Privacy Policy

Little Roots Montessori is based in South Africa and operates littlerootsmontessori.co.za and the Little Roots Play mobile app. For data-protection purposes we are the responsible party (under South Africa's POPIA) and the data controller (under the UK and EU GDPR).

Your account. Your email address and a securely hashed password, or — if you use Google sign-in — the email address and basic profile Google shares with us. Optionally a display name, the role you chose (parent, nanny, teacher and so on), and a faith preference if you set one.

About the child you plan for. A first name or nickname, date of birth, and the answers you give during setup: what you'd like to focus on, how much time you usually have, when you tend to play, what materials you have at home, and whether you have outdoor space.

What you choose to record. Notes and any photos or videos you upload as Learning Stories, along with which activities were planned, completed or saved.

Basic technical information. Our hosting provider logs standard request data such as IP address and browser type for security and reliability.

• We do not run advertising of any kind.
• We do not use third-party analytics or tracking. There are no third-party trackers, pixels or advertising SDKs in the site or the app. We record a small number of our own product events — that onboarding was finished, that a page was opened — stored in our own database and never shared. They contain no names, birthdates or anything your child said or made.
• We do not sell, rent or share your information — or your child's — with anyone for their own purposes.
• We do not build advertising profiles, and we do not track you across other websites or apps.

• To create and secure your account.
• To generate a programme suited to your child's age and your circumstances — this is what the date of birth and setup answers are for.
• To store the Learning Stories you create, so you can look back on them.
• To send you essential service emails such as sign-in links, confirmations and password resets.
• To keep the service working, diagnose faults and prevent abuse.

Under GDPR our lawful bases are performance of a contract (running the service you signed up for) and our legitimate interests in keeping it secure. Where we rely on consent — an optional faith preference, for example — you can withdraw it at any time by changing or clearing that setting.

Little Roots is designed for adults. Children do not create accounts, do not sign in, and cannot be contacted through the service. Any information about a child is entered by their parent, guardian or an adult caregiver acting with the parent's permission, and is visible only to that account.

We ask for a first name and a date of birth only. The name is so the app can address your child properly; the date of birth is so activities match their stage. You are welcome to use a nickname and an approximate date — nothing breaks.

We do not knowingly collect information directly from children. If you believe a child has provided us information directly, contact us and we will delete it.

We use a small number of service providers, and only to run the product. They process data on our instructions and may not use it for their own purposes.

• Supabase — database, authentication and file storage. Data is hosted in the EU (Ireland).
• Google Firebase App Hosting — serves the website and app backend.
• Google — only if you choose to sign in with Google, and only to authenticate you.
• Resend — sends service emails such as sign-in links.

Because our providers operate internationally, your information may be processed outside South Africa or your own country. Where that happens we rely on the providers' standard contractual clauses and equivalent safeguards.

For as long as your account is open. Delete your account and we remove your profile, your children's profiles, your Learning Stories and any uploaded media. Backups are overwritten on a rolling basis and anything remaining there is purged within 30 days. We may retain a minimal record where the law requires it.

You can delete your Little Roots account and everything in it at any time. In the app, open Profile and choose Delete account. On the website, the same option is in your account settings.

You can also email info@littlerootsmontessori.co.za from your registered address and we will delete it within 30 days.

Deletion is permanent. Learning Stories and photos cannot be recovered afterwards, so download anything you want to keep first.

You may ask us to show you what we hold, correct anything wrong, delete it, or give you a copy in a portable format. You may object to processing or ask us to restrict it. Exercising these rights costs nothing and will never affect your service.

If you are unhappy with how we've handled your information you can complain to South Africa's Information Regulator, or to your local supervisory authority if you are in the UK or EU.

Connections are encrypted in transit. Passwords are hashed, never stored in a readable form, and are not visible to us. Access to your data is enforced at the database level by row-level security, so one account cannot read another's records. Uploaded photos are stored in a private bucket, not on a public URL.

No system is perfect. If a breach affects your information we will tell you and the relevant regulator without undue delay.

If we change this policy materially we will update the date above and tell you by email or in the app before the change takes effect. Continuing to use Little Roots after that means you accept the updated policy.