Privacy notice
Last updated 14 October 2026.
Who is responsible for your data
Squelch Ltd (company 17405508, registered in England and Wales, registered office 66 Paul Street, London, EC2A 4NA, United Kingdom) operates MinderSprout. We are registered with the Information Commissioner's Office (ICO) under reference ZC226129. For anything about your data, contact [email protected].
Two roles. We are the controller of the account and billing data of the setting that subscribes to MinderSprout. For the personal data about the children and families a setting enters, the setting is the controller and we are its processor, acting only on its instructions. Our processor terms are in the terms of service.
What we process and why
| Data | Why | Lawful basis |
|---|---|---|
| Your name, email address, and whether your email is verified. Passwords are held only as a hash by our sign-in service — never in plain text. | To create your account and sign you in | Contract |
| Plan, subscription status, trial and renewal dates, Stripe customer reference. | To bill the setting and manage its subscription | Contract; legal obligation (accounting records) |
| Card details. | Taken and held by Stripe, not by us. We see only the card type and last four digits. | Contract |
| Data about children and families entered by the setting: children's names and dates of birth, room and key worker, allergies, dietary requirements and medical notes, emergency contacts, diary entries, photos, messages, invoices, and the email addresses of invited parents. | To provide MinderSprout to the setting and the families it connects | We process this on the setting's instructions. The setting is the controller and is responsible for its lawful basis. |
| Server and security logs (for example, a record of sign-in activity). | To keep the service secure and to investigate problems | Legitimate interests (security) |
Children's data and special category data
MinderSprout is built for childcare. The data a setting enters about a child — in particular allergies, dietary needs and medical notes — is special category data under Article 9 UK GDPR, and photographs are personal data. The setting is the controller of that data and must have an appropriate lawful basis (for example, the provision of health or social care, a substantial public interest, or vital interests, alongside the setting's safeguarding duties and its own policy). We process it strictly on the setting's instructions and only to provide the service.
Photographs are shared only with the parents or guardians linked to that child, and only where the setting has recorded the child's photo consent.
Cookies
We use only the cookies needed to sign you in and keep your account safe — no advertising or third-party tracking. See the cookie notice.
Who we share it with
We use a small number of service providers (subprocessors) who process personal data on our behalf: hosting, network and storage, payments, and email delivery. They are listed, with where they process data and the transfer safeguard used, on the subprocessors page. We never sell personal data.
Where your data is held
Our servers and the database are in the UK/EU, and diary photos are stored in a private Cloudflare R2 bucket in the EU. Some subprocessors operate globally or in the United States; where data leaves the UK, we rely on UK adequacy regulations or the UK Extension to the EU-US Data Privacy Framework / the UK Addendum to the EU Standard Contractual Clauses, as set out on the subprocessors page.
How long we keep it
- While a setting's account is active, we keep its data so the service works.
- If a setting's subscription lapses, the setting is locked but all its data is kept for 90 days. Paying at any point in that window restores everything intact. After 90 days the data may be removed.
- Database backups are retained for up to 30 days.
- We keep billing records for the period required by law (currently six years).
Your rights
Subject to the law, you have the right to:
- be told what we hold (this notice) and to access a copy of it — you can download your data from your account page;
- have inaccurate data corrected;
- have data erased — you can delete your account in the app;
- restrict or object to processing;
- receive your data in a portable format; and
- withdraw any consent you gave (for example, photo consent, which a parent gives to their setting).
Where the setting is the controller (children and family data), please contact the setting first; we will help them respond. You can also raise concerns with us at [email protected], and you have the right to complain to the ICO at ico.org.uk (our registration is ZC226129).
Security
Every request runs under row-level security in PostgreSQL, so a person can only ever reach the data they are entitled to. Data is encrypted in transit, sign-in is managed by Keycloak, secrets are held in Infisical and never in code, and access to production is restricted.
Changes
If we change this notice we will update the date above and, for material changes, tell account holders.
Contact
Squelch Ltd, 66 Paul Street, London, EC2A 4NA, United Kingdom. Privacy queries: [email protected]. Support: [email protected].