Your privacy, in plain English
A clear summary of how myHopscotch handles your data. The full Privacy Policy (v3.4) is below/linked and is the version that legally applies. If anything here is unclear, the full policy wins — but we've tried hard to make them say the same thing.
Who's in charge of your data: MY HOPSCOTCH LTD (England & Wales).
Who to contact: Kristi Hall — hello@myhopscotch.co.uk
Where we are today
myHopscotch is not open yet. Today the only personal details we collect are founding list sign-ups (called the waitlist in this policy) and any email you send us. Like any website, our host also handles technical data such as your IP address. Everything else below describes how the service will work from the day it opens. None of that collects or uses any data until then.
The short of it
- We collect your details and your setting's details — not children's details.
- The documents you make are streamed to you and not kept on our side.
- There's no AI writing your documents — they're built from expert-written, checked templates.
- We never sell your data and never use it to train AI.
- You can ask us to delete your data any time.
What we collect, and why
If you join the waitlist (the founding list): your name, email, setting name and a confirmation you're in England — so we can tell you when we launch. You don't have to give us any of it; without your name, your email, the England confirmation and the tick, we can't add you to the list. We keep this for up to 24 months, or until you ask us to remove you. You said yes with a tick box, and you can change your mind any time. That yes only covers us telling you about launch — not ongoing marketing. We'll only send marketing if you separately tick the marketing opt-in. And if you become a paying member, we run your account under our contract with you, not this consent. We also note the campaign tag on the link you clicked, if it had one, to learn which posts bring people to us. That is not part of the tick, and you can ask us to remove it. We also keep a record of what you ticked and when, for as long as you are on the list, so we can show what you agreed to.
When you have an account: your name and email, your setting's name and address, your Ofsted number, an optional phone number, and setting-level facts — hours, fees, age bands, how many children (a number), how many assistants, whether you cook, whether you drive children, and any setting-wide dietary rule (like "nut-free setting"). We need this to run the service for you.
We do not collect anything about individual children. No child names, no birth dates, no per-child records.
The documents you make: built on demand from checked templates, streamed to you, not stored by us. Nothing to delete on our side — the document lives in your records. Make it again any time.
How the product is used: we note things like which steps you finish and which features you use, so we can improve. It's first-party only — no ad trackers, no cross-site tracking, no tracking on our public pages (apart from the campaign tag on a waitlist sign-up, above). You can opt out in settings.
Payments: handled by Stripe. We never see or store your card details. We keep your billing status and Stripe ID.
The Chalk Box (our shop): if you buy a resource, we keep what you bought, the amount, the date, your Stripe ID, and your country (the shop is UK-only when it opens, and we need it for VAT). Payment is Stripe again.
If you email us: we use your message only to reply and to deal with what you asked.
When you visit our website: our host handles technical data such as your IP address to deliver the pages. We don't use it to identify you. When you send the founding-list form, it goes through our website to Airtable, where the list is kept.
Where your data lives
Your account data is held in the EU (Supabase, Ireland), encrypted, and as a member you can only see your own records. Our technical team can reach it to run and support the service.
(One honest note: some of our suppliers are in the US, or may handle data outside the UK — Airtable, which stores waitlist sign-ups; Vercel, our website host; Resend, which sends our emails; Stripe, which takes payments; Google, which runs our company email; and our technical team, K AND H DOTCOM, in South Africa. Each works under a transfer protection UK law recognises. Your account data is stored in the EU.)
Who we share it with
Only the suppliers we need to run the service: Supabase (database), Airtable (waitlist storage), Vercel (hosting), Google Workspace (our email), Stripe (payments), Resend (emails to you), and K AND H DOTCOM (Pty) Ltd in South Africa (our technical team). Where data goes outside the UK, we use a transfer protection UK law recognises — the UK International Data Transfer Addendum or Agreement, standard contractual clauses, or the UK Extension to the EU–US Data Privacy Framework where a US provider is certified. We never send your data — or any child's data — to an AI model as part of the service.
Children's data
myHopscotch is a professional tool for childminders. Children don't use it, and at launch we collect nothing about individual children. If we ever add features that involve children's data, you would be the data controller and we'd be your processor, with a proper agreement and a new privacy check first.
Your rights
You can ask us to: show you what we hold, correct it, delete it, pause it, hand it over in a portable format, or stop using it. To use any of these, email hello@myhopscotch.co.uk with "Data Rights Request." We reply within one month, free.
