Privacy Policy
Last updated: 6 October 2026
Privacy Policy
Growing Bright Minds Last updated: March 2026
1. Who We Are
Growing Bright Minds is a parenting and early childhood education content platform.
For any privacy-related enquiries or to exercise your rights, contact: office@growingbrightminds.com
2. What Personal Data We Collect and Why
2.1 Browsing the site (unauthenticated)
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, browser type, operating system | Security, fraud prevention, server logs | Legitimate interest (Art. 6(1)(f)) |
| Pages visited, referral source | Site operation, performance monitoring | Legitimate interest (Art. 6(1)(f)) |
2.2 Analytics (only with your consent)
| Data | Purpose | Legal basis |
|---|---|---|
| Page views, scroll depth, clicks, session data | Understanding content performance and user behaviour | Consent (Art. 6(1)(a)) |
| Device type, browser, approximate location (country/region) | Product improvement | Consent (Art. 6(1)(a)) |
Analytics are collected via PostHog (EU Cloud) and Google Analytics 4 only if you accept analytics cookies. If you decline, no analytics cookies are set. PostHog operates in cookieless mode for declined-consent users.
2.3 Newsletter subscription
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Sending newsletters and content updates | Consent (Art. 6(1)(a)) |
| Name (optional) | Personalising emails | Consent (Art. 6(1)(a)) |
Subscription requires double opt-in confirmation. You may unsubscribe at any time via the link in every email.
2.4 User account (Google Sign-In)
| Data | Purpose | Legal basis |
|---|---|---|
| Google email address, display name, profile photo | Account creation and authentication | Contract / legitimate interest (Art. 6(1)(b)/(f)) |
Sign-in is handled via Google OAuth. We do not store your Google password.
2.5 Comments
| Data | Purpose | Legal basis |
|---|---|---|
| Comment text, timestamp | Publishing your community contribution | Contract (Art. 6(1)(b)) |
| Email address (not displayed publicly) | Reply notifications (if enabled) | Legitimate interest (Art. 6(1)(f)) |
3. Third-Party Processors
We use the following third-party processors to operate the platform. Each has a Data Processing Agreement in place where required:
| Processor | Role | Location | Safeguard |
|---|---|---|---|
| Supabase | Database, authentication, file storage | EU / US | DPA, SCCs |
| Vercel | Website hosting and serverless functions | US | DPA, SCCs |
| PostHog | Product analytics | EU (Frankfurt) | EU data residency |
| Google (Analytics 4) | Acquisition analytics | US | DPA, SCCs, Consent Mode v2 |
| Google (OAuth / Search Console) | Sign-in, search data | US | DPA, SCCs |
| Resend | Transactional and newsletter email | US | DPA, SCCs |
| OpenAI | AI-assisted content drafting (operator-side only) | US | DPA, SCCs |
User personal data is not shared with OpenAI. AI agents operate on editorial content only, under the operator's control.
4. Children's Data
This platform is directed at parents and early childhood educators. We do not knowingly collect personal data from children under the age of 13. If you believe a child has submitted data through this platform, contact us immediately at office@growingbrightminds.com and we will delete it promptly.
5. AI-Generated Content
Articles on this platform may be drafted with AI assistance (OpenAI GPT-4o). All AI-generated content is reviewed and approved by the human operator before publication. No fully automated decisions are made about users. See our AI Transparency Notice for full details.
6. Data Retention
| Data type | Retention period |
|---|---|
| Newsletter subscriber data | Until you unsubscribe |
| User account data | Until account deletion is requested |
| Comments | Until deletion is requested or account is deleted |
| Analytics data | Per PostHog and GA4 retention settings (PostHog: 1 year; GA4: 14 months default) |
| Server logs | 30 days |
Consent cookie (gbm_consent) | 365 days (renewed on preference change) |
7. Your Rights Under GDPR
As a data subject, you have the following rights:
- Access — request a copy of the personal data we hold about you
- Rectification — request correction of inaccurate data
- Erasure — request deletion of your data ("right to be forgotten")
- Portability — receive your data in a structured, machine-readable format
- Restriction — request that we limit how we process your data
- Objection — object to processing based on legitimate interest
- Withdraw consent — where processing is based on consent, you may withdraw at any time without affecting prior processing
- Complaint — lodge a complaint with the Danish Data Protection Authority (Datatilsynet): www.datatilsynet.dk
To exercise any right, email: office@growingbrightminds.com. We will respond within 30 days.
8. Security
We implement appropriate technical and organisational measures to protect your data, including encrypted transmission (HTTPS/HSTS), database-level Row Level Security policies, and access controls limiting data access to authorised personnel only.
9. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated to registered users by email. The "last updated" date at the top of this page reflects the most recent revision.
10. The Growing Bright Minds app
This policy covers the Growing Bright Minds mobile app as well as this website.
The app collects no personal data from a child, or from anyone reading, watching or colouring without signing in. Reading a book, watching a video or colouring a page asks for no name, no email address and no account, and nothing is collected about a child doing it. A sign-in button is reachable from a couple of places a child can also reach — "Keep it" on a coloured page, and the daily-limit sheet — but pressing it alone only reaches a parental gate a grown-up must solve first; the Google sign-in itself does not begin until that gate is solved. Playing a video loads a YouTube embed, handled by Google under its own terms. There is no advertising in it, no advertising identifier is read, and no analytics or tracking package is included.
If a grown-up chooses to sign in, the app asks for the name and email address Google gives us; Google's sign-in also provides a profile picture URL, which we store alongside them. Signing in can only be started once a grown-up has solved the parental gate — a child who presses the sign-in button alone gets the gate, not Google. It uses your existing Google account; we never see or store a password. Signing in is what lets a grown-up keep a coloured picture, and it lifts the other daily limits (currently one book, one video and one colouring design a day); it is not required to read, watch or colour. Signed out or signed in, the app reads the books, colouring pages, videos, articles, shop products and events already published on growingbrightminds.com; once signed in, it also reads that account's own kept pictures back to it.
A signed-in grown-up's kept pictures are stored against that account. When a signed-in grown-up presses "Keep it" on a coloured page, that picture is saved to our servers against their account, so it can be found again from any device they sign into.
Deleting a kept picture, deleting the account it belongs to, or removing the colouring page it was made from — each of these deletes its stored copy. The app has no delete control of its own: the stored copy on our servers is the only one, so removing it through any of those three ways removes it for good.
How to reach us. Email publishing@growingbrightminds.com, and a person will read it. Please do not include anything about your child in that email; we do not need it.