Privacy policy

The short version

In this policy, "we", "us" and "our" mean Cannings Digital. The rest of the page gives the detail.

Who we are

Cannings Digital is the trading name of Paul Cannings, a sole trader based in Cheshire, UK. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Paul Cannings, trading as Cannings Digital, is the controller of the personal data described in this policy, except where we say another organisation is responsible.

For any privacy question or request, email paul@canningsdigital.com.

Cannings Digital is run by one person, so your message will be read and answered by Paul.

This website

Hosting and security

canningsdigital.com is hosted on Cloudflare Pages. When you visit, Cloudflare processes technical information that every web request involves, such as your IP address, browser type, the page requested and the time, to deliver the site and protect it from attacks and abuse. Cloudflare does this on our behalf as a processor. Our lawful basis is legitimate interests: running a secure, working website.

Visitor statistics

We use Cloudflare Web Analytics to understand which pages are useful. It does not use cookies or local storage, and Cloudflare states that it does not fingerprint visitors by their IP address or browser. We see only totals, such as page views, the pages and sites people arrive from, broad device and browser types, and countries. We can't identify you from these reports. Our lawful basis is legitimate interests: improving the website.

Cookies

We don't set any cookies on this website. Cloudflare may set a short-lived, strictly necessary security cookie if it needs to check that a visitor isn't an automated bot. It isn't used for tracking or advertising.

The website's fonts are stored on our own site, so viewing it doesn't send your details to a font service.

If you email us

We receive your email address, your name if you include it, and whatever you write. We use this only to reply to you and to deal with your question. Our lawful basis is legitimate interests: answering the people who contact us. Our email is provided by Google Workspace, which acts as our processor.

Harlequin Theatre Mobile App

Cannings Digital builds and publishes the Harlequin Theatre Mobile App for The Harlequin Theatre in Northwich, Cheshire. The theatre provides the app's content.

What the app does not collect

The app collects no personal data. It has:

• no account or sign-in;
• no analytics, crash-reporting or advertising software;
• no tracking, as Apple defines it;
• no access to your location, contacts, camera, microphone or photos;
• no push notifications at present. If we add them, the app will ask your permission first and we will update this policy before the change.

Show listings

The app downloads the theatre's show listings and posters from TicketSource, the theatre's ticketing provider. Like any internet request, this means TicketSource's servers see your device's IP address. The request contains no information about you.

When you leave the app

• Booking tickets opens TicketSource's booking pages. Your booking is between you, the theatre and TicketSource. We never see your booking or payment details, and TicketSource's privacy policy applies.
• Membership and auditions pages are loaded from the theatre's own website (harlequinplayers.com) inside the app. That website may use cookies under its own privacy policy.
• Directions, phone, email and social media links open Apple Maps, your phone or email app, Facebook, Instagram or X. Those services' own privacy policies apply.

Diagnostics from Apple

If you've chosen to share analytics with app developers in your device's settings, Apple may give us crash reports and usage statistics. Apple provides these in a form that doesn't identify you, and you can turn sharing off at any time in Settings.

Animated Social Stories

Animated Social Stories is an app for children, used with their parents, carers or teachers. It is still in development. This section describes how it will handle data, and we will update it before release if anything changes.

Because children use the app, we have designed it around the ICO's Age Appropriate Design Code (the Children's Code). See Children's privacy for how.

The free stories: no account, no personal data

The free stories are built into the app and play offline, with no account and no personal data sent to us. Personalisation, such as the avatar you build and a first name shown on screen, is stored only on your device.

The app contains no adverts, no tracking and no third-party analytics or advertising software.

Your child's name stays on your device

Your child's first name and avatar are kept only on your device, for every part of the app. We never receive them, and neither does anyone else. Stories show the name on screen; it is never spoken in the narration.

Custom stories (planned)

A later version will let a parent or carer create custom stories about a situation their child finds hard. This feature is not yet available. When it is, it will work like this:

• Parent account. You sign in with Apple. We receive an account identifier and, if you choose to share them, your name and email address. You can use Apple's Hide My Email.
• Your description. You describe the situation in your own words. Before it leaves your device, the app removes your child's name. We ask you not to include other details that could identify your child, such as their surname or school. We use the description only to write and check the story, and delete it as soon as the story is delivered. If it was flagged for review, we delete it once the review is done.
• Age band. We receive your child's age band (3 to 8, or 9 to 15) with each request, so the story uses the right words and pace.
• Human review. While the feature is new, every custom story will be checked by a person (Paul) before it is delivered. That means Paul will read your description and the story.
• How stories are written and narrated. Anthropic's AI model writes and checks the story text, and ElevenLabs turns that text into narration. They receive only the story request and the story text: no names, no account details and nothing that identifies you, your child or your device. Anthropic doesn't use this text to train its models and deletes it within 30 days. We will switch off ElevenLabs' option to use our content to improve its models.
• Purchases. Custom stories are paid for with credits bought through Apple. Apple handles the payment; we receive a record of the transaction to keep your credit balance, never your card details.
• Your stories. Finished stories are stored with your account so you can download them again, and they keep working offline on your device.

