1. Who We Are
Hero Colouring Ltd ("we", "us", "our") is the data controller for personal data collected through this website and subscription service. We are committed to protecting your privacy and handling your data responsibly in accordance with UK GDPR and the Data Protection Act 2018.
Contact: hello@herocolouring.co.uk
2. What Data We Collect
About you (the subscriber):
- Email address
- Mobile number (optional)
- Delivery name and address
- Payment information (processed and stored securely by Stripe — we never see or store your full card details)
About your child and family (for personalisation):
- Child's first name
- Child's gender (optional)
- Family member names you choose to include (e.g. Mum, Dad, siblings — all optional)
Note on children's data: We only collect a child's first name and optional gender for the sole purpose of personalising their book. We do not create accounts for children, contact children directly, or use children's data for any purpose other than producing their book.
3. How We Use Your Data
- To fulfil your subscription — personalising and printing your monthly book and dispatching it to your address.
- To manage your account — processing payments, handling cancellations, and sending transactional emails (order confirmation, dispatch notification).
- To contact you — regarding your subscription, delivery issues, or changes to our service.
- Legal compliance — maintaining records as required by law.
We do not use your data for marketing without your consent, and we never sell your data to third parties.
4. Legal Basis for Processing
- Contract performance — processing your data is necessary to fulfil your subscription.
- Legitimate interests — fraud prevention and service security.
- Legal obligation — retaining financial records as required by law.
5. Third Parties We Share Data With
We share your data only with trusted third parties necessary to operate our service:
- Stripe — payment processing. Your payment data is governed by Stripe's privacy policy.
- Supabase — secure database hosting. Data is stored in the EU.
- Our print partner — your name, delivery address, and personalised PDF are shared with our print and fulfilment partner solely to produce and ship your book.
- Resend — transactional email delivery (order confirmation, dispatch emails).
All third parties are required to handle your data securely and only for the purposes we specify.
6. How Long We Keep Your Data
- Subscriber and child data is retained for the duration of your subscription plus 2 years.
- Financial records (payment history) are retained for 7 years as required by HMRC.
- If you cancel your subscription you may request deletion of your personal data (excluding financial records we are legally required to keep).
7. Your Rights
Under UK GDPR you have the right to:
- Access — request a copy of the data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data (subject to legal retention requirements).
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interests.
- Restriction — ask us to restrict processing of your data.
To exercise any of these rights, email us at hello@herocolouring.co.uk. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
8. Cookies
We use only a single session cookie to keep you logged in to your admin account. We do not use tracking cookies or third-party advertising cookies.
9. Data Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. All data is transmitted over HTTPS and stored in encrypted databases.
10. Changes to This Policy
We may update this policy from time to time. We will notify you of significant changes by email. The current version is always available on this page.