Effective date: 14 July 2026 · Last reviewed: 11 July 2026
1. Who we are
The data controller is Spodge Ltd, trading as LifeLearn, registered in England & Wales (Company Reg. No. 17339371), registered office 82a James Carter Road, Mildenhall, IP28 7DE, United Kingdom. Contact for anything in this policy: hello@lifelearn.co.uk.
LifeLearn is operated by Spodge Ltd, a private limited company. LifeLearn Foundation CIC (company no. 17341763) is a separate community interest company established to widen access to opportunities for home-educated children. Spodge Ltd intends to support the Foundation as LifeLearn grows. The Foundation is a separate data controller and has no access to LifeLearn member data.
We process personal data in accordance with the UK GDPR and the Data Protection Act 2018.
2. Who LifeLearn is for
LifeLearn accounts are only for adults aged 18 or over. We do not knowingly collect personal data from under-18s as account holders, and no part of the service is directed at children. Information about children appears on the platform in only one way: parents and carers may record their own children’s learning in the private journal (see section 4).
3. What we collect
Account data — name, email address, password (hashed), your confirmation that you are 18 or over (we do not collect date of birth), membership tier.
Profile and community data — anything you choose to add to your profile, and content you post: activity, groups, forums, messages, reviews, offers.
Journal data — learning goals, progress updates and notes you record, which may include your children’s first names and learning information. Journal data is private to your account and is not published.
Provider data — business details, listing content, badge declarations you make, and any supporting evidence you choose to show us if we ask (we record the fact and outcome of a check, not document copies).
Directory (seeded) data — publicly available business contact information for UK providers, collected to build the directory (see section 6).
Payment data — handled by Stripe; we receive subscription status and transaction references, never card numbers.
Technical data — IP address, device/browser information, pages visited, login events; and, with your consent, first-party analytics data (see Cookie Policy).
4. Children’s information in the journal
The journal is a private record-keeping tool for parents. You control what you enter; we recommend using first names only. This information is stored securely, never sold, never used for advertising, never shown to other users, and is deleted when you delete the entry or your account. We process it because you ask us to provide the journal service (contract) and, for safeguards around it, our legitimate interest in running a safe platform.
5. Why we process your data (lawful bases)
| Purpose | Lawful basis |
|---|---|
| Providing accounts, community, journal, dashboards, listings | Contract |
| Taking payment, tax and accounting records | Contract; legal obligation |
| Provider declaration badges and evidence spot-checks | Legitimate interests (trust and safety) |
| Moderation, safeguarding, complying with the Online Safety Act 2023 | Legal obligation; legitimate interests |
| Service emails (receipts, notices, security) | Contract |
| Marketing emails | Consent — unsubscribe any time |
| Analytics | Consent (via the cookie banner) |
| Seeded directory listings | Legitimate interests (see section 6) |
6. Seeded directory listings — for providers
We list publicly available business information (business name, address, publicly listed contact details, services) so families can find local provision. Our lawful basis is legitimate interests: this is business contact data, already public, used for its published purpose. You can claim, correct or remove your listing at any time by emailing hello@lifelearn.co.uk — we action removals promptly and this is highlighted in our first contact with you.
7. Who we share data with (processors)
- PMPro Hosting — site hosting on DigitalOcean infrastructure (data centre: London, UK)
- Cloudflare Stream — video hosting for community video features
- Cloudflare — CDN and security
- Stripe — payment processing
- Brevo — transactional and marketing email
- Google — fonts served from Google Fonts (your IP is disclosed to Google when fonts load)
We do not sell personal data. We may disclose data where the law requires — including to law enforcement or statutory safeguarding agencies where there is risk to a child.
Where a processor transfers data outside the UK, transfers are protected by UK adequacy regulations or the ICO’s International Data Transfer Agreement / Addendum.
8. Retention
- Account, profile and journal data: for the life of your account, then deleted within 30 days of account deletion (backups purge within 90 days).
- Community posts: you can delete your own posts; on account deletion, posts are deleted or anonymised.
- Declaration evidence spot-checks: we record what was seen and when; document copies are never retained — only the reference, date and outcome.
- Payment/tax records: 6 years (legal obligation).
- Moderation and safeguarding records: up to 6 years, or longer where required for legal proceedings.
9. Your rights
You have the right to access, rectify, erase, restrict, object, and port your data, and to withdraw consent at any time where consent is the basis. Email hello@lifelearn.co.uk; we respond within one month. You can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113), though we would welcome the chance to resolve it first.
10. Security
TLS everywhere, hashed passwords, role-restricted admin access, UK hosting (London), premium-gated REST routes with nonce protection, and regular review of access. No system is perfectly secure; we will notify you and the ICO of any breach as the law requires.
11. Changes
We will post updates here and email account holders about material changes before they take effect.