Your description might reveal information about your child's health, disability or additional needs. Under UK GDPR this is special category data, so the app will ask for your explicit consent before you send a description, and you can withdraw consent at any time.

Our lawful bases for custom stories are performance of a contract (providing the stories you ask for), explicit consent (for any health-related information in your description) and legal obligation (keeping transaction records for tax).

You will be able to delete your account from inside the app, or by emailing us. We delete your account data within 30 days. Deleting a child profile removes it from your device straight away.

Children's privacy

Animated Social Stories is made for children, so it follows the principles of the ICO's Children's Code:

• Data minimisation. We collect only what a feature needs to work. The free stories need nothing.
• High privacy by default. Nothing is shared and nothing is switched on that a child would need to switch off.
• No profiling. We don't build profiles of children or use their data to predict or influence what they do.
• No behavioural advertising. There are no adverts of any kind, behavioural or otherwise.
• No location. The app never asks for or uses location.
• No nudge techniques. No streaks, points, autoplay chains or prompts to keep watching or to share more data.
• Grown-up controls. Child profiles, purchases and custom stories sit behind a parent gate.
• Assessed before launch. We will complete a data protection impact assessment before the app is released.

Animated Social Stories will be listed in Apple's Kids Category, so it also follows Apple's rules for that category: no third-party advertising or analytics, no sending children's personal information to third parties, and a parent gate before purchases or links out of the app.

The Harlequin Theatre Mobile App and this website are not aimed at children, but they collect no personal data from anyone who uses them.

Marketing emails

We don't send marketing emails unless you have opted in.

• You'll only receive news or product updates if you've said yes to them yourself. There are no pre-ticked boxes, and we won't add you because you emailed us, asked for support or bought something.
• Every marketing email will include a simple way to unsubscribe, and you can also reply or email us to stop at any time.
• We never send marketing to children, and there is no marketing in the parts of our apps that children use.
• Messages you need, such as replies to your questions or notices about your account, are not marketing.

Our lawful basis for marketing emails is your consent.

Who we share data with

We never sell personal data, and we don't pass it to partners, advertisers or data brokers. The only companies that handle it are service providers working on our instructions, under contract, for the purposes in this policy:

When custom stories launch, Anthropic (story writing) and ElevenLabs (narration) will also be used, as described in Animated Social Stories. They receive story text only, with nothing that identifies you or your child, so we don't share personal data with them.

TicketSource and The Harlequin Theatre are not our service providers. When you book tickets or use the theatre's website, they are responsible for your data under their own policies.

We may also disclose data if the law requires it, for example to comply with a court order.

Transfers outside the UK

Cloudflare and Google are US companies and may process data outside the UK. Both are certified under the UK Extension to the EU-US Data Privacy Framework, which UK law recognises as giving adequate protection to personal data sent to the US. Apple handles transfers for its own services under its privacy policy.

How long we keep data

Keeping data safe

This website and our apps use encrypted connections (HTTPS). We keep personal data to a minimum, limit who can access it (in practice, only Paul) and choose providers with strong security. Account data for custom stories will be stored on Cloudflare, which encrypts it where it is stored.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data;
• ask us to restrict how we use your data;
• object to us using your data on the basis of legitimate interests;
• ask for your data in a portable format;
• withdraw your consent at any time, where we rely on consent. This doesn't affect anything we did before you withdrew it.

To use any of these rights, email paul@canningsdigital.com. It's free. We'll reply within one month, and we may need to confirm who you are first.

Children have the same rights over their own data. A parent or carer can make a request on behalf of a younger child.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

Complaints

If you're unhappy with how we've handled your data, please tell us first at paul@canningsdigital.com. We'll acknowledge your complaint within 30 days and tell you what we're doing about it.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this policy

When we change this policy, we'll update the date at the top. If a change affects how an app uses your data, we'll tell you in the app or by email before it takes effect.