1. Who we are
Namesake Stories is a trading name of Dijkstrack LTD, registered in England and Wales under company number 15308611.
Our registered address is 3rd Floor 86–90 Paul Street, London, England, EC2A 4NE.
Dijkstrack LTD is the data controller responsible for deciding how your personal information is used.
Contact us about privacy or your information at privacy@namesakestories.com, or write to our registered address.
This policy covers our website, family accounts, personalised books and connected games, including namesakestories.com and christmas.namesakestories.com.
2. Information we collect
Accounts and sign-in
We process your email address, account identifier, email-verification status and information needed to manage sign-in.
We use Clerk for authentication. If you sign in using a social account, the provider may share information such as your name, email address and profile image, depending on the permissions involved. Our application uses your account identifier, email address and verification status.
Passwords entered through Clerk are handled by Clerk rather than sent to our application API.
Child profiles
We collect basic details about your child: their first name and age in years, such as “John, 6”. We do not ask for their surname or date of birth.
We also store the character options you choose: boy or girl, hairstyle, hair colour, eye colour, skin tone, clothing colour and cat or dog companion. These choices do not have to match your child’s actual appearance.
Our current personalisation form does not request a child’s email address or photograph.
Purchases and payments
We keep records of the products selected for each child, prices, VAT, payment references, payment status and order history.
For personalised books, we retain the details needed to produce the version you purchased.
Stripe processes payments. We do not receive or store your full card number or card security code. Stripe may collect payment, billing and fraud-prevention information during checkout.
Book delivery
For book orders, we collect the recipient’s name, address lines, city, postcode and country.
We do not request a delivery address for game-only orders. Stripe may still require billing information to process payment.
Game information
We process character settings, purchased game access, game-launch records and saved progress. Saved progress may include checkpoints, in-game location, play time and other information needed to resume a game.
Preferences, enquiries and technical information
We keep your communication preferences and information you send when contacting us.
Our services and providers also process technical information, such as IP addresses, browser and device information, request times and error records, to deliver and protect the service.
3. How and why we use information
| Purpose | Legal basis |
|---|---|
| Manage your account, purchases, delivery and related support | Performance of our contract with you, or steps you request before entering a contract |
| Personalise children’s products, set an initial level of challenge and save game progress | Legitimate interests in providing the personalised service requested by a parent or guardian, balanced against the child’s rights |
| Maintain required accounting and tax records | Legal obligation |
| Protect accounts, prevent fraud and investigate technical faults | Legitimate interests in operating a secure, reliable service |
| Send optional news and offers | Consent |
| Use optional Google Analytics tracking | Consent |
| Keep a record of consent or an unsubscribe request | Legitimate interests in demonstrating and respecting your choices, and applicable legal obligations |
Where we rely on legitimate interests, we assess necessity and the effect on you and your child.
Some information is necessary to provide an account, personalised product or delivery. Without it, we may be unable to provide that part of the service. Marketing and analytics are optional.
Age-based challenge settings can be changed in the game. They do not constitute a decision producing legal or similarly significant effects.
4. Children’s information
Parents or guardians manage family accounts, purchases and child profiles.
Children’s information is used to provide their personalised books and games. We do not use child profiles to target advertising or send marketing directly to children.
Children have their own data-protection rights. Parents or guardians can contact us on their behalf, and we consider the child’s understanding and circumstances when responding.
5. Cookies and analytics
We use cookies and similar technologies that are strictly necessary for sign-in, security and shopping functionality. These do not require consent. Session storage also helps retain your basket and quotation while you use the website.
Optional analytics are off by default. With your consent, we use Google Analytics on public website pages to understand traffic and interactions, including pages visited, referral sources, and browser and device information.
We do not use Google Analytics in the children’s game or account area. We do not send children’s names, character details, email addresses or delivery addresses to Google Analytics.
You can accept or reject optional analytics and change your choice through Cookie settings. Rejecting analytics does not prevent purchases or sign-in.
Our Cookie policy provides further details.
6. Email communications
You can separately choose whether to receive news and offers.
You can withdraw consent through your account preferences, the unsubscribe link in a marketing email, or by contacting us. Withdrawal does not affect processing carried out lawfully before that point.
