Data map, retention & lawful basis
Last updated: 27 September 2026
A simple record of every piece of personal data in CloseKin Play. MyCloseKin LTD is the controller.
| Data | Why | Where stored | Who can access | When deleted | Article 6 basis |
|---|---|---|---|---|---|
| Parent email & password | Create and secure the account | Our cloud (UK/EU hosting) | Account holder; MyCloseKin LTD staff for support | Within 30 days of account deletion request | Contract |
| Trial start date | Run the 14-day free trial | Our cloud | Account holder; MyCloseKin LTD | With the account | Contract |
| Subscription status & Paddle IDs | Unlock Family Access | Our cloud | Account holder; MyCloseKin LTD | 6 years after subscription ends (tax records) | Contract; legal obligation |
| Payment card, billing address, invoices | Take payment, tax, invoicing | Paddle (Merchant of Record) | Paddle | Under Paddle's privacy policy | Contract; legal obligation |
| Child & adult profiles (nickname, avatar, age band) | Personalise play and pick suitable cards | This device only | People using the device | Until the parent resets or clears browser data | Legitimate interests (set up by parent) |
| Play progress (cards seen, adventures, realms) | Show the journey and avoid repeating cards | This device only | People using the device | Until the parent resets or clears browser data | Legitimate interests |
| Theme & accessibility settings | Remember display preferences | This device only | People using the device | Until cleared | Legitimate interests; PECR strictly necessary |
| Sign-in session token | Keep the parent signed in | This device | The browser | On sign-out or expiry | Contract; PECR strictly necessary |
| IP address & security logs | Security and fraud prevention | Hosting / cloud provider | MyCloseKin LTD; providers | Up to 90 days | Legitimate interests |
| Support messages | Answer questions | Email inbox | MyCloseKin LTD | 2 years after last contact | Legitimate interests |
| Conversation answers | — | NEVER collected | Nobody | Not applicable | Not processed |
Lawful-basis notes
Contract (Art. 6(1)(b)) covers the parent's account, trial and subscription — we need this data to provide what the parent signed up for.
Legitimate interests (Art. 6(1)(f)) covers profiles and progress kept on the device. The data is minimal, set up by the parent, never leaves the device and clearly benefits the family. We have balanced this against children's interests and found low risk.
Legal obligation (Art. 6(1)(c)) covers keeping tax and payment records.
Consent is not relied on. Because we do not rely on a child's consent, the UK GDPR Article 8 parental-authorisation rule for under-13s is not triggered. If we ever add processing that relies on consent (for example marketing or optional analytics), we will obtain it from a parent and update this record.
Internal record prepared following ICO guidance; not legal advice.