Privacy Policy

What We Collect

We collect account details such as name, email address, password credentials, purchases, subscription status, credit balances, saved classroom work, approximate registration country and basic activity records. Legacy Bubble account data is imported only where it supports account access, entitlement, analytics, customer support or compliance. When a new account is created, we may retain limited registration attribution such as campaign source, referring domain and landing page path. Full referring URLs and arbitrary query parameters are not stored on the account.

How We Use Data

We use personal data to provide accounts, manage purchases and subscriptions, protect access to paid resources, support customers, improve the site and understand aggregate usage. Marketing email preferences are stored separately from operational emails.

Analytics and Cookies

For signed-in accounts, we keep the most recent time the account used the service. The previous time is overwritten, and this basic activity check does not record the page, resource, search, form contents or student information. We use it to provide customer support and understand whether a reported problem is continuing. This limited operational record does not use an additional analytics cookie or browser identifier. We process it on the basis of our legitimate interests, subject to your right to object.

We use limited audience measurement to understand aggregate page use and improve the website. Our first-party counters are grouped by day and do not store a visitor, session or account identifier, a full URL, form contents or search text. Where local rules permit an opt-out model, aggregate site analytics may operate by default and you can object at any time using the setting below. In consent-led regions, including the EEA, it remains off unless it is enabled. Google Analytics advertising features are disabled, and we do not send your name or email address to Google Analytics. Where Google Analytics is enabled, it may store an identifier such as _ga in your browser for up to 30 days.

Detailed account journey analytics is separate. In jurisdictions that require consent, including the UK and EEA, it remains off unless you expressly enable it. Where local rules permit an opt-out model, it may operate by default. Our own records of schemes, lesson plans, resources and tools viewed, and print dialogs opened, may be connected to your signed-in account so authorised staff can improve the service and investigate support problems. We do not collect form contents, search text, student information or arbitrary URL query parameters in these records. These account-linked records are not sent to Google Analytics. You can switch this history off at any time here or in your Account page; switching it off stops future collection.

Legacy Import Data

The legacy user import excludes old access codes, verification tokens, QR payloads, geo address fields and raw user journey IDs. Imported analytics are stored as aggregate counts where possible, with retention review dates for legacy metadata.

Sharing and Processors

We use service providers for hosting, email delivery, payments and application data storage, including Google Analytics for limited audience measurement where enabled. Payment details are handled by the payment provider rather than stored directly in this application.

Your Rights

You can ask to access, correct, delete, restrict or receive a copy of your personal data, and you can object to processing based on our legitimate interests. You can also withdraw analytics or marketing consent at any time. Contact the site administrator using the published Drama Lesson Plans contact details to make a request.

Retention and Security

We keep personal data only for as long as needed for account access, legal, financial, support and analytics purposes. Account-linked journey records and admin-only import fields are restricted to authorised staff, and passwords are stored using the authentication system rather than in plain text.

Further Guidance

For independent information about UK data protection rights, see the Information Commissioner's Office.