We may still send necessary messages about account security, purchases, delivery or changes affecting your service.
7. International processing
We use AWS to host our website, API and database. Other providers may process information outside the UK, including in the United States.
Where required, international transfers are covered by recognised safeguards, such as UK adequacy regulations or approved contractual safeguards, including the UK International Data Transfer Addendum.
Contact us for information about the safeguards relevant to your data and how to obtain a copy.
8. How long we keep information
The following periods apply to information in systems we control.
| Information | Retention period |
|---|---|
| Accounts with ongoing purchased game access | While needed to provide that access. After 3 years without account or game activity, we review whether continued retention is necessary and contact you before making changes. We do not automatically cancel purchased access solely because of inactivity. |
| Accounts with no purchases | 12 months after the last account activity, followed by 30 days’ notice before deletion if there is no further activity. |
| Child profiles with no purchased products | 12 months after the profile was last used or updated, followed by 30 days’ notice before deletion. |
| Profiles and saves associated with purchased games | While needed to provide the game service, or until you request deletion. |
| Book-only child profiles | 12 months after the latest book delivery or subsequent profile activity, followed by 30 days’ notice, unless another purchase requires the profile. |
| Closed accounts and valid requests to delete child profiles | Removed from our active systems within 30 days, except information we must retain for the purposes explained below. |
| Personalised book PDFs and order-specific character snapshots | 90 days after delivery, or after cancellation if the order is not fulfilled. |
| Delivery addresses in operational records | 12 months after delivery, or cancellation for unfulfilled orders. |
| Necessary accounting and transaction records | 6 years from the end of the company financial year to which they relate, or longer where the law requires. |
| Abandoned quotations and unpaid checkout records | 30 days after expiry or cancellation, once payment status has been reconciled. |
| Routine support correspondence | 12 months after the enquiry is resolved. |
| Routine technical logs and game-launch history | 30 days. |
| Security logs | 90 days. |
| Evidence of marketing consent and changes | While relied upon, then 6 years after withdrawal or the last marketing message sent under that consent, whichever is later. |
| Unsubscribe records | A minimal record is kept while we operate the relevant mailing list, to prevent unwanted messages. |
| Backups | A rolling period of up to 35 days. |
Google Analytics is configured to retain user-level and event-level data for 2 months, with retention reset on new activity disabled. Google deletes expired data through its monthly process. Standard aggregated reports are not governed by that setting.
We may retain particular records longer where necessary for an unresolved complaint, payment dispute, security incident or legal obligation. We restrict their use and review retention when that reason ends.
Deleting active records does not immediately remove copies from backups. Backup copies remain protected until they expire. If a backup is restored, we reapply relevant deletions before returning the restored data to ordinary use.
Our providers may retain information under their own contractual, backup or legal requirements. We pass on deletion requests where appropriate and explain any applicable exceptions.
9. Who receives information
We share relevant information with:
- Clerk, for authentication and account security.
- Stripe, for payments and payment security.
- AWS, for website, API and database hosting.
- Lulu and its printing and delivery partners, to produce and deliver personalised books.
- Resend, to deliver service emails and marketing you have requested.
- Google, for optional website analytics.
Lulu receives the personalised print files, which contain the child’s chosen first name and character, and information needed to fulfil the order. Delivery partners receive information needed for delivery.
Providers acting on our behalf process information under our instructions and applicable data-processing agreements. Some providers, including Stripe for certain regulated payment activities, also act independently for purposes explained in their privacy notices.
We may share information with professional advisers or authorities where necessary to meet legal obligations or establish, exercise or defend legal claims.
10. Your rights
Depending on the circumstances, you can ask to access, correct, delete or restrict use of your information, receive certain information in a portable format, or object to processing based on legitimate interests.
You can object to direct marketing at any time and withdraw consent where we rely on it.
Contact privacy@namesakestories.com. We may need to verify your identity and your authority to act for a child. We normally respond within one month, subject to applicable legal exceptions.
You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. You do not have to contact us first.
11. Changes to this policy
We update this policy when our services or use of information changes. We will update its date and bring significant changes to your attention where appropriate.