Privacy Policy

Memory Robin Ltd ("Memory Robin", "we", "us", "our") respects your privacy. This Privacy Policy explains how we collect, use, store and share personal data when you visit memoryrobin.com, register your interest in our pilot, or otherwise get in touch with us.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO).

1. Who we are

Data Controller: Memory Robin Ltd, a company registered in England and Wales under company number 17145244.

Registered address: 8 Southolme Close, Boroughbridge, North Yorkshire, YO51 9AU.

ICO registration number: ZC130820

Contact: info@memoryrobin.com for general privacy enquiries. Requests to exercise your data rights (see Section 8) can be sent to the same address with the subject line "Data subject request".

2. What personal data we collect

We only collect the data you voluntarily share with us through the website. Specifically:

When you complete a contact or pilot registration form

• Your name
• Your email address
• Your location (if provided)
• Your interest area (e.g. pilot family, partnership, press enquiry)
• Your family situation, including children's ages, if you choose to share this
• The content of your message or additional notes

When you visit the website

• Anonymised technical data collected by our hosting provider, including IP address, browser type, device type and pages visited. This is used solely to keep the website running securely and to understand broad traffic patterns.

We do not currently use third-party analytics cookies (for example, Google Analytics). If this changes, we will update this policy and, where required, seek your consent. See our Cookie Policy for more detail.

3. Why we use your data, and our lawful basis

We only process personal data where we have a lawful basis to do so under UK GDPR. Our bases are:

• Consent — when you submit a form, you are giving us consent to respond to your enquiry and, where relevant, to consider you for our pilot or wider programmes. You can withdraw consent at any time by emailing info@memoryrobin.com.
• Legitimate interests — to operate, secure and improve the website, and to maintain records of enquiries we receive and responses we send. Our legitimate interest is running a safe, responsive service for the families and partners who contact us.
• Legal obligation — to meet our obligations under applicable laws, including responding to lawful requests from regulators or authorities.

4. Who we share your data with

We do not sell your data. We share it only with a small number of trusted service providers that help us run the website and respond to you:

• Netlify, Inc. — our website hosting and forms provider. Netlify may store your form submission on its servers, including servers located outside the UK (primarily in the United States and EU). Netlify is certified under the EU-US Data Privacy Framework and provides contractual safeguards that meet UK GDPR requirements for international data transfers.
• Email and communication tools (such as our inbox provider) — to receive, store and respond to your messages. Providers are chosen to meet appropriate UK and EU data protection standards.

Where we use providers based outside the UK, we rely on UK-approved safeguards such as the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses, and — where applicable — the UK Extension to the EU-US Data Privacy Framework.

We will only share your data with a third party if we are legally required to (for example, by a court order), or if you have asked us to (for example, to connect you with a specific charity partner).

5. How long we keep your data

We keep personal data only for as long as we need it:

• Enquiry and pilot interest data — kept for up to 24 months from our last contact with you, unless you ask us to delete it sooner or you become an active pilot participant, in which case a separate retention schedule (shared with you on onboarding) will apply.
• Business and tax records — kept for 6 years as required by UK tax law.
• Security logs — kept for a short period by our hosting provider, in line with their retention policies, to help detect and investigate abuse.

6. Children's data

Memory Robin's website is intended for adults (aged 18 and over). We do not knowingly collect personal data from children through the website.

Pocket Robin — our companion app for children aged 5 to 16 — will be a separate product with its own consent model, designed around UK GDPR and the ICO's Age Appropriate Design Code ("Children's Code"). Pocket Robin is not yet live. When it is, a child's access is always initiated and supervised by a verified parent, guardian or appointed trusted adult, and we will publish a dedicated Children's Privacy Notice before any child uses the service.

7. How we keep your data secure

We take reasonable technical and organisational measures to protect your data, including:

• HTTPS encryption on the website
• Limiting staff access to personal data on a need-to-know basis
• Using reputable third-party providers with recognised security standards
• Reviewing our security practices regularly as we build out the platform

No system is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required, and we will contact you directly if the breach is likely to result in a high risk to you.

8. Your data rights

Under UK GDPR, you have the following rights:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct data that is wrong or incomplete
• Erasure — ask us to delete your personal data, subject to certain exemptions
• Restriction — ask us to limit how we use your data in certain situations
• Portability — ask us to provide your data in a portable format or send it to another provider
• Objection — object to our processing where we rely on legitimate interests
• Withdraw consent — where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, email info@memoryrobin.com. We will respond within one month. There is no charge for most requests.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to address your concerns first, but you can complain to the ICO at any time.

9. Cookies

Memory Robin uses a minimal set of functional items on this website, including essential cookies and similar technologies. Full details are in our Cookie Policy.

10. Links to other websites

Our website links to external organisations such as Child Bereavement UK, Cruse and Samaritans. This Privacy Policy only applies to memoryrobin.com. Those third parties have their own privacy policies.

11. Changes to this policy

We will update this Privacy Policy as Memory Robin grows — for example, when new platforms (Guardian Robin, Pocket Robin) come online, or if we start working with new service providers. When we make significant changes we will update the "last updated" date above and, where appropriate, contact you directly.

12. Contact us

Questions about privacy, your data, or this policy? Email info@memoryrobin.com.