Privacy Policy
Effective date:
1. Who we are
Totchi is a children’s audio storytelling service operated by Mindset Marvels Ltd.
Mindset Marvels Ltd is the data controller for all personal data processed in connection with the Totchi service and website.
Detail | Information |
|---|---|
Company name | Mindset Marvels Ltd |
Company number | 16339374 |
Registered address | 1 Flitchside Drive, Little Canfield, Dunmow, England, CM6 4AA |
ICO registration | C1909966 |
Data Protection Officer | Sophie Jackson |
DPO email | |
General contact |
This Privacy Policy explains how we collect, use, and protect personal data when you use the Totchi app or visit our website at totchi.com. Please read it alongside our Children’s Privacy Notice, which provides additional information about how we handle data relating to children.
The Totchi service is available to users in the United Kingdom. We do not currently accept subscriptions from users outside the UK.
2. What data we collect and why
2.1 Parent and carer account data
When you create a Totchi account, we collect and process the following information about you as the account holder:
Data | Purpose |
|---|---|
Name | To personalise your account and address you in communications |
Email address | Account creation, login, subscription management, and service communications |
Subscription status and history | To manage your access to the Totchi service and verify entitlement |
App store subscription reference | To link your Totchi account with your Apple In-App Purchase or Google Play subscription |
Device identifiers (iOS and Android) | To associate your account with your device for offline access and background playback |
We do not collect payment card details. All billing is handled by Apple or Google in accordance with their terms and privacy policies.
2.2 Child profile data
You may create child profiles within your Totchi account. We apply strict data minimisation to all data held about children. For each child profile, we collect only:
Data | Purpose |
|---|---|
Profile nickname | A label chosen by you to identify the profile within the app. You are guided to use a nickname rather than your child’s real name — this is optional and at your discretion. |
Age group (Minis or Older) | To determine which story content is appropriate for your child. Selected by you — not inferred automatically. |
Listening progress | To maintain sequential story unlocking within topics and allow the child to resume where they left off |
We do not require the child’s real name, date of birth, contact details, location, photograph, or any biometric data. Children do not register directly and cannot create their own accounts. All profiles are created and managed by you as the parent or carer.
Full details of how we handle children’s data are in our Children’s Privacy Notice.
2.3 Usage and technical data
We may collect limited technical data to maintain and improve the service:
Data | Purpose |
|---|---|
App crash and error logs | To identify and fix technical issues |
Device type and operating system version | To ensure compatibility and support troubleshooting |
We do not use in-app analytics SDKs for behavioural tracking within the Totchi app.
2.4 Website analytics data
Our marketing website at totchi.com uses Google Analytics 4 (GA4) to understand how visitors use the site. This applies only to the marketing website — not to the mobile app. See Section 10 for full details.
2.5 Marketing communications
If you opt in at account creation, we will send you occasional emails about new stories, features, and Totchi updates. This is entirely optional — you can opt in or out at any time, and opting out does not affect your subscription or service access.
Service-related emails (subscription confirmation, payment receipts, policy update notices) are sent regardless of marketing preference, as they form part of delivering the service you have subscribed to.
2.6 Support and contact data
If you contact us for support or with an enquiry, we will collect and process the information you provide (name, email, message content) to respond to you and, where relevant, to improve the service.
3. Legal bases for processing
Processing activity | Legal basis |
|---|---|
Creating and managing your parent account | Article 6(1)(b) — Performance of a contract |
Managing your subscription and verifying entitlement | Article 6(1)(b) — Performance of a contract |
Creating and maintaining child profiles | Article 6(1)(b) — Performance of a contract (you as the contracting party; your child as the beneficiary) |
Storing listening progress | Article 6(1)(b) — Performance of a contract |
Sending service-related communications (e.g. subscription confirmations, policy updates) | Article 6(1)(b) — Performance of a contract; or Article 6(1)(c) — Legal obligation where required by law |
Responding to support enquiries | Article 6(1)(f) — Legitimate interests (responding to users who contact us) |
Maintaining audit logs | Article 6(1)(f) — Legitimate interests (security, fraud prevention, compliance) |
Sending marketing emails (new stories, features, Totchi updates) — opt-in only | Article 6(1)(a) — Consent. You may withdraw at any time via the unsubscribe link in any email. |
Website analytics (GA4) | Article 6(1)(a) — Consent (via cookie banner) |
Technical crash and error logging | Article 6(1)(f) — Legitimate interests (maintaining a functional, secure service) |
Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms. You have the right to object to processing based on legitimate interests — see Section 8.
