Privacy Notice

Expressive Minds provides creative enrichment programmes for children and runs this website and the Expressive Minds Creative Space. For the personal information described in this notice, Expressive Minds is the controller, meaning we decide how and why it is used.

Contact us about anything in this notice, or to use your rights, at admin@expressiveminds.org.uk.

When you send an enquiry through our contact form: your name, email address, the type of enquiry, your message and, if you are a parent or carer and choose to give it, your child's age. We ask you not to include your child's name, health details or other sensitive information in the message.

Parent and carer accounts: your name, email address, a password (stored only in protected, hashed form by our sign-in service), and account records such as when you signed in. We also keep the link between your account and the children you add or that our team connects to you, and the programmes you allocate or pause.

Staff accounts: name, email address, role and a record of actions taken in the staff workspace.

Children's Creative Space accounts: see section 3.

Activity records: we keep a log of important account events (for example a child account being created, a PIN being reset or a programme being allocated) so we can keep accounts safe and investigate problems.

Technical information: our hosting and security services process information such as IP address and browser details when you visit the site, to deliver pages and protect the service. We do not use advertising or analytics tracking on this website.

Children's Creative Space accounts are set up by a parent or carer, or by our team. Children do not sign themselves up and do not need an email address. For each child we hold:

• first name or display name, a username and a PIN (the PIN is stored only in hashed form and cannot be read back by anyone, including our team);
• age or year details provided by the parent, carer or our team, and the programmes they are allocated;
• their programme progress and the work they create, such as plant diary notes, story pages and words, game characters and worlds;
• photos or pictures they upload, for example plant photos or images for their story pages.

Uploaded photos are kept in private storage and are only visible to the child, their linked parent or carer, and authorised Expressive Minds staff. They are not published publicly. Please help your child avoid uploading photos that show faces, school uniforms, home addresses or other identifying details.

Story art: when a child chooses to turn a picture into story-style art in Story Makers, that image and a short description are sent to an AI image service to create the new picture. The result is saved privately with the child's story.

Safeguarding: we have a duty to keep children safe. If anything a child creates or shares, or anything we learn through our programmes, raises a safeguarding concern, we may record it and share relevant information with the appropriate authorities (such as children's social care or the police) without consent where the law allows or requires this.

UK data protection law requires a legal basis for each use. We rely on:

• Replying to enquiries — legitimate interests (responding to people who contact us), or steps before entering into an agreement with you.
• Providing parent, child and staff accounts and the Creative Space (sign-in, saving progress and creations, showing parents their child's progress) — performance of our agreement with the parent or carer, and legitimate interests in running the service safely.
• Security, activity logs and preventing misuse — legitimate interests.
• Safeguarding and meeting legal duties — legal obligation and, where necessary, vital interests or substantial public interest (safeguarding of children).
• Optional features such as uploading photos or creating AI story art happen only when the child or parent chooses to use them.

We do not use personal information for marketing without separate permission, we do not sell it, and we do not make decisions about anyone using automated decision-making with legal or similarly significant effects.

Within Expressive Minds, access is limited to authorised staff who need it. A parent or carer can see information about children linked to their account. We use these service providers, who process information on our behalf under our instructions:

• Lovable — website and app platform, including hosting, database, sign-in, private file storage and email sending (enquiry notifications and account emails such as invitations and password resets). Lovable uses its own infrastructure providers, including Supabase and Cloudflare.
• Lovable AI gateway and the AI image model provider behind it — only when Story Makers story art is requested.

We may also share information where the law requires it, for safeguarding, or to protect the rights and safety of children, families and our team.

Some of our service providers store or process information outside the UK, including in the United States or the European Economic Area. Where this happens, we rely on safeguards recognised under UK law, such as UK adequacy regulations or the International Data Transfer Agreement / UK Addendum to standard contractual clauses, as offered by those providers. Contact us for more detail.

We do not use advertising, analytics or social media tracking cookies. When you sign in, your browser stores a strictly necessary sign-in token (in local storage) so you stay signed in. This is removed when you sign out. Our hosting and security providers may set strictly necessary security cookies. Because these are essential to provide the service, we do not ask for cookie consent for them.

• Enquiries — enquiry emails are kept for as long as needed to deal with your enquiry and any follow-up, then deleted.
• Parent, child and staff accounts, progress and creations — kept while the account is active. Pausing a programme keeps saved progress. If you ask us to close an account, we will delete or anonymise its information unless we need to keep some of it for the reasons below.
• Activity and security logs — kept for as long as needed to keep accounts secure and investigate issues.
• Safeguarding records — kept for as long as required by safeguarding guidance and law, which may be longer than other records.

We protect information using access controls so each person only sees what they are allowed to, encrypted connections (HTTPS), hashed passwords and PINs, private file storage and records of key account actions. No online service can be completely secure, so please keep passwords and PINs private and tell us straight away if you think an account has been misused.

Under UK data protection law you have the right to:

• ask for a copy of your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information;
• ask us to restrict how we use it, or object to uses based on legitimate interests;
• ask for information you gave us to be transferred to you or another organisation, where applicable;
• withdraw consent at any time where we rely on consent.

Parents and carers can usually exercise these rights on behalf of their children. Children who are old enough to understand their rights may also make requests themselves. Email admin@expressiveminds.org.uk. We will normally respond within one month. Some rights have legal exceptions, for example where we must keep safeguarding records.

Please contact us first at admin@expressiveminds.org.uk so we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

We will update this notice when our services or the way we use information change, and show the new effective date at the top of this page. You can always reach us through the Contact page.