Prifio Privacy Notice

Version 0.7 · 2026-10-06 · Status: Draft for founder review

0.7: everything the export holds, and what it leaves out; how long each kind of record is kept; how we correct what's wrong; your name, product news, the do-not-email list, birth month and year, Stripe's US storage and the password check, described as they are.

This notice explains what Prifio collects about you and your family, why, and what you can do about it. It's written for the grown-ups — the guardians who hold the account. There's also a much shorter version written for children: Prifio, Explained for You.

What this notice covers

1. Who we are
2. The short version
3. What we collect and why
4. Our lawful bases
5. Who processes data for us
6. International transfers
7. Retention — how long we keep things
8. Your rights
9. Children's information
10. Cookies and similar storage
11. Complaints
12. Changes to this notice

1. Who we are

Prifio is a trading name of SectorSMART Ltd, a company registered in England & Wales, company number 17047477, registered office 95 Carlton Meadows, Llay, Wrexham, LL12 0QW. SectorSMART Ltd is the "controller" of the personal data described in this notice — the organisation legally responsible for deciding how and why it's used.

We are registered with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection. (to be confirmed)

We haven't appointed a separate Data Protection Officer. Instead, the founder is the single named contact for every privacy question, request or concern:

• Email: (to be confirmed)

Use that address for anything in this notice, including exercising any of the rights in section 8.

2. The short version

If you read nothing else on this page, read this.

1. Your child never has an account. Only grown-ups (guardians) do.
2. We store the minimum we possibly can about your child, and section 3 lists every single item we hold — there is no hidden extra.
3. We never sell or share your family's data with anyone, for any reason.
4. There are no adverts anywhere in Prifio. Not now, not later.
5. There's no tracking and no analytics in the parts of Prifio your child uses.
6. You can see what your child did in Prifio, the day after: notes written in advance by people, never a score. Your child is told, in words they can understand, that the people who look after them can see it.
7. Your family's data is hosted and processed in the UK and the EU. The one exception, once paid plans exist, is our payment processor — section 6 says what goes where.
8. You can export your family's data, or delete your account, yourself, at any time.
9. If your child has two guardians, they stand as equals. Neither can see into a home the child isn't part of, and deleting one guardian's account never deletes the child's record while the other guardian remains.
10. We'll tell you whenever something that matters about how we handle your data changes.
11. If you're ever unhappy, you can complain to us, and then to the ICO.

3. What we collect and why

About you, the guardian

Everything above is needed to provide the service, except two-factor authentication and product news, which are entirely optional.

If we invite you to the beta

While Prifio is tried out with a few families, creating an account needs an invitation. If we invite you, we keep your email address with the invitation, so that we can send it to you and check, when you sign up, that you are using the address it was sent to. The link in it works once, for that address only, for 14 days, and we keep only a scrambled form of it. When it is used, we note which account used it, and our records show it was used and from which network, as they do for other account events (section 7). We delete the invitation 30 days after it is used, withdrawn or out of date. If you delete your account, the invitation it was created from goes with it at once; any others we sent to your address go within the same 30 days. A guardian's invitation to join their family lets you sign up in the same way; nothing more is kept for that.

About your child

You, the guardian, give us this information directly when you set up your child's profile. None of it is collected from your child, and your child never fills in a form or answers a question themselves.

This is the complete list. Nothing else about your child is ever collected.

We don't collect, and will never ask you for: your child's photograph, school, home address, location, or anything written freely about them in their own words.

Devices you set up for your children

Your child never has an account. When you set up a tablet for your children, the tablet keeps its own key, and we store only a scrambled copy of it, the family it belongs to, which guardian set it up, and the dates it was set up, signed out and stops working (after a year). We don't record anything about the device itself — not its name, type or location, and not when it is used. Like every account event, setting it up is recorded with the first part of the network address it was set up from (section 7). Every guardian is emailed when a device is set up, and any guardian can sign out every device at once. We don't record which device, or which home, your child played in. (Like every website, our hosting provider keeps routine logs of requests for a short time, for security; a save from a tablet shows up there as a request, with its time. We never use those logs to see when your child plays.)

