PRIVACY

Privacy policy

This policy explains how LittleSite.co.uk handles personal information when people create a site, make a booking, buy a download, submit a review or otherwise use the service.

1. Who is responsible for your information

LittleSite.co.uk ("LittleSite", "we", "us" or "our") is the controller for personal information used to operate, secure and improve the LittleSite platform, administer accounts, collect LittleSite fees and meet our legal obligations.

Creators using LittleSite may be separate controllers when they use customer information to provide their own services, manage client relationships or meet their own legal duties. Their own privacy information may therefore also apply.

Operator details

The operator has chosen not to publish a legal name, postal address or public contact address in this version. Those details should be added before relying on this notice as a complete UK GDPR privacy notice.

2. Information we collect

Account information: email address, authentication records, username, display name and account status.
Creator content: biography, location, links, images, branding, services, availability, product files, testimonials and other material a creator publishes or stores.
Booking and client information: customer name, email, telephone number, messages, appointment details, time zone, internal client notes, booking history, reminder status and cancellation or rescheduling information.
Order and payment records: delivery email, product or booking purchased, price, discount, currency, payment status, Stripe account and transaction identifiers, refunds and disputes. LittleSite does not receive full card numbers or card security codes.
Reviews and communications: ratings, review text, names attached to reviews, support messages and transactional email delivery information.
Usage and technical information: page views, link clicks, event times, session-based view markers, device or browser information made available in service and security logs, and approximate network information processed by hosting and security providers.

3. How we receive information

We receive information directly from account holders, creators and customers; from the creator whose page a customer uses; automatically when the service is used; and from service providers such as Stripe, Supabase, Vercel and email-delivery providers.

4. Why we use information and our lawful bases

PurposeUK GDPR lawful basis

Create accounts; publish creator pages; provide bookings, downloads, dashboards and secure fulfilmentPerformance of a contract

Process payments, platform fees, refunds, disputes and Stripe Connect onboardingPerformance of a contract and legitimate interests in operating the marketplace

Send confirmations, download access, calendar links and service remindersPerformance of a contract

Prevent fraud, secure accounts, enforce terms and keep reliable audit recordsLegitimate interests and, where applicable, legal obligation

Maintain financial, tax, consumer-rights and regulatory recordsLegal obligation and legitimate interests in legal claims

Measure page visits, clicks and service performance using limited first-party analyticsLegitimate interests in understanding and improving the service

Publish a review when the creator chooses to make it publicLegitimate interests in providing verified reputation features

Where we rely on legitimate interests, we consider the benefit, necessity and effect on individuals. You may object to this processing as described below.

5. When information is required

Information marked as required is needed to create an account, complete a booking or order, deliver a download, process a payment or provide another requested feature. If it is not provided, that feature may not work. Optional profile and message fields can be left blank.

6. Who receives information

Creators and customers: each receives the information reasonably needed to manage the booking, purchase, delivery, cancellation, refund or dispute.
Stripe: payment processing, fraud prevention, refunds, disputes, identity checks, connected-account onboarding and payouts. Stripe may act as an independent controller for parts of this activity.
Supabase: authentication, database and private file storage.
Vercel: website hosting, delivery, security and operational logs.
Email providers: delivery of confirmations, reminders and other transactional messages.
Professional advisers, regulators, courts and authorities: where reasonably necessary to establish or defend rights, comply with law or protect users.
A buyer or successor: if all or part of the service is reorganised, sold or transferred, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal information.

7. International transfers

Some suppliers may process information outside the United Kingdom. Where UK personal information is transferred internationally, we require an applicable UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with additional measures where required.

8. How long we keep information

We keep information only for as long as reasonably necessary for the purposes above. Account and creator content is generally kept while the account is active. Booking, order, fee, refund and related financial records may be retained for up to six years after the relevant transaction or account closure where needed for tax, accounting, consumer or legal-claim purposes. Security and webhook records are retained for a shorter period appropriate to investigation and reliability needs. Published reviews may remain until withdrawn, removed or no longer needed.

Deletion may be delayed where information is required to resolve a dispute, prevent fraud, comply with law, preserve another person's rights or maintain a secure backup. Backup copies are removed on their normal replacement cycle.

9. Cookies and local storage

LittleSite uses authentication, security and load-balancing technologies that are necessary to provide the service. Public creator pages also use session storage to avoid counting the same page view repeatedly during one browser session. LittleSite does not currently use non-essential advertising cookies. If non-essential cookies or similar technologies are introduced, we will provide clear information and obtain consent where PECR requires it.

10. Security

We use access controls, row-level database security, private storage, signed payment webhooks, limited-use customer links, encryption in transit and operational monitoring. No internet service can guarantee absolute security, so users should use a unique password and protect private booking, calendar and download links.

11. Your data-protection rights

Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to processing of your personal information, and to receive information you supplied in a portable form. Where processing is based on consent, you may withdraw it without affecting earlier processing.

Your right to object: you may object to processing based on legitimate interests. We will stop unless there are compelling legitimate grounds or the information is needed for legal claims.

Requests may require identity verification. We normally respond within one month, subject to lawful extensions. You can also complain to the Information Commissioner's Office.

12. Children

LittleSite accounts are intended for people aged 18 or over. We do not knowingly offer accounts to children or intentionally collect their information. A customer booking a service for a child should provide only information that is necessary and lawful to share.

13. Changes to this policy

We may update this policy when the service, suppliers or law changes. Material changes will be brought to account holders' attention where reasonably possible. The effective date at the top identifies the current version.