We do not use consent as the legal basis for processing account or subscription data. If you withdraw consent for analytics cookies, that does not affect the processing necessary to deliver your subscription.
4. Children’s data
Totchi is a service designed to be used by children under parental supervision. We take children’s privacy extremely seriously and apply the standards of the ICO Age Appropriate Design Code (UK Children’s Code).
Key principles we apply to children’s data:
Data minimisation: We collect only age group and listening progress. We do not collect names, dates of birth, contact details, or location for children.
No profiling: We do not build behavioural profiles of children or use their data for commercial profiling or targeted advertising.
No tracking: Analytics and tracking tools are not active in the mobile app or on any page accessible to children.
Privacy by default: All settings default to the most privacy-protective option.
Parental control: All child profile data is managed by the parent or carer. Children cannot register independently.
No geolocation: We do not collect location data for children.
Our Children’s Privacy Notice provides the full detail required by the Children’s Code, including a child-friendly summary and complete parent-facing information.
5. Third parties and data sharing
We do not sell your personal data or share it with third parties for their own marketing purposes. We share data only in the circumstances below.
5.1 Cloudflare
Our platform infrastructure is provided by Cloudflare, Inc. Cloudflare processes data on our behalf as a data processor. This includes our web application firewall (WAF), content delivery network, cloud storage (R2) for audio files, and access controls. A Data Processing Agreement is in place. For more information, see Cloudflare’s Privacy Policy.
5.2 Apple
Subscription billing for the Totchi app on iPhone and iPad is handled by Apple via In-App Purchase. Apple processes payment data directly and is an independent data controller for billing transactions. Totchi does not receive or store your payment card details. For more information, see Apple’s Privacy Policy.
5.3 Google Play
Subscription billing for the Totchi app on Android is handled by Google via Google Play Billing. Google processes payment data directly and is an independent data controller for billing transactions. Totchi does not receive or store your payment card details. For more information, see Google’s Privacy Policy.
5.4 Google Analytics
Our marketing website uses Google Analytics 4 (GA4), which processes pseudonymised usage data on our behalf. This applies to the website only — not the app. GA4 data is only collected with your consent, via the cookie banner. For more information, see Google’s Privacy Policy.
5.5 Legal disclosure
We may disclose personal data where required to do so by law, court order, or regulatory authority, or where necessary to protect the rights, property, or safety of Mindset Marvels Ltd, our users, or others.
5.6 Business transfers
If Mindset Marvels Ltd is acquired, merged, or its assets transferred, personal data held by us may be transferred as part of that transaction. We will notify affected users before their data is transferred and becomes subject to a different privacy policy.
6. International transfers
Mindset Marvels Ltd is based in England. Your data is stored on infrastructure provided by Cloudflare and may be processed in data centres located in the UK, European Economic Area (EEA), or the United States.
Where data is transferred outside the UK, we ensure appropriate safeguards are in place:
Cloudflare: Transfers are covered by the UK’s International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs), and Cloudflare’s UK GDPR-compliant data processing terms.
Google (Google Play and Google Analytics): Google LLC is certified under the EU-US Data Privacy Framework and has in place SCCs for UK transfers. GA4 is configured with IP anonymisation.
Apple: Apple’s data processing is covered by SCCs and Apple’s UK GDPR-compliant terms.
