Privacy Policy

This Privacy Policy explains how Second Star Play Ltd, trading as OK Let’s Play, collects, uses, stores, shares and protects personal data when you visit or use the OK Let’s Play website, web application, companion mobile application, mailing list, customer support channels or related services.

It also explains your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the Privacy and Electronic Communications Regulations 2003 (PECR). Because the service is offered worldwide, additional local privacy rights may apply depending on where you live. Where applicable law gives you stronger rights than those described here, we will respect those rights.

In this policy, “OK Let’s Play”, “we”, “us” and “our” refer to Second Star Play Ltd. “Service” means the OK Let’s Play website, web application, mobile application and associated features. “Personal data” means information relating to an identified or identifiable person.

Second Star Play Ltd is the data controller for the personal data described in this policy. This means that we decide why and how that personal data is processed.

We have not appointed a Data Protection Officer because we do not currently consider that we are legally required to do so. Privacy enquiries and requests should be directed to hello@okletsplay.uk.

Only adults aged 18 or over may create an account or purchase a subscription. We do not recommend use of the product by anyone under 18, and children must not create accounts or provide personal data directly to us.

The Service is designed to help parents, guardians and other responsible adults discover and organise play activities for children. An adult account holder may add limited information about a family member to personalise recommendations. The account holder is responsible for ensuring that they have authority to provide that information and that it is appropriate, accurate and limited to what is necessary.

4.1 Account and identity information

When you create or manage an account, we may collect your name, email address, encrypted or hashed authentication credentials, account settings, preferences and subscription status.

No social-login providers are currently used. Users sign in using the account credentials provided directly through OK Let’s Play.

4.2 Subscription and payment information

All subscription payments are managed and securely processed by Stripe. Subscriptions are purchased through the OK Let’s Play web platform.

OK Let’s Play does not collect, receive, process or store debit card numbers, credit card numbers, bank details, card security codes or other payment credentials at any time or for any reason. Payment details are entered directly into Stripe’s payment environment and are handled by Stripe under its own privacy and security arrangements.

Stripe provides us only with the subscription and transaction information needed to deliver and administer the Service. This may include your Stripe customer identifier, subscription plan, subscription status, payment status, billing and renewal dates, cancellation information, invoice references, transaction references, refunds and dispute status, and limited billing information where necessary for accounting or customer support.

4.3 Family profile information

An adult account holder may create family profiles to personalise activity suggestions. The available fields are:

• nickname;
• age bracket;
• interests; and
• other needs relevant to selecting appropriate activities.

We strongly recommend using a nickname rather than a real name for family members. Users should not at any time include surnames, dates of birth, addresses, school names, contact details, or other information that could identify a child.

The likes, dislikes and needs fields should be limited to practical information that is genuinely useful for selecting activities. Users should avoid entering medical diagnoses, detailed health records, ethnicity, religion or other special category or highly sensitive personal data unless we expressly introduce a feature designed for that purpose and provide suitable additional information and safeguards.

4.4 Prompts, preferences and activity information

When you search, filter, save or generate play ideas, we may process information such as age bracket, interests, needs, time available, energy level, preferred level of adult involvement, available materials, location or environment, saved activities, favourites and prompts submitted to the AI idea-generation feature.

Users should not enter real names, addresses, school details, contact information or other unnecessary identifying information into prompts or free-text fields.

4.5 Mailing-list information

If you join our mailing list, we may collect your name, email address, the date and method of subscription, evidence of consent, marketing preferences, delivery status, email opens, link clicks, unsubscribe status and suppression-list information.

Mailing-list consent is always collected through a separate unticked opt-in. Joining the mailing list is optional and is not a condition of using the core Service.

4.6 Customer support and communications

When you contact us, we may collect your name, email address, the contents of your enquiry, information needed to investigate the matter, attachments or other information you choose to send, and records of our response.

Users cannot upload files through the Service itself. This does not prevent a user from voluntarily attaching a file to an email sent to our support address, but users should avoid sending sensitive or unnecessary information.

