Draft for review: please have a solicitor check this before launch and fill in the contact details.
Privacy policy
The Knock Knock Club makes digital advent calendars. This page explains what personal information we collect, why, and what you can do about it. We try to collect as little as we can.
Who we are
The operator of The Knock Knock Club is the data controller. Contact: [add contact email and address].
What we collect
- Buyers and owners: your email (to sign you in with a magic link and send receipts), and what you pay. Card details go straight to Stripe; we never see them.
- Calendar content: the messages, photos, voice notes, videos and coupons that go in doors. These can include personal information about the people in them. We store them privately.
- Group members: the name and email the organiser gives us (or you give us), your doors, reactions and comments. You do not need an account.
- Recipients: nothing, unless you choose to sign up for a daily reminder (your email or a browser notification).
- Followers of a business calendar: your email or browser notification, only if you follow. We hold it and send the notifications for the business. The business never sees your contact details.
- Crowd calendar contributors: your email and display name, and the post you make. You must tell us you are 16 or over. The calendar owner sees only your display name. If you tick the optional box, we may email you offers and news from the brand; claiming a door never depends on it.
- Technical data: to stop abuse and count door opens we keep short-lived hashed identifiers (for example a hash of your IP address and device), not your raw IP address. Basic usage analytics may be collected with PostHog.
Why we use it
- To run the calendars you ask us to run (contract).
- To send reminders and notifications you asked for, or that you receive as part of a calendar you belong to. Every notification email has an unsubscribe link.
- To send marketing emails only if you ticked the optional, unticked box. You can unsubscribe at any time.
- To keep the service safe, including reviewing reports (legitimate interests and legal obligations).
Who sees your content
- A door's content is only shown after its day arrives, and only to the people it is for.
- In a group calendar the organiser cannot see other members' doors before they open.
- Group comments are private to the group. A door only becomes public if the person who made it chooses to share it, and they can make it private again at any time. Public views never show comments.
- If you report something, our team may look at it to decide what to do.
Who we share it with
Only the services that help us run The Knock Knock Club: Supabase (database and file storage), Stripe (payments), Resend (email), Vercel (hosting), Cloudflare (bot checks), and PostHog (analytics). We do not sell your data.
How long we keep it
Calendars close at the end of January. We email you a download link a week before. Photos, voice notes and videos are deleted on 2 February, two days after calendars close, so organisers have a day to download everything. [Confirm retention for emails and other records with your adviser.]
Children
Group members should be 13 or over, and Crowd calendar contributors must be 16 or over. Children can appear in content, but an adult submits it. Children who receive a personal calendar only view it; we collect nothing from them.
Your rights
Under UK GDPR you can ask to see, correct, delete or move your data, object to how we use it, and withdraw consent. Email us at the address above. You can also complain to the Information Commissioner's Office (ico.org.uk).