Cookies
At launch, only the strictly-necessary ones — one to keep you logged in, one to remember your settings. No analytics or ad cookies, so no cookie banner. Our public pages set none.
If something goes wrong
If a data breach could affect you, we tell the ICO within 72 hours and tell you where we're required to. Unhappy with how we handled your data? You have the right to complain to us (we reply within 5 working days), and to the Information Commission (the ICO): ico.org.uk · 0303 123 1113.
This plain-English summary sits alongside the full Privacy Policy v3.4, which is the legally binding version. Company number, ICO registration and registered office are shown in the full policy.
MYHOPSCOTCH PRIVACY POLICY
Version 3.4 · October 2026 · Supersedes v3.3 (August 2026)
Data controller: MY HOPSCOTCH LTD (company number 17491343, registered in England and Wales, registered office 20 Carlton Park Avenue, London, England, SW20 8BL)
ICO registration number: ZC264818
Data Protection Contact: Kristi Hall — hello@myhopscotch.co.uk
Website: myhopscotch.co.uk
Where we are today
myHopscotch is not open yet. Today the only personal details we collect are founding list sign-ups (called the waitlist in this policy) and any email you send us. Like any website, our host also handles technical data such as your IP address. Everything else below describes how the service will work from the day it opens. None of that collects or uses any data until then.
Who we are
myHopscotch is a platform for registered childminders in England that provides setting-personalised policies and guidance, activity planning connected to the EYFS, weekly menus and related childminding resources — produced from expert-written, verified templates.
myHopscotch is operated by MY HOPSCOTCH LTD (company number 17491343, registered in England and Wales).
Note: MY HOPSCOTCH LTD is not required to appoint a formal Data Protection Officer under Article 37 UK GDPR. Kristi Hall acts as Data Protection Contact for all privacy enquiries.
The short version
We collect only what we need — your details and your setting's details, not children's details. Your account data is stored in the EU, and where we use providers outside the UK we use the transfer protections required by UK data-protection law. The documents you generate are streamed to you and not kept on our side. We never sell your data, and we never use it to train AI models. You can ask us to delete your data at any time.
Phased availability. This policy describes the launch service. Some features are planned for later phases. A feature that is not yet available does not process or store any data until it goes live, and where a future feature will involve a new kind of processing (for example, anything involving children's data), we will update this policy — and obtain consent where required — before that processing begins.
What data we collect and why
1. Waitlist sign-ups (the founding list)
When you join our founding-member waitlist we collect:
| Data | Why | Lawful basis |
|---|---|---|
| Your name | To address you personally | Consent |
| Email address | To contact you when we launch | Consent |
| Setting name | To personalise our communication | Consent |
| Country — England, confirmed at sign-up | To confirm the service area applies to you | Consent |
| The campaign tag on the link you clicked, if it had one (for example "facebook") | To learn which posts bring people to us | Legitimate interests — knowing which of our posts bring people to us |
You don't have to give us any of this. Without your name, your email, the England confirmation and the tick, we can't add you to the list.
Retention: 24 months from sign-up, or until you ask us to remove you — whichever comes first. The consent checkbox on the waitlist form matches the consent purposes above (Article 7(2) UK GDPR). You can withdraw consent at any time. This consent covers contacting you about the launch; ongoing marketing happens only if you separately tick the marketing opt-in, and if you become a subscriber, your account is administered on the basis of contract, not this consent. The lawful basis for that marketing is consent. We keep your marketing opt-in until you unsubscribe, or until your details come off the list if that is sooner.
We also keep a record of which boxes you ticked and when, so that we can show what you agreed to. Lawful basis: legal obligation (we must be able to show your consent). We keep it for as long as you are on the list.
2. Childminder account and setting information
When you create an account and set up your setting profile we collect: your name and email, setting name and address, Ofsted registration number, phone number (optional), and setting-level details — hours, fees, age bands present, capacity, number of children (a count), number of assistants, whether you provide food, whether you transport children, and any setting-level dietary constraints (for example, "this is a nut-free setting").
We do not collect information about individual children — no child names, dates of birth, or per-child records. Dietary constraints are held at the level of your setting, never linked to a named child.
Lawful basis: contract — this data is necessary to provide the service you subscribe to. Retention: subscription duration plus 12 months after cancellation.