4.7 Technical, security and usage information

When you access the Service, we may automatically collect limited technical and usage information, including IP address, browser and device type, operating system, app version, language and time-zone settings, session identifiers, login dates and times, pages or features used, cookie identifiers, security events, error messages, crash reports and diagnostic information.

We collect personal data:

• directly from you when you create an account, subscribe, complete a form, add profile information, use features, join the mailing list or contact us;
• automatically through your use of our website, web application or mobile application;
• from Stripe, which supplies subscription and transaction status but not your payment credentials; and
• from service providers that help us host, secure, analyse, monitor and support the Service;

Most of the personal data we process is processed because it is necessary to provide the OK Let’s Play service you have requested. Where processing is not necessary to provide the service, for example, marketing communications, we will rely on your consent or another appropriate lawful basis under UK data protection law.

6.1 Creating and managing accounts

We use account information to register and authenticate users, maintain account settings, recognise subscription status, provide saved content and preferences, administer access and deliver requested features.

6.2 Providing and personalising the Service

We use account information, family profile information, preferences, prompts and activity history to display relevant play ideas, filter and recommend activities, generate personalised suggestions, remember settings and provide requested functionality.

6.3 Managing subscriptions and payments

Stripe securely processes all subscription payments. We use the limited information supplied by Stripe to activate subscriptions, verify whether access should remain active, administer renewals and cancellations, manage refunds or disputes, provide subscription support and maintain legally required accounting records.

We never receive or store payment card details or other payment credentials.

6.4 Essential service communications

We may send account verification messages, password resets, security alerts, subscription confirmations, payment-status notices, renewal or cancellation information, important product notices, changes to terms or privacy information and customer-support responses.

6.5 Marketing communications

Where you have actively opted in, we may send product news, feature updates, parenting and play-related content, offers, surveys, beta-testing invitations and other information about OK Let’s Play. Our email service may record delivery, opens and clicks so that we can understand engagement and improve communications. You may withdraw consent at any time using the unsubscribe link in an email or by contacting hello@okletsplay.uk. We may retain a minimal suppression record so that we can honour your choice not to receive further marketing.

6.6 Customer support

We use contact, account and technical information to answer questions, investigate problems, verify account ownership, resolve subscription issues and manage complaints.

6.7 Security, fraud prevention and legal claims

We may use account, device, network and usage information to protect accounts and systems, prevent unauthorised access, investigate misuse, enforce service limits, maintain backups and establish, exercise or defend legal claims.

6.8 Analytics, diagnostics and service improvement

Where appropriate, we use Google Analytics, Firebase Analytics and Sentry to help us understand how our website and applications are used, identify errors, improve performance and develop new features.

Analytics information is used only to improve the quality, reliability and usability of the service. Where reasonably possible, information used for analysis is aggregated, anonymised or pseudonymised.

Where analytics require consent under applicable law, they will only be used after that consent has been obtained.

6.9 Research, beta testing and feedback

We may use account information, usage information and feedback voluntarily provided by users to evaluate beta features, conduct product research, understand how the Service is used, improve existing features and develop new functionality.

Where reasonably possible, information used for research is anonymised or aggregated. We will not use a user’s name, feedback, comments or account information in marketing, testimonials or promotional materials without obtaining separate, explicit consent. Where a specific research activity requires consent under applicable law, we will seek that consent.

6.10 Legal and regulatory obligations

We may process personal data to comply with tax, accounting, consumer-protection, data-protection and other legal duties, respond to valid requests from courts, regulators or law-enforcement bodies, investigate complaints and protect the rights, safety and property of users, the public or our business.

Where we rely on legitimate interests, those interests may include operating and improving OK Let’s Play, providing relevant functionality requested by account holders, supporting users, preventing fraud and misuse, protecting systems, maintaining appropriate business records, conducting proportionate product research and protecting our legal rights.

Before relying on legitimate interests, we consider whether the processing is necessary and balance our interests against the rights, freedoms and reasonable expectations of the people whose information is involved.

