Privacy and data rights

What we collect

The free kit form asks for an adult parent or carer's first name and email address. Please do not submit a child's name, age, school, financial information or other child data.

Why we use it

We use these details to send the kit you requested and an application-owned confirmation message. A separate checked marketing choice, confirmed through our double-opt-in flow, permits occasional Little Lessons, Big Blessings updates. An unchecked choice does not create a marketing-eligible contact. Turnstile and the hidden honeypot help protect the form from abuse.

Who processes it

Little Lessons, Big Blessings is responsible for this signup. Resend acts as our email processor for confirmation, transactional delivery and consented marketing. Our sending region is eu-west-1, but Resend states that account data, including contact data, message metadata, logs and API records, is stored in the United States regardless of sending region. The Resend DPA, UK Addendum and SCC transfer route remain account-holder actions and have not yet been accepted.

Retention and your rights

The encrypted confirmation state is kept for at most 30 days and is deleted at expiry or after a terminal failure. The application-owned D1 subscribers table stores subscriber personal data — email address, first name, marketing consent and its consent evidence — while marketing consent is active. Resend contact data is retained while consent is active; after unsubscribe, only the suppression needed to honour that choice is retained. Redacted webhook evidence is kept for 90 days after the event, unless an incident or legal hold requires longer retention. The retention and deletion triggers are indexed in the repository's Resend processor record.

Unsubscribing stops marketing but is not a deletion request. To request access, correction, deletion or restriction, or to report a suppression concern, email hello@littlelessonsbigblessings.com. We record the request, expected result, observed result, date and redacted evidence in the processor record, then carry out the applicable account or provider action. The final owner-attested procedures remain outstanding.