Privacy notice
Updated 15 November 2026 · Version 2026-11-15.4
Postal address: view our Contact page.
Who controls your information
Ian Trueman trading as Online Safety Stories is the data controller. Our postal address is on our Contact page. For privacy questions or requests email support@onlinesafetystories.co.uk.
Information we use
For adult accounts we use your email, display name, password hash, account/session identifiers and security records. Purchases add the selected plan and licence, order/payment references, price, agreed policy version, acceptance time, contract copy and email-confirmation records. We also receive information you send to support. Do not send card details or identifiable pupil information. Cancellation and refund requests also record the selected purchase, request type, submission date, status, any optional note and our response. These are linked to your adult account.
Payments
Stripe processes payment details on its hosted payment pages. We do not store complete card numbers or card security codes in the website database. We receive payment and subscription status and references needed to provide access, handle billing and keep records. Stripe also processes information for its own legal, security and fraud-prevention purposes; see https://stripe.com/privacy.
Why we use it
We use account, order and transactional email information to perform our contract with you. We use proportionate security and fraud-prevention records for our legitimate interests in keeping the service secure. We keep records required for accounting and legal obligations. We use support messages to answer requests and resolve problems. We do not sell personal information or use account emails for unsolicited marketing.
Children and quizzes
Accounts and purchases are for adults. Quizzes work in the current page and do not create individual pupil profiles or a saved pupil-results record. Hosting services may still receive technical visitor information when children view pages with adults. Avoid entering pupils’ names or personal experiences into support messages. A parent or teacher can contact us about a child’s information.
Service providers and transfers
Floot hosts and operates the website, database and email delivery. Its published provider list identifies Amazon Web Services for hosting and email delivery, and Databricks/Neon for the application database, with processing in the United States (us-east-1) and worldwide delivery caches. Our support mailbox is Microsoft 365 supplied through GoDaddy. GoDaddy and Microsoft process support correspondence as needed to provide and support that email service. See https://www.godaddy.com/en-uk/legal/agreements/privacy-policy and https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Stripe handles payments and may process information internationally. See https://floot.com/subprocessors and https://stripe.com/privacy. International transfers require appropriate lawful safeguards; contact us for information or copies relevant to your data. Third-party websites, including Amazon, have their own privacy notices.
How long we keep information
We keep account information while needed to operate your account and resolve outstanding matters. Contract, payment and related complaint records may be kept for up to six years after the relevant contract ends for accounting and legal claims, or longer where law or an active dispute requires it. Password-reset codes expire after the period stated in the reset process. Security logs are kept only as long as needed for security and investigation. Contact us to close an account or request deletion; records we must retain may be restricted rather than deleted.
Your rights
Depending on the circumstances, you can ask to access, correct, erase, restrict or transfer your personal information, and object to processing based on legitimate interests. We may need to verify your identity. We normally respond within one month; lawful extensions or exceptions may apply. Contact support@onlinesafetystories.co.uk. You can complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113.
Security and updates
We use access controls, password hashing and encrypted connections. No service can guarantee absolute security. Keep your password private and report suspected account misuse promptly. We update this notice when our processing changes and will highlight significant changes where appropriate.