Privacy Policy: Animal Bonds

Last updated: 14/05/2026 Effective from: 14/05/2026

This Privacy Policy explains how Animal Bonds (“we”, “us”, “our”) collects, uses, and protects information when you or your child uses our website at animalbonds.co.uk and the Animal Bonds web application at play.animalbonds.co.uk (together, the “Service”).

Animal Bonds is operated by Franklin Works, a sole trader based in the United Kingdom. Our address of record is Walkford, BH23 5LS. You can contact us at hello@animalbonds.co.uk.

We are the data controller for personal data processed via the Service, except where a school has signed a Data Processing Agreement with us, in which case the school is the controller and we are the processor for pupil data.

1. Who this policy is for

This policy is written for parents, guardians, teachers, and adult users. The Service is designed for children aged 5 to 11, but we do not expect children to read this document themselves.

2. What information we collect

We collect the minimum information necessary to provide the Service.

From children using the game

For each pupil we store one name that the school gives us, plus a second name that the game generates automatically:

A real name entered by the school administrator. The recommended format is first name plus surname initial (for example, “Alex S.”). This is enough for the child’s teacher or linked parent to identify them, but not enough for anyone else to. The pupil cannot set or change this, and the pupil never sees their own real name on the Service. The real name appears only on adult-facing surfaces: teacher dashboards, school admin records, and linked parent dashboards.
A display name automatically generated by the Service at first sign-in (an animal-and-noun combination, e.g. “OtterRiver” or “FoxMeadow”). This is the name the pupil uses on the Service: what they see for themselves and what other pupils see during multiplayer races and on shared leaderboards. The school administrator can change a pupil’s display name if the auto-generated combination becomes unsuitable.

We also collect:

A class or year group, set by the school, so that pupils can be organised into and identified by their class
Gameplay data: which questions were answered, whether the answer was correct, time taken, and similar performance metrics
A randomly generated player ID (separate from the names above; used internally)
Basic device information: browser type, screen size, and operating system (used to make the game work correctly on different devices)

We do not collect from children:

Email addresses
Postal addresses
Phone numbers
Photographs or videos
Voice recordings
Location data beyond country-level for service delivery
Information about parents, family, or friends

From parents and adult users

A name (visible only on your own profile and to your school administrator)
Information about which child profiles you are linked to

We do not collect personal email addresses from parents. Access to the parent dashboard is provided by login credentials issued by the school administrator.

From teachers and school staff

A name and role
The school you are associated with
Information about which class profiles you manage

We do not collect personal email addresses from teachers. Access is provided by login credentials issued by the school administrator.

From school administrators

A name (full name recommended)
The school they administer
Login credentials for the admin console

Automatically collected

Pages visited on the marketing site. We use Vercel Web Analytics, which is cookieless and does not track individuals or follow you across other sites. The data we see is aggregated, such as page views and device type. See our Cookie Policy for detail.
Errors and crashes (used to fix bugs)
Approximate country-level location based on IP address (used for service delivery and not stored)

3. Why we collect it (legal basis)

Under UK GDPR, we must have a lawful basis for each type of processing.

Purpose	Lawful basis
Providing the game to children	Contract (with the school)
Tracking gameplay progress	Contract; legitimate interests (improving the Service)
Maintaining adult login accounts	Contract
Bug reporting and crash analytics	Legitimate interests
Compliance with legal obligations	Legal obligation

4. How we use your information

To provide and personalise the game (including adapting question difficulty)
To save progress so children can continue where they left off
To show parents and teachers their child’s or pupils’ progress
To fix bugs and improve the Service
To respond to support enquiries
To comply with legal and regulatory obligations

We do not use the information for:

Advertising of any kind
Profiling for marketing
Sale or sharing with data brokers
Any purpose unrelated to running the Service

Multiplayer and name visibility

Pupils have two names on the Service: a real name (entered by the school admin) and an auto-generated display name (e.g. “OtterRiver”).

The pupil themselves sees only their own display name. Their real name is not shown to them anywhere in the Service.
Teachers and school administrators see both names on their dashboards.
Linked parents see both names for their own child on the parent dashboard.
Other pupils in any multiplayer mode see only display names. Pupils’ real names are never shown to other pupils.

We share data only with the small number of service providers needed to run the Service.

Provider	Purpose	Location	Safeguards
Vercel Inc.	Hosting	USA, with EU edge	Standard Contractual Clauses; UK addendum
Supabase Inc.	Database and authentication	EU (London/Ireland)	Hosted in UK/EU; SCCs apply
Stripe (when payments active)	Payment processing	UK/EU	UK GDPR-compliant; we do not see card details

We will never share children’s personal data with any party not listed above without first updating this policy and notifying parents and schools.

6. International transfers

Where personal data is transferred outside the UK, we rely on the UK’s adequacy regulations or the Standard Contractual Clauses with the UK Addendum, as required by UK GDPR.

7. How long we keep your data

Data	Retention period
Active player profiles	While the account is active, plus 30 days after deletion request
Gameplay data	12 months rolling, unless the parent or school requests longer
Adult account data	While the account is active, plus 12 months
Support correspondence	24 months
Anonymous, aggregated analytics	Indefinitely (no longer personal data)

You have the right to:

Access: request a copy of the personal data we hold about you or your child
Rectify: ask us to correct inaccurate data
Erase: ask us to delete your data
Restrict: ask us to stop processing your data in certain circumstances
Port: receive your data in a portable format
Object: object to processing based on legitimate interests
Withdraw consent: at any time, where consent is the basis for processing
Complain: to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113

To exercise any of these rights, email hello@animalbonds.co.uk. We respond within 30 days.

9. Children’s rights

Children have the same rights as adults under UK GDPR. Parents or guardians exercise these rights on behalf of under-13s. We comply with the ICO’s Age Appropriate Design Code (Children’s Code).

10. Security

We protect data with:

Encryption in transit (HTTPS everywhere) and at rest (database encryption)
Access controls
Regular software updates
Logging and alerting for unusual activity

If a breach occurs that is likely to result in a risk to your rights, we will notify the ICO within 72 hours and notify you without undue delay.

11. Changes to this policy

We will update this policy from time to time. The “Last updated” date at the top tells you when. Significant changes will be communicated to school administrators and posted prominently in the parent and teacher dashboards for 30 days.

12. Contact

For any privacy questions, contact:

Franklin Works, Walkford. BH23 5LS hello@animalbonds.co.uk

The Information Commissioner’s Office:

ico.org.uk
0303 123 1113