This Privacy Policy explains how Nora’s Lantern Care (“Nora’s Lantern”, “we”, “us”, “our”) collects, uses, shares, retains and protects personal data when you use the Nora’s Lantern website and platform (the “Platform”).

Nora’s Lantern is the data controller for the personal data described in this Policy. Our contact details are in Section 17 below.

This Policy should be read alongside our Terms & Conditions. Section 13 of this Policy is our Cookie Policy.

The Platform is for adults only. Parents/guardians and nannies registering an account must be 18 or over. Children are never Platform users and never have their own account — the only information we hold that relates to a parent’s children is what that parent chooses to tell us about their childcare needs (see Section 3), never the children’s names or other directly identifying details.

Account data: name, email address, a securely hashed password (we never store your actual password — see Section 8), account role (parent or nanny), and account status.

Nanny profile data: location, experience, qualifications, languages, availability, rates, a CV, a verification photo, and right-to-work documentation. These documents are collected specifically to support the safeguarding checks described in our Terms & Conditions (Section 8/25) and are stored and handled as described in Sections 6 and 9 below.

Parent childcare preferences: number of children, their age range, the type of childcare arrangement wanted, schedule, and any notes you choose to add — never a child’s name or other identifying details.

Messages: the content of messages sent through the Platform’s messaging feature between parents and nannies.

Payment data: a record that a payment was made, its amount, status and Stripe reference IDs. We never receive or store your card details — those are collected directly by Stripe, our payment processor (Section 6).

Technical and security data: IP address, session identifiers, and timestamps of security-relevant events (logins, failed login attempts, password changes), used to keep accounts secure and to detect abuse.

Consent records: a timestamped record of when you accepted our Terms & Conditions and this Privacy Policy, and the IP address that acceptance came from.

Directly from you — when you create an account, complete your profile, upload a document, send a message, or make a payment. We do not buy personal data from third parties or data brokers.

• To provide the Platform (creating your account, showing nanny profiles to parents, enabling messaging, processing payments) — necessary to perform our contract with you (the Terms & Conditions you accept when you register).
• For safeguarding, fraud prevention and security (reviewing nanny verification documents, detecting suspicious activity, enforcing our contact-details policy, keeping security logs) — our legitimate interest, and that of our users, in keeping the Platform safe, weighed against your privacy rights.
• To meet legal obligations (retaining payment records for UK tax and accounting law, responding to lawful requests from authorities) — necessary for legal compliance.
• Consent — recorded when you accept our Terms & Conditions and this Privacy Policy. You can withdraw consent by closing your account (Section 10), though some data must still be retained where we have a legal basis independent of consent (e.g. financial records).

We do not use your personal data for advertising, and we do not carry out any automated decision-making or profiling that produces legal or similarly significant effects on you — see Section 12.

We share personal data only where necessary to run the Platform:

• Stripe (payment processing) — receives what’s needed to process a payment. Stripe is a PCI-DSS compliant payment processor; we never see or store your full card details.
• Our file storage provider — stores nanny verification documents (CV, verification photo, right-to-work) in a private bucket. Files are never publicly accessible; every download goes through a short-lived, individually generated link.
• Nora’s Lantern staff/administrators — access is role-restricted (see our Admin security documentation) so, for example, general support staff cannot see verification documents, and only staff handling verification can review them.
• Legal/regulatory bodies — where we’re required to by law, or to protect the safety of a child, nanny or parent (see our Terms & Conditions, Section 25, Safeguarding Concerns).

We do not sell personal data, and we do not share it with advertisers or data brokers.

Where any of the providers in Section 6 process data outside the UK, we will only do so on a lawful transfer basis — for example the UK’s adequacy regulations or Standard Contractual Clauses — and will keep this section updated to reflect our actual hosting and storage providers once finalised.

Passwords are never stored in plain text — they’re hashed using scrypt, a modern, salted hashing algorithm. Verification documents are stored in a private (non-public) bucket, accessible only via short-lived signed links generated on demand. Administrator accounts require two-factor authentication and are restricted by role, so staff only ever see the data their role needs. Traffic to the Platform is encrypted (HTTPS), and we apply a set of browser security controls (including a strict Content-Security-Policy) to reduce the risk of common web attacks. A fuller technical account of our security posture is maintained internally and reviewed regularly.

Active accounts: we keep your data for as long as your account is active and you use the Platform.

Inactive accounts: if an account has had no login activity for 12 months, we anonymise it — your name and email are replaced with non-identifying values and the account is marked inactive. Nanny verification documents (CV, verification photo, right-to-work) are permanently deleted at this point, not just anonymised.

Payment records: kept for 6 years after the tax year they relate to, independent of what happens to the associated account, to meet UK financial record-keeping obligations (Companies Act 2006 / HMRC requirements). These records are never deleted early, including at your request — Section 10 explains how the right to erasure applies here.

Messages: retained so the other party to a conversation isn’t left with a broken thread, even if you anonymise your own account. If you have a specific concern about message retention, contact us (Section 17).

Security logs (sign-in and account-security events) are automatically deleted after 12 months. Audit logs (deliberate actions by our administrators, such as verifying a nanny or issuing a refund) are kept for longer, as an accountability record for actions that can matter to a safeguarding or financial query well after the fact.

You can request account deletion at any time from your account page, or by emailing us — see Section 10.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you — you can download a full export from your account page at any time.
• Rectification — correct inaccurate data by editing your profile, or by contacting us.
• Erasure (“right to be forgotten”) — request that we anonymise your account, available directly from your account page. As explained in Section 9, payment records are retained regardless, because we have a separate legal obligation to keep them.
• Restriction of how we use your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format (the account export is provided as JSON).
• Object to processing based on our legitimate interests.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, use the tools on your account page or email us at littlelantern@hotmail.com . We’ll respond within one month, as required by law.

Because Nora’s Lantern connects families with childcare providers, some processing exists specifically to protect children — reviewing nanny verification documents, and acting on safeguarding reports. This processing is carried out by trained staff, is restricted by role, and is limited to what’s necessary for that safeguarding purpose. See our Terms & Conditions (Section 8) for how nanny verification works, and Section 25 for how to raise a safeguarding concern.

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. Nanny verification decisions are made by a human reviewer, not an algorithm.

We use two cookies, both strictly necessary for the Platform to function:

• ll_session — keeps you signed in. Without it you couldn’t stay logged in between pages.
• ll_editor_session — used only by the Platform owner to access the site-editing tool. It is never set for ordinary visitors, parents or nannies.

We don’t use any analytics, advertising, or tracking cookies. Because both cookies are strictly necessary for a service you’ve actively requested (signing in), UK rules on cookies (PECR) don’t require us to ask for your consent to use them — but we’re telling you about them here regardless, in the interest of transparency. Your dark-mode preference and any site-editor customisation are stored in your browser’s local storage, not in a cookie, and are never sent to our servers.

The Platform is not directed at children and is not intended for use by anyone under 18. We do not knowingly collect personal data directly from children. If you believe a child has provided us with personal data, contact us and we will remove it.

We may update this Policy from time to time — for example as our hosting or payment providers change, or as data-protection law evolves. Material changes will be reflected in an updated “Last updated” date at the top of this page, and re-acceptance may be required at your next login where changes are significant.

If you have concerns about how we handle your personal data, please contact us first at littlelantern@hotmail.com so we can try to resolve it. You also have the right to complain to the UK’s data-protection regulator, the Information Commissioner’s Office (ICO), at any time.

Questions about this Policy or how we handle your personal data:

Nora’s Lantern Care

Email: littlelantern@hotmail.com

Registered/business address: Available at request.