Privacy Policy

Merrikin is operated by Merrikin Learning Ltd, a company registered in England and Wales under company number 15989372. Our registered office is Suite 2, Unit 1b, Pope Iron Road, Worcester, Worcestershire, United Kingdom, WR1 3HB.

For UK data protection law, Merrikin Learning Ltd is the controller of the personal information described in this policy.

Website. https://merrikinlearning.com

Privacy enquiries, data-rights requests and customer support. support@merrikinlearning.com

This policy covers adults who visit Merrikin, join the waitlist, request the free checklist, opt into marketing, contact us, purchase the Founding Family offer or later use the Merrikin membership service. The launch journey is for adults aged 18 or over. Children are not expected to complete the form, buy the offer or communicate with Merrikin directly.

Adult identity and contact information. First name, last name and email address, plus information entered in the contact form or sent to support.

Relationship and interest information. For example, whether you are a parent, carer, practitioner or another type of user and the option that best describes you.

Limited child-related information. The child’s exact date of birth. The waitlist does not request the child’s name, photograph, address, health information, diagnosis, special educational needs, milestone results or nursery or school records.

Choice and evidence records. Waitlist status; submission date, time and source; marketing choice; the wording and versions of notices, Privacy Policy and Terms shown; digital-supply and future-billing agreements; and unsubscribe or suppression records.

Purchase and payment information. Amount, currency, transaction status, billing details where requested, Stripe customer, Checkout Session, Payment Intent and payment-method references, fraud results, refunds and duplicate-order controls. Merrikin does not receive a full card number or security code.

Founding Family and membership information. Founding Family status, guide fulfilment, the three complimentary months from launch, launch and activation dates, saved-payment authority, subscription status, renewal and cancellation history and related communications.

Communications and feedback. Contact-form messages, emails, support requests, complaints, survey responses and handling notes. Please do not send child health, safeguarding or other sensitive information through a general form unless Merrikin specifically asks for it and explains why.

Technical, security and analytics information. IP/request and security data; browser and device type; broad location; referrer; page and event data; consent choice; pseudonymous identifiers; performance measurements; and suspected abuse or fraud. Cookieless Vercel analytics and performance information, and short-lived Vercel runtime logs used to diagnose errors and protect the service, may be processed by default. Consent-controlled analytics is described in section 9. Runtime logs must not deliberately contain form values, names, email addresses, child information, private offer tokens, payment data or Stripe identifiers.

Email delivery information. Whether an email was sent, delivered, delayed, bounced, complained about or unsubscribed from. Resend open-and-click tracking is disabled at launch.

The DOB may relate to an identifiable family, so Merrikin treats it as the child’s personal information as well as information supplied by the adult. We use it to calculate age, understand the age ranges represented on the waitlist, plan an age-appropriate service and make adult-facing information more relevant.

The exact DOB is stored in Neon. It is also included in the signup notification sent through Resend to an authorised Merrikin administrative email address so that Merrikin can administer the waitlist. Where the adult separately opts into marketing, Merrikin may use the DOB to tailor adult-facing emails, such as early-years tips, to the child’s age. The child’s DOB is not sent to PostHog, GA4, Vercel Analytics, Stripe, advertising platforms or email engagement tracking. We do not market directly to the child or use the DOB to make solely automated decisions with legal or similarly significant effects.

If Merrikin later introduces child profiles, milestone tracking, personalised recommendations or nursery-home sharing, we will update this policy before collecting the additional information, assess the impact on children and introduce appropriate safeguards.

Most information comes directly from you when you complete a form, place an order, select a choice or contact us. Child-related information comes from the adult, not directly from the child. We also receive payment and fraud information from Stripe; operational email events from Resend; consented analytics from PostHog and GA4; cookieless aggregate traffic and performance information from Vercel; security information from Cloudflare Turnstile; and information from advisers, authorities or service providers where necessary and lawful.

Where we rely on legitimate interests, we assess necessity and balance Merrikin’s interests against the rights and reasonable expectations of the people affected, including the particular protection due to children’s information.

Service emails include the free checklist, waitlist confirmation, order receipt, Parent Guide delivery, launch and activation information, pre-charge reminders, renewal or payment information, cancellation confirmation and security or legal notices. They are sent to fulfil or administer a request or contract and do not require marketing consent.

Merrikin is not sending marketing emails at launch. If marketing begins, early-years tips, Merrikin news, product updates and occasional offers will be sent only where the adult has actively opted in. The checkbox is separate, optional and unticked. Marketing may be tailored to an age band derived from the child’s DOB. Future marketing emails will include an unsubscribe link, and consent can also be withdrawn by emailing support@merrikinlearning.com. This will not remove the waitlist place or stop essential service messages. Merrikin may keep a minimal suppression record to honour the opt-out.

Resend open-and-click tracking is disabled at launch. Merrikin still processes operational delivery, bounce, complaint, unsubscribe and suppression events to deliver messages and protect its sending reputation. If engagement tracking is enabled later, this policy and the relevant email information will be updated first and any consent required by law will be obtained.

Neon is the sole live database for the launch journey. The Merrikin Production project is hosted in London and stores the launch waitlist, consent, purchase, fulfilment and membership records described in this policy.

The database is designed to keep one adult/contact record for an email address while allowing separate child records and separate submissions. A later submission for a second child must not overwrite the first child’s DOB. Marketing consent history is preserved with its wording, status, source and timestamp. The exact DOB is stored in Neon and is included in the signup notification sent through Resend to an authorised Merrikin administrative email address. It is not passed to analytics, advertising, payment or email-engagement tracking services.

