Privacy policy

Who we are

Pencilpace (pencilpace.com) is run by ThirteenTabs Ltd, company number 17326399, registered office 167-169 Great Portland Street, Fifth Floor, London W1W 5PF, England. We are the data controller. Contact: privacy@pencilpace.com.

The short version

We collect as little as possible about children: at most a first name you choose to print on the sheets. Nothing else about the child.
Free sample sheets are made in your browser. Nothing you type there is sent to us.
Your email is used to deliver your pack, for one feedback request about two weeks into the term, and, only if you tick the box on the free sheet page, for at most one email a month.
We delete packs, names and emails 12 months after purchase, and unpaid checkouts after 30 days.
Before ordering opens, you can ask to be told when it does: we then keep your email, the pack you set up and when you agreed, only to send you that one email. The entry is deleted 30 days after the email if you do not order, or after 6 months if ordering has not opened by then.
No advertising cookies, no selling or sharing of data for marketing. Analytics cookies only if you allow them.

What we collect and why

12-week pack order: grade, level, language, paper size, start date and the optional first name to print. Lawful basis: performance of a contract (UK GDPR art. 6(1)(b)). The first name is entered by the parent, guardian or teacher, who confirms that role at checkout.
Email address: from the checkout or the order form, to send the download link and answer support questions (contract), and from the sign-up box only if you tick it (consent, art. 6(1)(a)).
Waitlist (only while ordering is not open yet): if you tick the box asking to be told when ordering opens, we store your email address, the pack you set up (grade, level, language, paper size, start date and the optional first name to print, entered by the parent, guardian or teacher) and the time you agreed. We use them for one thing: a single email when ordering opens, with a link straight to payment for that pack. Lawful basis: consent (art. 6(1)(a)), which you can withdraw at any time. Nothing else is sent to that address.
Payment: handled by Lemon Squeezy, Paddle or Stripe (the checkout shows which), as merchant of record. We receive the order number, amount, currency and email; never card details. When Paddle runs the checkout, Paddle's script (Paddle.js) loads on our checkout page (/pay/) to show the payment form.
Placement check answers stay in your browser and are not sent to us.
Feedback: if you answer our feedback request, we store your rating, comment and level answer with your order (legitimate interests, art. 6(1)(f): improving the sheets). We publish a comment on the site only if you tick the box allowing it, and only with the name you choose to show, if any.
Analytics cookies: only if you click “Allow analytics”, we use Google Analytics 4 to count page views and steps of the order form (consent, art. 6(1)(a)). It is not loaded before you agree, IP addresses are truncated, and advertising features are off. If you allowed analytics and then buy a pack, our server also reports that purchase to Google Analytics once the payment is confirmed (order number, pack, price and currency, linked to the analytics identifier in your browser), so it is counted once even if you close the page; we then delete that identifier from your order. Without your consent nothing about your purchase is sent to Google. If you do not complete the payment, we delete that identifier at our next weekly clean-up. The report is sent once, when the payment is confirmed; withdrawing consent after you have started the checkout does not stop that single report. You can change your choice at any time with “Analytics settings” at the bottom of every page.
Server logs and, if enabled, Cloudflare Web Analytics: cookieless, aggregated page statistics (legitimate interests, art. 6(1)(f)).
On this device, the order form keeps your choices in your browser’s session storage until you close the tab, so they survive a trip to the checkout and back. Nothing of this is sent to us until you continue to payment or ask to be told when ordering opens.

Children

Pencilpace is for parents, guardians and teachers, not for children to use alone. We do not create accounts for children, we do not ask children for information, and we do not profile them. If you think a child has given us information, write to privacy@pencilpace.com and we will delete it.

Who processes data for us

Where data leaves the UK or EU, these providers rely on adequacy decisions or standard contractual clauses.

Supabase (database, file storage and functions; servers in the EU).
Lemon Squeezy, Paddle or Stripe (payments, tax and receipts; merchant of record).
Cloudflare (website hosting and, if enabled, cookieless analytics).
Resend (sending the download, feedback and waitlist emails, from hello@updates.pencilpace.com; replies go to hello@pencilpace.com).
Google (Google Analytics 4, only if you allow analytics cookies, including the purchase report described above).

How long we keep it

Packs (the PDF), the child’s first name and your email are deleted 12 months after purchase by an automatic weekly job. Unpaid checkouts are deleted after 30 days. Order records needed for tax keep only non-personal fields after that. Feedback you did not allow us to publish is deleted with your order; published feedback stays on the site until you ask us to remove it. Sign-up emails are kept until you unsubscribe. Waitlist entries are deleted by the same weekly job 30 days after the “ordering is open” email if you did not order, or 6 months after you joined if ordering has not opened by then; if you do order, the entry becomes your order and the rules above apply.

Your rights

You can ask for a copy of your data, its correction or deletion, restriction, portability, or object to processing, and withdraw consent at any time, by writing to privacy@pencilpace.com. To leave the waitlist, reply to our email or write to privacy@pencilpace.com and we delete the entry straight away. You can also complain to the Information Commissioner’s Office (ico.org.uk) or your local data protection authority.

Changes

This is version 2026-10-24. We record which version you accepted with each order.