How Little Spaces uses your information.

Who is responsible

Little Spaces is responsible for the account and website information described here:

For customer booking information, the business named on the booking page is normally the controller and Little Spaces acts as its processor under the Data Processing Agreement.

What we collect

When you create an account, we collect your name, work email, business name, optional contact number and separate marketing preference. During setup and use, we store the business profile, authorised team members, availability, booking records, settings and a limited security and activity history.

Secure sign-in links, verification state and essential session records protect account access. If a Little Spaces plan is started, we store Stripe customer and subscription references, plan status and relevant renewal or trial dates; Stripe handles payment details.

For basic funnel measurement, we store only daily totals for actions such as a landing-page visit or form start. These totals do not contain an email address, IP address, cookie identifier or visitor profile. To prevent abuse, we temporarily use a cryptographic hash derived from connection information for rate limiting; it expires automatically and is not used to identify or profile visitors.

Why we use it

We use account and workspace details to verify access, provide the service, support setup, secure each business workspace and administer a Little Spaces plan. This is necessary to take steps you request before entering a contract, perform the service contract, and pursue our legitimate interests in operating and improving a secure booking platform.

If you actively tick the optional product-news box, we use your work email for those messages on the basis of your consent. You can withdraw that consent at any time by contacting us or using an unsubscribe option in a message. Your choice does not affect your account.

Passkeys and account recovery

Business owners and platform administrators use a passkey and save one-use recovery codes to protect their private workspace. We use Hanko to register and verify passkeys, sending an opaque account identifier and the technical information needed for that check. Hanko processes credential identifiers, public keys, authenticator information and related security records. We do not send booking details, your Little Spaces password or recovery codes to Hanko.

Your device or passkey provider protects the private key. Little Spaces and Hanko do not receive your fingerprint or face scan. Little Spaces stores protected recovery-code hashes and limited passkey, session and recovery records to check access and prevent a code being used twice.

Who processes it

Our hosting, database, authentication, transactional-email and payment providers process information only to operate and secure Little Spaces. We do not sell account-holder information. See our subprocessor list for the service categories used by the platform. Where a provider processes information outside the UK, we review the transfer mechanism and contractual safeguards available.

Private operational reports

Authorised business managers can view aggregate reports of their own bookings and payment confirmations. The private platform-owner report uses business codes and totals to understand operational usage, reliability and subscriptions. It does not display customer names, contact details, children’s details or booking notes. We retain business-level daily booking and staff-appointment counts for 24 months, and a business’s first observed confirmation while its workspace exists, to measure usage separately from subscription billing. These counts do not contain customer or booking identifiers and are not used to track visitors across websites.

How long we keep it

An unverified sign-up is deleted after 30 days. Account, subscription and business-workspace information is kept while the service is active and then only as long as needed for security, legal, accounting and support purposes. Customer booking records follow the retention periods explained on each business’s booking privacy notice; reporting does not extend those periods. Anonymous daily funnel totals and private business-level daily operational counts are deleted after 24 months.

Your choices and rights

You may ask for access to your personal information, correction, deletion, restriction, portability where applicable, or object to processing based on legitimate interests. You may withdraw marketing consent at any time. Contact privacy@littlespaces.co.uk to make a request.

If you are unhappy with how we handle your information, you can also complain to the Information Commissioner’s Office.

Anonymous booking-page activity

We keep daily totals for views of a business’s public booking page and the first booking form opened on each page load. Each business can see its own totals separately from Little Spaces marketing figures. These counters contain the business identifier, calendar day, event type and count—not names, contact or child details, form contents, referral URLs, private booking links or visitor identifiers. We do not use cookies, browser storage, advertising pixels or cross-site profiles for these counters. We honour supported Do Not Track and Global Privacy Control signals for these optional booking-page events. Separate security rate limiting still protects public requests.

Cookies and tracking

The public marketing and sign-up pages do not use advertising pixels, cross-site tracking or non-essential cookies. Essential security and signed-in session technology is used in private parts of the service.