Privacy Policy
Last updated: 24 March 2026
Privacy Policy
Growing Bright Minds Last updated: March 2026
1. Who We Are
Growing Bright Minds is a parenting and early childhood education content platform.
For any privacy-related enquiries or to exercise your rights, contact: office@growingbrightminds.com
2. What Personal Data We Collect and Why
2.1 Browsing the site (unauthenticated)
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, browser type, operating system | Security, fraud prevention, server logs | Legitimate interest (Art. 6(1)(f)) |
| Pages visited, referral source | Site operation, performance monitoring | Legitimate interest (Art. 6(1)(f)) |
2.2 Analytics (only with your consent)
| Data | Purpose | Legal basis |
|---|---|---|
| Page views, scroll depth, clicks, session data | Understanding content performance and user behaviour | Consent (Art. 6(1)(a)) |
| Device type, browser, approximate location (country/region) | Product improvement | Consent (Art. 6(1)(a)) |
Analytics are collected via PostHog (EU Cloud) and Google Analytics 4 only if you accept analytics cookies. If you decline, no analytics cookies are set. PostHog operates in cookieless mode for declined-consent users.
2.3 Newsletter subscription
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Sending newsletters and content updates | Consent (Art. 6(1)(a)) |
| Name (optional) | Personalising emails | Consent (Art. 6(1)(a)) |
Subscription requires double opt-in confirmation. You may unsubscribe at any time via the link in every email.
2.4 User account (Google Sign-In)
| Data | Purpose | Legal basis |
|---|---|---|
| Google email address, display name, profile photo | Account creation and authentication | Contract / legitimate interest (Art. 6(1)(b)/(f)) |
Sign-in is handled via Google OAuth. We do not store your Google password.
2.5 Comments
| Data | Purpose | Legal basis |
|---|---|---|
| Comment text, timestamp | Publishing your community contribution | Contract (Art. 6(1)(b)) |
| Email address (not displayed publicly) | Reply notifications (if enabled) | Legitimate interest (Art. 6(1)(f)) |
3. Third-Party Processors
We use the following third-party processors to operate the platform. Each has a Data Processing Agreement in place where required:
| Processor | Role | Location | Safeguard |
|---|---|---|---|
| Supabase | Database, authentication, file storage | EU / US | DPA, SCCs |
| Vercel | Website hosting and serverless functions | US | DPA, SCCs |
| PostHog | Product analytics | EU (Frankfurt) | EU data residency |
| Google (Analytics 4) | Acquisition analytics | US | DPA, SCCs, Consent Mode v2 |
| Google (OAuth / Search Console) | Sign-in, search data | US | DPA, SCCs |
| Resend | Transactional and newsletter email | US | DPA, SCCs |
| OpenAI | AI-assisted content drafting (operator-side only) | US | DPA, SCCs |
User personal data is not shared with OpenAI. AI agents operate on editorial content only, under the operator's control.
4. Children's Data
This platform is directed at parents and early childhood educators. We do not knowingly collect personal data from children under the age of 13. If you believe a child has submitted data through this platform, contact us immediately at office@growingbrightminds.com and we will delete it promptly.
5. AI-Generated Content
Articles on this platform may be drafted with AI assistance (OpenAI GPT-4o). All AI-generated content is reviewed and approved by the human operator before publication. No fully automated decisions are made about users. See our AI Transparency Notice for full details.
6. Data Retention
| Data type | Retention period |
|---|---|
| Newsletter subscriber data | Until you unsubscribe |
| User account data | Until account deletion is requested |
| Comments | Until deletion is requested or account is deleted |
| Analytics data | Per PostHog and GA4 retention settings (PostHog: 1 year; GA4: 14 months default) |
| Server logs | 30 days |
Consent cookie (gbm_consent) | 365 days (renewed on preference change) |
7. Your Rights Under GDPR
As a data subject, you have the following rights:
- Access — request a copy of the personal data we hold about you
- Rectification — request correction of inaccurate data
- Erasure — request deletion of your data ("right to be forgotten")
- Portability — receive your data in a structured, machine-readable format
- Restriction — request that we limit how we process your data
- Objection — object to processing based on legitimate interest
- Withdraw consent — where processing is based on consent, you may withdraw at any time without affecting prior processing
- Complaint — lodge a complaint with the Danish Data Protection Authority (Datatilsynet): www.datatilsynet.dk
To exercise any right, email: office@growingbrightminds.com. We will respond within 30 days.
8. Security
We implement appropriate technical and organisational measures to protect your data, including encrypted transmission (HTTPS/HSTS), database-level Row Level Security policies, and access controls limiting data access to authorised personnel only.
9. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated to registered users by email. The "last updated" date at the top of this page reflects the most recent revision.