7. How long we keep your data
Data category | Retention period |
|---|---|
Parent account data (name, email) | Duration of active account + 30 days following account deletion request |
Child profile data (age group, listening progress) | Duration of active account + 30 days following account deletion request |
Subscription and payment history | 7 years from the date of the transaction, for financial and legal compliance purposes |
Audit log entries | 12 months from the date of the logged event |
Support correspondence | 24 months from the date of the last contact, unless longer retention is required for an active dispute |
Website analytics data (GA4) | 14 months (Google Analytics default retention, configured at account level) |
Crash and error logs | 90 days from the date of the event |
When data reaches the end of its retention period, it is securely and permanently deleted. We do not retain data longer than necessary.
Deleting your account will trigger the deletion of all personal data except where retention is required by law (e.g. financial transaction records). See our account deletion page for instructions.
8. Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
Right | What it means |
|---|---|
Right of access | You can request a copy of the personal data we hold about you (a “subject access request”). |
Right to rectification | You can ask us to correct inaccurate or incomplete personal data. |
Right to erasure | You can ask us to delete your personal data. Some data may be retained where we have a legal obligation to do so. See also our account deletion page. |
Right to restriction | In certain circumstances, you can ask us to restrict the processing of your data (e.g. while you contest its accuracy). |
Right to data portability | Where processing is based on consent or contract and carried out by automated means, you can request your data in a structured, machine-readable format. |
Right to object | You can object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds. |
Rights related to automated decision-making | We do not use automated decision-making or profiling that produces legal or similarly significant effects. |
Right to withdraw consent | Where we rely on consent (e.g. analytics cookies), you can withdraw it at any time without affecting the lawfulness of prior processing. |
To exercise any of these rights, please contact: [email protected] or write to us at the registered address above.
We will respond to rights requests within one calendar month of receipt, in line with UK GDPR requirements. We do not charge a fee for rights requests unless they are manifestly unfounded or excessive.
Right to complain
If you are not satisfied with how we handle your personal data or respond to a rights request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Website: ico.org.uk
Phone: 0303 123 1113
Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would welcome the opportunity to resolve any concern directly before you contact the ICO.
9. Security
We take the security of your personal data seriously and have implemented appropriate technical and organisational measures, including:
All data transmission is encrypted via HTTPS/TLS
Audio files are stored securely and served only via short-lived authenticated URLs — never via public permanent URLs
Access to our internal admin systems is protected by Cloudflare Zero Trust
All significant data actions are written to an append-only audit log
Secrets and credentials are held outside source code
File uploads are validated for type, extension, and size before being processed
No system is completely secure. If you believe your account has been compromised, or you are aware of a potential security vulnerability, please contact us immediately at [email protected].
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO in accordance with our obligations under UK GDPR Article 33/34.
10. Cookies and analytics
The Totchi mobile app does not use cookies.
Our marketing website at totchi.com uses cookies, including analytics cookies set by Google Analytics 4 (GA4). A cookie consent banner is shown on your first visit. Analytics cookies are only set with your explicit consent — optional categories are not pre-ticked.
Key points about our use of GA4:
Data is collected in anonymised or pseudonymised form and does not identify you personally
IP anonymisation is enabled
Advertising features and cross-site tracking are disabled
GA4 cookies are never active on any page accessible to children
Full details — including a complete list of cookies, their purposes and durations — are in our Cookie Policy.
You can manage or withdraw cookie consent at any time via the Cookie settings link in the footer of any page on totchi.com.
11. Changes to this policy
We may update this Privacy Policy from time to time — for example, when we change our data practices, introduce new features, or when the law changes.
When we make changes:
The effective date shown at the top of this page will be updated
If the changes are material, we will notify you by email before they take effect
Where required by law, we will seek your renewed consent before the changes take effect
We recommend you review this policy periodically. Continued use of the Totchi service after the effective date of any changes constitutes acknowledgement of the updated policy.
12. Contact and complaints
For any questions about this Privacy Policy, or to exercise your data rights, please contact:
Data Protection Officer
Sophie Jackson, DPO — Mindset Marvels Ltd
Email: [email protected]
Phone: 07972048669
Post: 1 Flitchside Drive, Little Canfield, Dunmow, England, CM6 4AA
General enquiries: [email protected]
ICO Registration: C1909966 · ico.org.uk