PostHog visitor analytics and Google Analytics 4 (measurement ID G-L4FRE1SFK2) operate only after the visitor accepts Analytics. Rejecting, closing or ignoring the banner means those optional visitor-analytics features are not activated. Limited server-side error reports may still be sent to PostHog Cloud EU where necessary to detect and diagnose faults; these reports do not use optional analytics cookies or browser storage and are not used to build visitor profiles. Vercel Web Analytics and Vercel Speed Insights may operate by default as cookieless tools that provide aggregate traffic and page-performance information. Cookie choices can be changed later through “Cookie settings”.

PostHog may use its own random pseudonymous first-party identifier to connect a consenting visitor’s waitlist-to-purchase journey. Person profiles remain disabled. PostHog does not receive names, email addresses, child information, form values, marketing choices, email-delivery status, existing-customer flags, payment details, order references or Stripe identifiers. A purchase-completed event may contain the offer name and version, amount and currency, together with the pseudonymous PostHog identifier. Any short-lived reconciliation link is deleted after use.

After consent, PostHog heatmaps, privacy-safe autocapture and session recording may be used on approved Merrikin launch pages. All form fields are masked. Stripe Checkout, confirmation, account, database and administration pages are excluded. Console recording and network-body capture are disabled. Individual recordings are retained on a rolling basis for no longer than 30 days.

GA4 receives consented page, source, device and core conversion-event information but not form content or direct identifiers. A purchase event may include the offer, amount and currency and, if needed to prevent duplicate counting, a random analytics-only transaction reference that is not a Stripe reference or Merrikin customer-facing order reference. Merrikin does not use GA4 User-ID at launch. Vercel Web Analytics uses an anonymised request-derived visitor hash for short-term counting and discards it after 24 hours. Speed Insights provides anonymous technical performance measurements. Neither Vercel tool is intended to set analytics cookies, use browser storage to recognise visitors or create a persistent Merrikin visitor profile. Search Console provides aggregate search visibility and does not track a visitor through the Merrikin website merely because they visit.

Strictly necessary hosting, form, private-offer, security and checkout processing may operate without Analytics consent. Cloudflare Turnstile protects the waitlist, contact and checkout-entry forms from automated abuse. Further details are in the Cookie Policy.

Merrikin uses selected providers and professional support to run the launch journey. They receive only the information reasonably needed for their role. Where they act as processors, Merrikin requires appropriate contractual and security protections.

Merrikin does not sell personal information and does not permit providers to use Merrikin customer or child-related information for unrelated advertising.

Neon is hosted in London and PostHog Cloud EU is configured in Frankfurt. Some other providers or their subprocessors may process information outside the United Kingdom, including in the European Economic Area and the United States. Where UK law requires safeguards, Merrikin relies on an applicable UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another lawful mechanism, together with appropriate risk and security measures.

You can contact support@merrikinlearning.com for more information about safeguards relevant to your information.

Merrikin keeps identifiable information only for as long as reasonably needed for the stated purpose, legal obligations or legal claims. The periods below are the normal maximums; information may be deleted sooner or retained longer where the circumstances or law require it. Where Merrikin controls the record, the applicable expiry or deletion rule is enforced automatically or through a scheduled deletion process, subject to legal holds and the normal backup lifecycle.

Merrikin may keep genuinely anonymised statistics for research, reporting, product planning and service improvement without a fixed period because they no longer identify anyone.

Merrikin uses proportionate safeguards including encrypted transmission, restricted role-based access, account security, provider due diligence, backups, audit or access records where available and incident-response procedures. Production access is limited to named people with a current need, and developer or contractor access is removed when no longer required. The authorised Merrikin administrative email account is restricted to authorised users and protected by two-factor authentication. Full payment-card details must never be copied into Neon, email or Merrikin systems.

If a personal-data breach creates a risk to people, Merrikin will assess and document it and notify the ICO and affected individuals where the law requires. No online system can guarantee absolute security.

Merrikin does not use personal information to make solely automated decisions with legal or similarly significant effects on adults or children. Calculating an age band, preventing duplicate records and automating the launch journey are administrative functions, not significant decisions. Stripe may use automated payment and fraud-prevention systems under its own privacy information.

Depending on the circumstances and lawful basis, you may have rights to be informed; access personal information; correct inaccurate or incomplete information; request deletion or restriction; receive certain information in a portable form; object to processing; and withdraw consent. The right to object to direct marketing is absolute. Children also have rights over their information, although a parent or carer may exercise them in appropriate circumstances.

Deletion is not absolute. Merrikin may retain limited information to comply with law, honour a marketing opt-out, handle security or fraud or establish, exercise or defend legal claims. To exercise a right, email support@merrikinlearning.com. Merrikin may request proportionate identity and authority evidence, particularly for a request concerning a child, and normally responds within one month subject to any lawful extension.

Please contact support@merrikinlearning.com first so Merrikin can try to resolve the concern. You also have the right to complain to the Information Commissioner’s Office.

ICO complaint information: https://ico.org.uk/make-a-complaint | Telephone 0303 123 1113

Merrikin may update this policy when the service, providers, analytics or law changes. If a new use materially affects existing personal information, Merrikin will bring it to affected people’s attention before the new use begins and obtain consent where required. When this policy is amended after launch, the replacement will receive a new version number and this v1.0 policy will remain available as the previous version.