The Service is not designed to collect special category data, such as detailed information about health, disability, ethnicity, religion, political opinions, trade-union membership, genetics, biometrics or sexual life or orientation.

Users should avoid entering this information into family profiles, prompts, support communications or other free-text fields. If a future feature genuinely requires special category data, we will provide additional privacy information and identify an appropriate lawful condition before processing it.

The AI idea-generation feature is powered by Anthropic. Prompts and associated contextual information are sent to Anthropic solely so that the requested response can be generated.

Based on the service configuration selected for OK Let’s Play, prompts submitted through the Service are not used by Anthropic to train its general-purpose models. We do not use AI to make solely automated decisions that produce legal effects or similarly significant effects about users or family members.

AI-generated suggestions are provided for general inspiration and should not be treated as professional medical, educational, safeguarding, legal or childcare advice. Users remain responsible for deciding whether an activity is appropriate and safe in their circumstances.

This section explains how the website’s storage and access technologies involve personal data. The names, purposes and lifetimes of individual cookies and browser-storage items are listed in our Cookie Policy.

10.1 Google reCAPTCHA

The public Beta Signup form uses Google reCAPTCHA v3 Classic to distinguish genuine submissions from automated abuse. When the security check runs, the browser communicates with www.google.com and www.gstatic.com. Google may process the IP address, browser and device information, the page and referring URL, timestamps, interaction information and other risk signals needed to produce an abuse-risk assessment.

reCAPTCHA may use the _GRECAPTCHA cookie and _grecaptcha local storage. Google describes _GRECAPTCHA as a necessary cookie used for risk analysis. We use reCAPTCHA because it is necessary to protect the form and Service from spam, fraud and automated misuse. Our data-protection lawful basis is our legitimate interests in securing the Service and its users. We treat the related device storage as strictly necessary for this security purpose where PECR applies. reCAPTCHA is not used by us for advertising.

Google processes this information under its own terms and privacy arrangements. More information is available in the Google reCAPTCHA privacy and security FAQ, the Google Privacy Policy and the Google Terms of Service.

10.2 Google Fonts

The website currently requests font files from fonts.googleapis.com and fonts.gstatic.com. Each request necessarily supplies Google with the IP address used to make the request, the requested URL and HTTP headers that can include the browser and operating-system user agent and the referring page. Google states that the Google Fonts API does not set or log cookies and that information collected by Google Fonts is not used to create end-user profiles or for targeted advertising.

We use these fonts in our legitimate interests in presenting a consistent, readable website. You may object by blocking Google Fonts requests through browser or device controls; the website will use available fallback fonts and may look different. See the Google Fonts privacy information and the Google Privacy Policy.

10.3 Civic Cookie Control

The website is configured to support Civic Cookie Control as its consent-management service, but that service was not active on ordinary visits at the date of this policy. If activated, it will provide the on-site privacy controls and place a first-party CookieControl cookie on this website to remember the categories you accept or reject. The preference record remains in the browser for up to 90 days by default, unless it is replaced or cleared sooner.

The preference record is necessary to remember and respect your choice. Our lawful bases for related personal-data processing are compliance with our data-protection and electronic-communications obligations and our legitimate interests in demonstrating and managing those choices. No central Civic consent-logging feature is configured. Requests needed to deliver the Civic script may nevertheless disclose ordinary network information such as an IP address, requested resource and browser headers to Civic or its delivery infrastructure. See the Civic Cookie Control privacy notice.

10.4 Google Analytics

Google Tag Manager container GTM-56JVHZ36 contains Google Analytics 4 tags for measurement ID G-N0Y77QR9G5. At the date of this policy, the production consent service is not active, so Google Tag Manager and Google Analytics are not loaded on ordinary visits and no website analytics data is sent before a visitor has made an Analytics choice.