3. The documents you generate
When you generate a document, we assemble it on demand from expert-written, verified templates personalised to your setting, and stream it to you to download or print. We do not keep a copy. Because nothing is stored, there is no document-retention period and nothing to delete on our side — the document lives only in your own records. You can regenerate any document at any time.
There is no live AI model in the service. Documents are produced by a deterministic merge of your setting details into pre-approved templates — not written for you by an AI at the point of use. (We do use AI behind the scenes at build time to help us draft and refine our template library; that process uses generic content only and never receives your data or any child's data.)
4. Product usage (analytics)
We record how the product is used — for example, which onboarding steps you complete and which features you use — so we can improve the service. This is first-party analytics tied to your account. We do not use third-party advertising trackers, we do not track you across other websites, we do not track visitors on our public marketing pages (the one thing we note there is the campaign tag on a founding-list sign-up, described in section 1), and we never sell usage data or use it to train AI models.
Lawful basis: legitimate interests (improving the service), assessed and recorded in our DPIA and scoped to specific product-improvement purposes only. You can opt out in account settings. Retention: up to 14 months, then aggregated.
5. Payment information
Payments are processed by Stripe. We do not see or store card details. We retain subscription status, payment history, and your Stripe customer ID for billing. Stripe is our processor for running payments, and a separate data controller for its own purposes, such as fraud prevention and legal compliance, under its own privacy policy. Lawful basis: contract.
6. Chalk Box purchases
When you buy a Digital Asset through the Chalk Box, we collect the details needed to complete and account for the purchase: what you bought, the amount, the date, your Stripe customer ID, and your country/billing location (which we use to confirm eligibility, as the shop is UK-only when it opens, and to apply VAT where required). Payment is processed by Stripe (see section 5 and the table below). Where the shop is limited to UK buyers, we use your billing country solely to confirm eligibility and apply the correct tax treatment; we do not use it for profiling or marketing. Lawful basis: contract. Retention: as required for accounting and tax records.
7. If you email us
If you write to hello@myhopscotch.co.uk, we use your email address and what you tell us to reply and to deal with what you asked. Lawful basis: legitimate interests — answering the people who contact us. We keep the message only as long as we need it for that.
8. When you visit our website
Our website host, Vercel, handles technical data such as your IP address to deliver the pages and keep the site secure. We do not use it to identify you. Lawful basis: legitimate interests — delivering our website and keeping it secure. We keep no copy of it ourselves; the request logs our host shows us are kept for one day. When you send the founding-list form, it goes to our website, which passes it straight on to Airtable, where the list is kept. We do not store the form on our website.
How we store your data
Your account data is held in the EU (Supabase, Ireland — eu-west-1), encrypted in transit and at rest. Access is owner-scoped: as a member, you can only see your own records. Our technical team can reach the data to run and support the service (see the note on K AND H DOTCOM below). Founding-list sign-ups are held separately, with Airtable in the United States (see the table below).
Who we share data with
We share data only with the providers we need to run the service:
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Supabase | Database, authentication | Stored in the EU (Ireland). Supabase (a Singapore company) and its sub-processors may handle it in other countries where needed to run and support the service | UK International Data Transfer Addendum, for any access from outside the UK and EU |
| Airtable | Founding-list sign-up storage | United States | UK International Data Transfer Addendum |
| Vercel | Website and app hosting, including passing founding-list sign-ups from our form to Airtable | United States (main location); other countries where Vercel and its sub-processors operate | UK International Data Transfer Addendum |
| Google Workspace | Our company email | Google's data centres, which may be outside the UK | UK Extension to the EU-US Data Privacy Framework for transfers to the United States; standard contractual clauses in Google's Cloud Data Processing Addendum for other countries, where required |
| Stripe | Payment processing (Stripe is our processor for running payments, and a separate controller for its own purposes such as fraud prevention and legal compliance) | United States, and other countries where Stripe and its sub-processors operate | UK Extension to the EU-US Data Privacy Framework; UK International Data Transfer Addendum |
| Resend (Plus Five Five, Inc.) | Transactional email delivery | United States | UK Extension to the EU-US Data Privacy Framework; UK International Data Transfer Addendum |
| K AND H DOTCOM (Pty) Ltd | Technical development and platform operations | South Africa | UK International Data Transfer Agreement |
For each provider above except K AND H DOTCOM (Pty) Ltd, the mechanism is the one set out in that provider's own data-processing terms, as read in October 2026. For K AND H DOTCOM (Pty) Ltd it is the UK International Data Transfer Agreement our two companies have signed.