Technical information

• Error reports. When something breaks, our error-monitoring tool (Sentry, hosted in the EU) captures a technical report so we can fix it. It's configured to scrub personal data before anything is stored.
• Security logs. Records of sign-ins and similar account-security events, so we can detect abuse and keep accounts safe. See section 7 for how long these are kept. (Not yet in use: error monitoring will be added before launch, and this notice will be updated before it is.)

4. Our lawful bases

Under UK GDPR, we need a lawful basis for everything we do with personal data. Here's ours.

[PROPOSED, pending DPIA confirmation]

We don't use your data, or your child's, for any purpose beyond these. We don't use profiling or automated decision-making that has a legal or similarly significant effect on you or your child — in fact, we don't profile children at all, in any form (see section 9).

5. Who processes data for us

We use a small number of specialist providers to run Prifio. We don't hand your data to anyone beyond this list, and none of them may use it for their own purposes.

Each provider will have a data processing agreement with us before it holds any family's data. (to be confirmed)

Beyond the providers listed above, Prifio loads no third-party scripts, fonts, or trackers of any kind.

6. International transfers

By design, we don't route your family's data outside the UK and EU. Every provider above that holds it was chosen because it offers a UK or EU hosting region, and that's where we've configured each one to run.

The exception is our payment processor. Once paid plans exist (the beta is free), Stripe will hold your name, email address and payment details in the United States, under the UK's safeguards for international transfers (the International Data Transfer Addendum to Stripe's data processing agreement). Your child's information never goes to Stripe. (to be confirmed)

One narrow, honest caveat: like most cloud platforms, our hosting provider (Vercel) runs some background "control-plane" systems — the infrastructure that manages deployments and configuration, not your family's data — on global infrastructure with US defaults. Your family's actual data lives in our database in London, and the application itself runs from London. We treat the control-plane point as a watch item, not a gap, and it's recorded in our internal risk documentation (the DPIA and processor register).

7. Retention — how long we keep things

The headline schedule:

This is the headline version. The full retention schedule, covering every category of data we hold, is at docs/compliance/retention.md.

8. Your rights

Under UK GDPR you have a set of rights over your own data, and over your child's, as their guardian. In plain words:

• See what we hold (access). Use the export tool in your account, any time — no need to ask us first. It gives you everything we hold about you and your child, in two formats: a JSON file (complete and machine-readable) and a readable HTML page (open it like a webpage). That includes where you're signed in, your two-step and email choices, the links we emailed you, invitations to the beta and to a family, a subscription with Stripe's references for it, deletion requests, and the record of what you did and what was done to your account — with the network on what you did yourself, never on what our staff or anyone else did. One download holds the latest 5,000 entries of that record, and the latest 100 links we emailed you; if there are more, it says so, and we'll send you the rest. It also lists what it leaves out, and why: your password, two-step secret and recovery codes (we hold only scrambled forms, and even those would weaken your account), failed attempts to sign in and requests to reset your password (anyone who types your address can make one, and each holds the network of whoever made it; we keep them for 24 months to look into attacks), when our staff looked at your account (ask us, and we'll tell you, unless that could put a child at risk), and anything about another person. One thing waits a day: what your child did today is added to the export the next day, so that an export doesn't tell another home when your child played. The export says the last day it covers, and nothing is held back for longer than that. One thing can still show that your child played: the save of their world (which journeys they've helped with) changes when they play, so two exports taken some time apart show that your child played in between — not when, or in whose home.
• Correct it (rectification). If anything's wrong, tell us. Once we've checked it's you, through your account, we can correct your child's nickname or birth month and year, your name, or the role you hold in the family; each correction is recorded, and when a child's details are corrected every guardian in the family is emailed (except one whose account we have suspended, who is told nothing of the family meanwhile).
• Delete it (erasure). Delete your account from your account settings whenever you like. We hold it for 14 days in case you change your mind, then it's permanently and completely erased.
  • If your child has two guardians, deleting one guardian's account never deletes the child's profile or world while the other authorised guardian remains. The child's world stays exactly as it was.
• Take it with you (portability). The same export tool covers this — your data, in a format you can move elsewhere.
• Ask us to pause (restriction). If you dispute something we're doing, ask us to restrict processing while we sort it out, and we'll tell you what we can pause. We can stop every email to your address — the security ones too, such as the email that your password changed, so we'll agree that with you first — and we'll tell you before it starts again.
• Object. You can object to processing we base on legitimate interests (section 4); tell us why and we'll consider it.
• Withdraw consent. For product news, turn it off any time in your email settings, or use the link in every one — nothing else about your account changes.
• Automated decisions. These rights don't come up in practice, because we don't make automated decisions about you or your child that have a legal or similarly significant effect, and we don't profile children at all.

