Privacy Notice

Personalised Suitabook accounts are for adults acting as a parent, guardian or other authorised family member. Public book guides can be explored without an account.

For privacy and data-rights requests, email privacy@suitabook.com. General enquiries can go to hello@suitabook.com and customer support to support@suitabook.com.

Suitabook is the operating/trading name used for this controlled MVP. Until a separate legal entity is formed, the individual operating Suitabook is the data controller for the personal information described in this notice. The controller can be contacted for data-protection matters at privacy@suitabook.com.

Adult account information includes your name, display name, email address, sign-in records, family memberships, invitation activity, notification preferences and account settings. Authentication credentials are handled by our authentication provider; Suitabook does not need access to your plaintext password.

Child and family reading information can include a child display name, date of birth, reading stage and confidence, interests, strengths, reading goals, sensitivities, optional current reading context, family values and reading preferences, reading decisions, Reading Plan activity, outcomes and feedback.

Technical and security information may include IP address, browser or device information, timestamps, request identifiers, authentication or security events, and diagnostic or error logs generated when the service is used. This information is used only where needed to operate, protect and troubleshoot the service.

Support and quality information can include book requests, issue reports, MVP feedback and, if an adult asks Sofia to hand over a question, the adult's reply email, optional name, question and the page where help was requested.

Optional acquisition analytics can record how an adult visitor found Suitabook, campaign/referrer information and a small set of Parent-level milestones. Child identifiers or child-profile information are not placed into marketing attribution.

When you create an account, we use adult account and core service information because it is necessary to enter into and perform our contract with you under the Terms of Use, including authentication, family access, book-finding features, Reading Plans, notifications and support.

We use child and family reading information only to provide and improve parent-requested reading guidance and family features. Our current basis is our legitimate interest in providing a useful, privacy-conscious parent service, balanced against the child's rights and interests. Parents control what is added and can edit or remove child information.

We use technical, security and operational information where necessary for our legitimate interests in protecting accounts, preventing misuse, diagnosing failures and running a reliable service.

Optional acquisition analytics relies on your consent. It is not required to use Suitabook. You can decline it and, if signed in, withdraw identifiable attribution later from Account without affecting the lawfulness of processing before withdrawal.

Where we need information to comply with law or exercise or defend legal rights, we may use it for those purposes.

Please do not enter a child's medical diagnosis, school name, religion, contact details, passwords, card details or other unnecessary sensitive personal information in Reading Profile free-text fields. Describe only the reading-related context you need Suitabook to consider.

Suitabook does not diagnose children and does not infer medical conditions. The current controlled MVP does not expose the separately proposed dyslexia, ADHD, autism or visual-support fields.

If unnecessary sensitive information is submitted, we may minimise or remove it where practical and may ask you to restate the reading need without the sensitive detail.

AI-assisted systems help analyse books and support parts of Suitabook's Book Intelligence workflow. Book analysis can be incomplete or wrong, so evidence and uncertainty remain part of the guide.

Personalised reader guidance combines the published book information with the reading information an authorised adult has supplied. It is guidance for the adult, not a decision made for the child.

Sofia is a bounded help assistant. Sofia does not automatically read a child's profile. If an adult asks for human help, Suitabook saves only the submitted support contact and question rather than automatically forwarding a full chat transcript.

Suitabook does not use solely automated processing to make decisions about a child that produce legal or similarly significant effects. AI-assisted outputs support information shown to an adult, who remains responsible for the reading decision.

Suitabook uses service providers for website hosting, database and authentication, transactional email, business email and AI-assisted processing. Current providers include Vercel, Supabase, Resend, Microsoft 365/GoDaddy and OpenAI where the relevant feature uses them.

Providers receive only the information needed for their role. Some providers may process information outside the UK. Where international processing applies, we rely on the provider's contractual and data-transfer safeguards and keep the amount of personal information sent to providers limited.

We do not sell personal information to advertisers and do not use child-profile information for behavioural advertising.

We use reasonable technical and organisational measures designed to protect personal information, including access controls, protected authentication, encrypted connections in transit and security safeguards provided by our infrastructure providers. No internet service can guarantee absolute security.

Access to private family information is limited by account and family-membership controls. We minimise the information sent to external providers and investigate security or privacy incidents where required.

Family and child profile information is kept while the relevant account or family feature remains active, unless you delete it earlier. The product includes controlled child, family and account deletion routes. Deletion removes eligible information from active product systems, subject to limited provider backup, security, accounting or legal-retention requirements described in this notice.

Sofia human-support enquiries have a 90-day expiry and an automated hourly purge schedule. The related notification intent is deleted with the enquiry. Financial/provider usage receipts are kept separately without the support question content where required for operational accounting.

A consented anonymous acquisition visitor record expires after 90 days. The browser choice remembering Allow or No thanks can last up to one year. Identifiable Parent attribution can be withdrawn from Account; de-identified aggregate source facts may remain.

Some historical reading-journey records can remain without an adult actor identifier where this is needed to preserve the integrity of a family's reading history. Provider security or backup records may persist for their limited operational retention periods.

You can edit adult and child profile information, change reading preferences, remove a child, leave or delete a family where the ownership rules allow it, withdraw optional acquisition attribution and delete an eligible adult account from Account.

You may also ask about access, correction, deletion, restriction, objection, portability or another data-protection right by emailing privacy@suitabook.com. We may need to verify the request before disclosing or changing private information.

You can complain to the UK Information Commissioner's Office if you are unhappy with how your personal information is handled. We would also welcome the chance to address the issue directly through privacy@suitabook.com.

Suitabook is designed for adult-controlled accounts, but public pages may still be viewed by children. We therefore take account of the ICO Children's Code where it is relevant to a service likely to be accessed by under-18s and use conservative defaults: child profiles are private, acquisition analytics is optional, child data is excluded from marketing attribution, and personalised family data is protected by family membership controls.

Children should not create their own Suitabook account or submit support contact details. A parent, guardian or other authorised adult should manage personalised features. Suitabook does not rely on a blanket claim that it never processes information about children: authorised adults may provide child-profile information for the reading-guidance service.

We will update this notice when the product, providers or data practices materially change. The effective date shown on this page identifies the current controlled-MVP version.