If the consent service is activated, the website will use a basic consent setup: Analytics will remain off unless you actively allow the Analytics category. Only then will Google Tag Manager load the Google Analytics tags. Google Analytics may process a first-party client identifier, session information, pages viewed, interactions, referrer information, approximate location derived from an IP address, and browser and device information. The current implementation is for website measurement and improvement; advertising-storage, advertising-user-data and advertising-personalisation signals remain denied.

Our lawful basis for Google Analytics website processing will be your consent. You will be able to reject Analytics without losing access to the website and, once the preference control is active, withdraw consent through it. Withdrawing consent stops future analytics storage and collection but does not affect processing that was lawful before withdrawal. Google’s default implementation stores a client identifier in the _ga cookie only when analytics storage is enabled. Further details, including the current cookies and durations, are in our Cookie Policy and the Google Privacy Policy.

We do not sell, rent or trade personal data. We disclose personal data only where necessary to operate, secure and improve the Service, comply with law, protect legal rights or act on your instructions.

Service providers may process personal data only for agreed purposes and subject to contractual, confidentiality, security and data-protection obligations. Principal providers are listed in Appendix A.

We may also disclose information where required by law or court order, in response to a valid regulator or law-enforcement request, to protect vital interests, to establish or defend legal claims, or in connection with a sale, merger, restructuring or transfer of all or part of the business, subject to appropriate safeguards.

OK Let’s Play’s primary hosting is based in the United Kingdom.

Some third-party service providers may process, support or access personal data from countries outside the United Kingdom. Where personal data is transferred internationally, we will ensure that an appropriate legal safeguard is in place in accordance with UK data protection law. Depending on the destination and circumstances, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses, or another legally recognised transfer mechanism, together with supplementary safeguards where appropriate.

You may contact hello@okletsplay.uk for more information about safeguards relevant to a particular transfer.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.

13.1 Active accounts

Account information and family profiles are retained while the account remains active, unless the user deletes or updates particular information earlier.

13.2 Closed accounts

When an account is permanently closed, personal information relating to the account holder is anonymised and all associated family profiles are deleted. Information that must be retained for legal, accounting, fraud-prevention or dispute-resolution reasons may be kept separately for the required period and access will be restricted.

13.3 Support messages

Support messages and related records are retained for seven years for legal, customer-service, security and dispute-resolution purposes.

13.4 Technical logs and crash reports

Technical logs, security records, diagnostic information and crash reports are retained for seven years for security, auditing, troubleshooting and incident-investigation purposes.

13.5 Backups

Backups are retained for seven years under our disaster-recovery and business-continuity arrangements. Deleted information may remain in protected backups until the relevant backup expires or is overwritten, but it will not be restored for ordinary operational use.

13.6 Marketing records

Mailing-list information is retained until you unsubscribe or the mailing list is discontinued. A minimal suppression record may be retained afterwards to ensure that your opt-out continues to be respected.

13.7 Transaction records

Subscription and transaction records received from Stripe may be retained for the period required by applicable tax, accounting and financial-record laws.

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, misuse, alteration, disclosure and destruction. Measures may include encrypted communications, secure UK-based hosting, password hashing, access controls, administrative multi-factor authentication where available, software updates, logging and monitoring, backups, data minimisation, staff or contractor confidentiality duties and contractual safeguards with providers.

No internet-based service can be guaranteed to be completely secure. Users should choose a strong password, keep credentials confidential and notify us promptly if they suspect unauthorised access.

15.1 Right to be informed

You have the right to receive clear information about how we collect and use personal data. This Privacy Policy is intended to provide that information.

15.2 Right of access and right to receive a copy

You may ask us to confirm whether we process personal data about you and to provide a copy of all personal data we hold about you, together with supporting information required by law, such as the purposes of processing, categories of data, recipients or categories of recipients, retention information, data sources and relevant safeguards for international transfers. Requests should be sent by email to hello@okletsplay.uk with the subject line “Subject Access Request”.

A copy will normally be supplied electronically in a commonly used format unless you reasonably request another format. This right generally relates to your own personal data and may be limited where disclosure would adversely affect the rights and freedoms of another person.

