Privacy Policy

1. Who we are

Little Otter is the data controller for the personal data described in this policy. [Placeholder: registered business/legal entity name and address to be added here.] You can contact us at hello@littleotter.co.uk.

2. What we collect

When you sign up and use the member area, we collect:

• Account details: your email address and a securely hashed password (we never store your actual password).
• Profile details you choose to add: name, nickname, bio, and avatar image.
• Business details you choose to add: business name and address, VAT registration status, VAT scheme, and flat rate percentage.
• Pricing calculator inputs (costs, fees, VAT position) you enter to get a calculation - these are used to compute results but are not currently saved against your account, whether or not you’re logged in.
• Basic technical data (via Google Analytics, only if you accept our cookie banner - see section 5) about how the site is used.

You don’t need an account to use most of the site. If you use these other features, we also collect:

• Contact form submissions: your name, business name (if given), email address, and message - emailed directly to our own inbox so we can reply. These aren’t stored in our database.
• Waiting list signups: your name and email address, if you join our waiting list for early access to new tools.
• Etsy Store Auditor inputs: a public Etsy shop URL (free tier) or an uploaded product-listings CSV file (connected tier) - used only to generate your audit report and its PDF/CSV downloads, then discarded; we don’t keep a copy.
• Your cookie-consent choice (accepted/declined), stored in your browser, not sent to us at all.

3. Why we collect it, and our legal basis

We use your account and profile data to provide the Service (performance of a contract with you) - for example, authenticating you, remembering your business/VAT defaults, and displaying your profile back to you. Where you provide business/VAT details, that’s on the basis of your consent, given by saving those fields yourself. We use contact form, waiting list, and Etsy Store Auditor inputs on the basis of your consent, given by submitting them, solely to respond to you or generate the report you asked for. Site usage analytics (Google Analytics) run only with your consent, given via our cookie banner - see section 5.

4. Where your data is stored

Account and profile data is stored in Google Cloud Firestore (London/Belgium region), and avatar images in Google Cloud Storage (Belgium region) - both provided by Google Cloud Platform. Password reset emails and contact form messages are sent via Resend, a transactional email provider. These providers act as our data processors and only process data on our instructions.

5. Cookies

We use two kinds of cookie:

• Strictly necessary: a single essential cookie that keeps you logged in (an encrypted session token). This is required for the member area to function and isn’t used for tracking or advertising, so it’s not something you can opt out of and still stay logged in.
• Analytics (optional): Google Analytics, which may process data outside the UK/EU in accordance with Google’s own privacy policy. We use Google’s Consent Mode: until you accept the cookie banner shown when you first visit, Google Analytics runs in a cookieless mode that doesn’t set analytics cookies or identify you - it only sends anonymous, aggregated signals Google uses for modelling. Accepting switches Analytics to its normal cookie-based mode; declining (or simply not choosing) keeps it in that cookieless mode indefinitely. Declining doesn’t affect anything else about browsing the site: page navigation doesn’t rely on cookies at all, and the strictly necessary session cookie above is only ever set when you actually log in or sign up, not proactively.

You can change your choice at any time via the "Cookie preferences" link in the site footer.

6. How long we keep your data

We keep your account data for as long as your account is active. If you ask us to delete your account, we’ll delete your personal data within a reasonable time, except where we’re required to keep certain records by law. Contact form messages are kept only in our email inbox, for as long as any other email correspondence; waiting list signups are kept until we either contact you about early access or you ask us to remove them.

7. Your rights

Under UK GDPR, you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data ("right to be forgotten");
• ask us to restrict or object to certain processing;
• receive your data in a portable format; and
• complain to the Information Commissioner’s Office (ICO) if you’re unhappy with how we’ve handled your data.

To exercise any of these rights, contact us at hello@littleotter.co.uk or via our contact form.

8. Security

Passwords are hashed (never stored in plain text), session cookies are encrypted and marked httpOnly so they can’t be read by page scripts, and data is encrypted in transit and at rest by our cloud providers’ default security measures.

9. Changes to this policy

We may update this policy from time to time. If we make material changes, we’ll update the "Last updated" date above.