Privacy Policy

1.Our commitment

Cuddle & Sing handles personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We collect only what we need to run safe, enjoyable classes and to manage your bookings, and we never sell personal information.

Booking only needs a parent’s name and email and your child’s first name. Everything else — date of birth, health notes, photo and marketing permissions, birthday celebrations — is optional.

2.What we collect

About you (the parent or carer):

• Name, email address and, if you choose, a mobile number.
• Your bookings, payments, refunds, credits, gift cards and referrals.
• Your choices about notifications, photos, marketing and birthday celebrations, and when you made them.
• Messages you send us, for example through the contact form.

About your child:

• First name (last name optional) and the classes they attend, including attendance and make-ups.
• Date of birth, if you choose to give it — it helps us suggest the right age group and, if you opt in, celebrate their birthday. It is never shown publicly.
• Allergy, medical or other safety notes, if you choose to provide them. This is sensitive information, so we only collect it with your consent — see our medical and allergy information notice.

When you visit the website:

• Essential cookies that keep you signed in, remember your cookie choices and remember a referral link you followed (for 30 days).
• If you allow them, analytics and advertising cookies (Google Analytics and Meta Pixel) that tell us how visitors find and use the site. See “Cookies and analytics” below.

We don’t collect your full card number — Stripe handles card details on its secure payment page.

3.How we use it

• To take bookings and payments, hold places, and send confirmations, receipts, reminders and important class changes.
• To run classes safely: class rosters, attendance, make-ups, and essential allergy or health alerts for the teacher.
• To manage credits, gift cards, referrals, waitlists and next-term bookings.
• To answer your questions and handle requests or complaints.
• With your separate permission only: to include your child in class photos or videos we share, to celebrate your child’s birthday in class, and to send you news and offers.
• To understand and improve the website (only with your analytics consent), and to keep our systems secure, prevent fraud and meet legal, tax and accounting obligations.

Booking confirmations and other service messages are sent whatever your marketing choice. We never put health notes or dates of birth in routine emails, and never send them to analytics or advertising services.

4.Where it’s stored and how we protect it

We use trusted service providers to run the website and the Family App:

• Supabase — our database and sign-in service, where family, child and booking records are kept.
• Stripe — payment processing. Stripe holds your card details; we receive only a payment reference and receipt.
• Amazon Web Services (AWS) — sending emails and text messages.
• Vercel — hosting the website and Family App.
• Upstash — short-lived technical data used to keep the site fast and to limit abuse, such as counting repeated sign-in attempts from an IP address or email address. It doesn’t hold family records.

Information is encrypted in transit (HTTPS) and at rest with these providers. Access to child and health information is limited to people who need it, by role, and changes to consents, payments and refunds are logged. Staff sign in securely, and the owner account uses multi-factor authentication where available.

Where we can choose, we keep data in Australia (Sydney). Some providers — including Stripe, Vercel, Google, Meta and our email-list and contact-form providers — may store or process information overseas, including in the United States. We choose providers with strong security and privacy commitments and take reasonable steps so they handle information consistently with the APPs.

5.Who we share it with

• The service providers listed above, only for the services they provide to us.
• Your child’s teacher: a private class roster with first names, attendance, opted-in birthday reminders and only essential allergy or health alerts.
• Mailchimp and Resend, if you join our waiting list or send a contact form message, to manage the list and pass your message to us.
• Google Analytics and Meta, only if you accept those cookies, and never with names, emails, dates of birth or health information.
• Professional advisers, insurers or authorities where required or permitted by law (for example, to deal with an emergency or a legal claim).

We don’t sell or rent personal information, and we never publish a child’s date of birth or health information.

6.Cookies and analytics

The first time you visit, you can choose which optional cookies to allow. You can change your mind at any time with the “Cookie settings” link at the bottom of every page.

• Essential (always on): sign-in session cookies for the Family App, your cookie choice, and a referral code from a friend’s link (kept for 30 days so it can be applied when you book).
• Analytics (optional): Google Analytics 4, to see which pages are useful and where people get stuck when booking.
• Marketing (optional): Meta Pixel, to measure whether our Facebook and Instagram ads lead to bookings.

Analytics and advertising events describe pages and bookings in general terms (for example “began checkout” or “purchase, $28”). They never include your name, email, your child’s name, date of birth or health information. If you decline, the site and booking work exactly the same.

7.How long we keep it

• Booking, payment and refund records: for as long as Australian tax and consumer laws require (at least five years after the transaction).
• Consent records (what you agreed to and when): for as long as we hold your account and the related records, so we can show what was agreed.
• Allergy and health notes: only while they are needed to keep your child safe in class. You can update or remove them at any time in the Family App.
• Contact form messages and waiting-list details: until they’re no longer needed to respond to you or you unsubscribe.

When information is no longer needed, we delete it or de-identify it, unless the law requires us to keep it.

8.Access, correction and deletion

You can see and update most of your family’s details, children, health notes and permissions yourself in the Family App.

You can also ask us for a copy of the personal information we hold about you or your child, to correct it, or to delete it. Use “Your data” on the Family page of the Family App, or email us. We’ll confirm who you are, respond within a reasonable time (usually within 30 days) and explain if any information must be kept by law — for example payment records.

Withdrawing a permission (photos, marketing or birthday celebrations) takes effect from then on and never affects your bookings.

9.Children’s information

Children don’t use our website or Family App themselves; a parent or carer provides and controls their information. We keep child information to the minimum needed, don’t use it for advertising, and never infer photo permission from attendance.

10.Questions and complaints

If you have a question or a concern about how we have handled your personal information, please email us at hello@cuddleandsing.com.au. We’ll acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

If we ever have a data breach that is likely to cause serious harm, we will notify affected families and the OAIC as required by law.

11.Changes to this policy

We’ll update this policy when our practices change. The version and date at the top show which version is current, and we record which version you acknowledged when you booked.