. Security

We use industry-standard measures to protect your information, including encrypted connections and securely hashed passwords. No system is completely risk-free, but we take reasonable steps to keep your data safe.

9. Changes to this policy

We'll update the "last updated" date above whenever we make changes to this policy, and let you know if a change is significant.

10. Contact

Questions about this policy or your information can be sent to camps@captiv8life.com.