We do not sell your data. We do not share it with advertisers. We do not send your data — or any child's data — to any AI model as part of the service.
International transfers
Where personal data is transferred outside the UK, we use a lawful transfer mechanism. For Airtable, Vercel and Supabase that is the UK International Data Transfer Addendum to the standard contractual clauses, which forms part of each provider's data-processing terms. Stripe and Resend state that they take part in the UK Extension to the EU-US Data Privacy Framework; while that is in force it is the mechanism for transfers to them in the United States, and the UK International Data Transfer Addendum in their data-processing terms applies if it is not. For Google Workspace, Google states that Google LLC is certified under the same UK Extension and uses it for transfers to the United States; for other countries Google's data-processing terms use standard contractual clauses where required. For K AND H DOTCOM (Pty) Ltd (South Africa) it is the UK International Data Transfer Agreement (UK IDTA). You can ask us for a copy of the safeguards.
Note on K AND H DOTCOM (Pty) Ltd and South Africa access: K AND H DOTCOM (Pty) Ltd provides technical development and platform-operations services to MY HOPSCOTCH LTD. It handles personal data for us under a Data Processing Agreement, and its personnel may access personal data held for MY HOPSCOTCH LTD in the course of operating the platform and the founding list. It holds some supplier accounts, including Airtable, on our behalf. This access from South Africa is an international transfer governed by the UK IDTA. K AND H DOTCOM acts solely as a processor, and only on MY HOPSCOTCH LTD's documented instructions. Account data itself is held in the EU (Ireland).
Children's data — our position
myHopscotch is a professional tool for registered childminders. Children do not access it, and at launch we do not collect any information about individual children.
- ICO Children's Code (UK): the Age Appropriate Design Code applies to services likely to be accessed by children. myHopscotch is not such a service. We nonetheless follow its data-minimisation and privacy-by-default principles as good practice.
If we introduce features involving children's data in a future phase, the childminder will be the data controller and myHopscotch the processor, governed by a Data Processing Agreement, and we will complete a new privacy assessment before that processing begins.
Childminders as data controllers (future phases)
Where a future feature involves you entering personal data about children or families in your care, you are the data controller and MY HOPSCOTCH LTD is your data processor. Our Data Processing Agreement (available on request and incorporated into your subscription) will govern that relationship. At launch, no such data is collected, so this arrangement is not yet engaged.
Your rights
Under UK GDPR you have the right to:
- Access — ask what data we hold and receive a copy (within one month)
- Rectification — correct inaccurate data (most is editable in account settings)
- Erasure — ask us to delete your data (within one month)
- Restriction — ask us to pause processing while a concern is investigated
- Portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interests (including analytics)
- Withdraw consent — for any consent-based processing (e.g. the waitlist), at any time
To exercise any right, email hello@myhopscotch.co.uk with the subject "Data Rights Request". We respond within one month, at no charge. We make no decisions about you by automated means.
Cookies
At launch, myHopscotch uses only strictly-necessary cookies — a session cookie to keep you logged in and a preference cookie to remember your settings. These do not require consent under PECR. We do not use analytics or advertising cookies, so there is no cookie-consent banner. If we introduce non-essential cookies in future, we will add a consent mechanism first. Our public website — the pages you can see without logging in — sets no cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Keeps you logged in | Until you log out |
| Preference cookie | Remembers your settings | 12 months |
Data breaches
If a breach is likely to affect your rights and freedoms, we will notify the ICO within 72 hours of becoming aware, and will notify you where required.
Changes to this policy
We notify you by email of material changes. The version and date at the top always reflect the current version. We review this policy at each phase release, and in any event by 1 March 2027, to confirm it still reflects how the service actually processes data.
Contact and complaints
Data Protection Contact: Kristi Hall — hello@myhopscotch.co.uk
Complaints. You have the right to complain to us about how we use your information: email hello@myhopscotch.co.uk. We will acknowledge your complaint within 5 working days, look into it without delay and tell you the outcome. You also have the right to complain to the Information Commission (the ICO): ico.org.uk · 0303 123 1113.
myHopscotch — setting-personalised policies and guidance, activity planning connected to the EYFS, weekly menus and related childminding resources · myhopscotch.co.uk