Privacy notice
Version 1.5, effective 28 October 2026
Who is responsible for your data. Aspire Capital LTD, trading as Little Big Stars, company number 12503673, 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF, is the controller of your personal data. Email privacy@littlebigstars.co.uk. We are registered with the Information Commissioner's Office (registration number ZC277234).
Who this is for. Our service is for adults. We collect data about children only when a parent, grandparent or other adult gives it to us to personalise a Product, and we ask only for what we need.
What we collect, why, and our legal basis
| What | Why | Legal basis | How long we keep it |
|---|---|---|---|
| Your name, email, order details, and the IP address and time of your consent ticks | To take, deliver and support your order, and sign you in | Contract | 6 years after the order (tax and accounting law) |
| Payment details | To take payment. Card numbers go to Stripe and never reach us | Contract | Stripe's own periods. We keep the order and amount for 6 years |
| A child's first name, age, interests, appearance details | To personalise the Product | Contract | 90 days after delivery, then deleted unless you ask us to keep them |
| Your email and your gift details when you ask for a free preview (child's first name, age, interests, appearance, and the avatar and preview if we make them) | To show or send you a preview and let you come back to finish your gift. If you get a free preview but don't order, we may send you one email with a link back to your saved preview. We won't send any more reminders about it. | Steps you ask us to take before a contract | 30 days if you don't buy, then deleted. If you ticked the box to hear from us, we keep only your email address so we can send news until you unsubscribe. If you buy, the order rules above apply. |
| An optional photo of a child | Only to create the preview picture and your child's cartoon character | Your explicit consent (you can withdraw it at any time) | Deleted within 24 hours of upload |
| The cartoon character (avatar) and preview picture | To appear in the Product | Contract | 90 days after delivery, then deleted unless you ask us to keep it |
| Messages, complaints, data requests | To reply and meet our legal duties | Legitimate interests, and legal obligation | 6 years after the matter closes |
| Basic site statistics (no cookies, no personal profile), and anonymous page and form-step totals (no cookies, no IP address, nothing you type) | To see which pages are used and improve the site | Legitimate interests | Per our analytics provider's settings; step totals are anonymous counts |
| Marketing cookie data (Meta Pixel) | To measure ad performance and show our ads | Your consent, through the cookie banner | Per Meta's settings, and until you withdraw consent |
| Review text, if you leave one | To publish your review | Consent | Until you ask us to remove it |
We keep a record of your cookie choice (yes or no, the date and the policy version). If you are signed in, it is linked to your account. We do not store your IP address with it.
We do not sell your data. We do not use your child's photo, name or avatar to train AI models, or for marketing.
The photo, in plain words. If you upload a photo, it is stored in a private area that only we can open, for the shortest time needed. When you ask for a free preview, our AI image service (fal), paid for by us, automatically creates a preview picture and a cartoon character from the photo, or from your description if you didn't upload one. Your child's name is never sent to it. We delete the photo permanently from our storage within 24 hours of upload, and record the deletion. Our storage provider's backups hold only a record that a file existed, not the photo itself. We instruct our AI provider not to store the photo and to delete the files within an hour. There is a longer explanation on our "How we handle your child's photo" page.
If you ask for a free preview, the photo rules are the same: the photo is still deleted within 24 hours of upload, even if you haven't bought yet.
Because an AI service is used, we have carried out a data protection impact assessment, which we keep under review. A photo is not used to identify anyone. We do not run face recognition or build a face template for matching.
Who we share data with. Only service providers who act on our instructions, under contract:
| Provider | What for | Where data may go |
|---|---|---|
| Supabase (via Lovable Cloud) | Database, sign-in, private file storage | EU (Ireland, eu-west-1) |
| fal (fal.ai) | Creating the preview picture and the child's cartoon character from the photo or the description, set not to store requests, to delete files within an hour, and not to train | USA (the fal-hosted model API has no published UK or EU region), under the UK International Data Transfer Addendum in fal's data processing addendum |
| Stripe | Taking payment | UK, EU, USA, with UK safeguards |
| Lovable email service | Sending order emails and magic links | EU (Ireland, eu-west-1) region |
| Lovable (hosting) | Running the website | See Lovable's privacy information |
| Meta Platforms | Advertising measurement (from your browser and from our server), only if you accept marketing cookies | USA and elsewhere, with UK safeguards. Meta is responsible for its own use of the data |
Where a provider is outside the UK we rely on UK-approved safeguards such as the UK International Data Transfer Agreement or the UK Extension to the EU-US Data Privacy Framework.
We may also share data where the law requires, for example with HMRC, the police or a court.
Your rights. You can ask us to: tell you what we hold about you and your child (access), correct it, delete it, restrict or object to how we use it, and give you your data in a portable form. You can withdraw consent at any time, for example for a photo or for marketing cookies, and withdrawing is as easy as giving it. Email privacy@littlebigstars.co.uk. We will acknowledge within 5 working days and reply within one month. We may ask you to prove who you are. A parent or guardian can exercise these rights for their child.
Complaints. Please tell us first at privacy@littlebigstars.co.uk or hello@littlebigstars.co.uk and we will try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security. Photos are in a private bucket reachable only through short-lived links for authorised staff. Data is encrypted in transit and at rest by our providers. We limit who can see it and keep a log of deletions.
Changes. If we change this notice we will update the date and, for material changes, tell you by email.