15.3 Right to rectification

You may ask us to correct inaccurate personal data or complete information that is incomplete.

15.4 Right to erasure

You may ask us to delete personal data in certain circumstances. This right is not absolute, and we may retain information where there is a lawful reason to do so.

15.5 Right to restrict processing

You may ask us to restrict the way we use personal data in certain circumstances, for example while accuracy or a legal objection is being considered.

15.6 Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may have the right to receive personal data you provided in a structured, commonly used and machine-readable format or ask us to transmit it to another controller where technically feasible.

15.7 Right to object

You may object to processing based on legitimate interests. We will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your rights or the processing is needed for legal claims. You have an absolute right to object to direct marketing.

15.8 Right to withdraw consent

Where processing relies on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

15.9 Right to complain

You may complain to us about how we handle personal data. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. We would appreciate the opportunity to address your concern first, but you are not required to contact us before approaching the ICO.

ICO website: ico.org.uk | Telephone: 0303 123 1113

To exercise any privacy right, including requesting a copy of all information we hold about you, email hello@okletsplay.uk. Please describe the request clearly and identify the account involved.

We may ask for reasonable information to verify your identity and protect personal data from unauthorised disclosure. We will not ask for more information than is necessary for verification.

We will respond within the period required by applicable law. Under the UK GDPR, this is normally one month after receiving a valid request, although the period may be extended where a request is particularly complex or numerous. We will explain any permitted extension.

Requests are normally handled free of charge. We may charge a reasonable fee or refuse a request only where permitted by law, including where a request is manifestly unfounded or excessive.

If you provide information about another person, including a child or family member, you confirm that you are authorised to provide it, that it is relevant and limited to what is necessary, and that doing so does not infringe that person’s rights.

You should consider whether a nickname and age bracket are sufficient, keep the information accurate, remove it when it is no longer needed and explain the use of the Service to the person concerned in an age-appropriate way where reasonable.

Only adults aged 18 or over may create an OK Let’s Play account. The Service is not intended to be used independently by children, and we do not knowingly permit children to create accounts or subscribe to marketing communications.

Where an adult creates a family profile, we encourage the use of a nickname, age bracket, interests and only the minimum information about relevant needs. Users should not enter school details, addresses, contact details, photographs or other directly identifying information.

If we become aware that a child has provided personal data directly without appropriate authority, we may delete or restrict that information and close the relevant account. Concerns should be sent to hello@okletsplay.uk.

We take reasonable steps to ensure that personal data is accurate and kept up to date. Users can help by keeping account details current and correcting or deleting outdated family-profile information.

We seek to collect and retain only the personal data that is adequate, relevant and limited to what is necessary. Users should follow the same principle when completing optional fields or prompts.

The Service may contain links to third-party websites, app stores or services. Those organisations operate independently and may collect personal data under their own privacy notices. We are not responsible for their privacy practices, and users should review the relevant notice before providing personal data.

If all or part of our business is sold, merged, reorganised or transferred, personal data may be disclosed or transferred as part of that transaction. Any recipient will be required to use personal data consistently with applicable law and appropriate confidentiality and data-protection safeguards.

We may update this Privacy Policy to reflect changes to the Service, technologies, providers, legal requirements or our privacy practices. The latest version will be published through the website or application and will state the date of the most recent update.

Where a change is significant, we will provide an appropriate notice, which may include email or an in-app notice. We will not use personal data for a materially different purpose without first providing the information required by law and identifying an appropriate lawful basis.

Questions, privacy requests or complaints may be sent to:

Appendix A – Third-party service providers

The providers below support the operation of OK Let’s Play. The exact data processed by each provider depends on the features used and the applicable service configuration. Provider privacy notices may change over time; the current notice should be reviewed directly on the provider’s website.

We require service providers acting as processors to handle personal data only on documented instructions, apply appropriate security, support data-subject rights and deletion obligations, assist with security incidents where required, and provide appropriate safeguards for any restricted international transfer.