To exercise any of these, email us (section 1). We'll normally respond within one month.

If your account is suspended, these rights still stand: you can't sign in, but you can email us for a copy of your data, or to have your account deleted.

If you can't sign in — you've lost access, or your account is suspended — ask us, and we'll check it's you. We can then email a link to your data to the address your account has already confirmed, never to another address. The link works once, within three days; if you use two-step verification it asks for your code as well; and our admin tools never show what's in it. We can also start your account's deletion, with the same 14 days to change your mind, and cancel a deletion we started if you ask. We email you whenever we do any of these, so you'd know if anyone asked in your name — which is also why we can't do them for an address that was never confirmed.

9. Children's information

The ICO's Children's Code (the Age Appropriate Design Code) sets out how services used by children should treat their data. Here's what that means in practice at Prifio:

• High privacy by default. The most protective settings apply automatically. Your child never has to configure anything.
• No profiling. We don't build a behavioural profile of your child, ever, in any form.
• No nudge techniques. Nothing in Prifio is designed to keep your child engaged for longer than they want to be, or to pull them back in. No streaks, coins, leaderboards or timers exist anywhere in the product — this is a settled decision, checked automatically on every change we make (tests/policy/child-safety.test.ts). Sessions end naturally, when your child is done.
• Minimisation. We only ever collect the short list in section 3. Nothing more, ever, without updating this notice first.
• A notice your child can understand. There's a separate, much shorter explainer, written and voiced for a four- or five-year-old: Prifio, Explained for You.
• Your child is told what you can see. You can read what your child did in each activity. On a tablet you've set up for them, your child's own explainer says, in Welsh, that the people who look after them can see what they did there (the Children's Code, standard 11). In the free taster nothing is recorded, so it isn't said.
• Your child's privacy matters too. Children have a right to privacy of their own (the UN Convention on the Rights of the Child, article 16). The notes are there to help you help them learn, like a note home from a teacher. Please use them that way, and talk with your child about what they've been doing rather than checking up on them.

10. Cookies and similar storage

This is everything Prifio stores on your devices, or on a device you set up for your children. Nothing else is stored, and the list is checked automatically every time we change Prifio (tests/policy/storage-inventory.test.ts).

Each item is needed for Prifio to work the way you've asked it to, or remembers a choice someone made by pressing a button. None of it is used to track anyone, and there are no advertising cookies, analytics or third-party trackers. UK law only requires a cookie banner when a site stores things that aren't needed for the service you asked for. We don't, so there's nothing to ask your permission for, and nothing to click through.

11. Complaints

We hope you never need to, but if you're unhappy with how we've handled your family's data, tell us first: (to be confirmed). We'll do our best to put it right.

If you're still not satisfied, you have the right to complain to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection:

• Website: ico.org.uk
• Helpline: 0303 123 1113

12. Changes to this notice

This notice is versioned — the version number and date are always at the top. When we make a material change (anything that actually affects what we do with your family's data), we email every guardian to tell them directly, rather than quietly updating the page.

Version log