Privacy policy

Who we are

Pencilpace (pencilpace.com) is run by ThirteenTabs Ltd, company number 17326399, registered office 167-169 Great Portland Street, Fifth Floor, London W1W 5PF, England. We are the data controller. Contact: privacy@pencilpace.com.

The short version

We collect as little as possible about children: at most a first name you choose to print on the sheets. Nothing else about the child.
Free sample sheets are made in your browser. Nothing you type there is sent to us.
Your email is used to deliver your pack, for one feedback request about two weeks into the term, and, only if you tick the box on the free sheet page, for at most one email a month.
We delete packs, names and emails 12 months after purchase, and unpaid checkouts after 30 days.
No advertising cookies, no selling or sharing of data for marketing.

What we collect and why

12-week pack order: grade, level, language, paper size, start date and the optional first name to print. Lawful basis: performance of a contract (UK GDPR art. 6(1)(b)). The first name is entered by the parent, guardian or teacher, who confirms that role at checkout.
Email address: from the checkout or the order form, to send the download link and answer support questions (contract), and from the sign-up box only if you tick it (consent, art. 6(1)(a)).
Payment: handled by Lemon Squeezy as merchant of record. We receive the order number, amount, currency and email; never card details.
Placement check answers stay in your browser and are not sent to us.
Feedback: if you answer our feedback request, we store your rating, comment and level answer with your order (legitimate interests, art. 6(1)(f): improving the sheets). We publish a comment on the site only if you tick the box allowing it, and only with the name you choose to show, if any.
Server logs and, if enabled, Cloudflare Web Analytics: cookieless, aggregated page statistics (legitimate interests, art. 6(1)(f)).
On this device, the order form keeps your choices in your browser's session storage until you close the tab, so they survive a trip to the checkout and back. Nothing of this is sent to us until you continue to payment.

Children

Pencilpace is for parents, guardians and teachers, not for children to use alone. We do not create accounts for children, we do not ask children for information, and we do not profile them. If you think a child has given us information, write to privacy@pencilpace.com and we will delete it.

Who processes data for us

Where data leaves the UK or EU, these providers rely on adequacy decisions or standard contractual clauses.

Supabase (database, file storage and functions; servers in the EU).
Lemon Squeezy (payments, tax and receipts; merchant of record).
Cloudflare (website hosting and, if enabled, cookieless analytics).
Resend (sending the download and feedback emails).

How long we keep it

Packs (the PDF), the child's first name and your email are deleted 12 months after purchase by an automatic weekly job. Unpaid checkouts are deleted after 30 days. Order records needed for tax keep only non-personal fields after that. Feedback you did not allow us to publish is deleted with your order; published feedback stays on the site until you ask us to remove it. Sign-up emails are kept until you unsubscribe.

Your rights

You can ask for a copy of your data, its correction or deletion, restriction, portability, or object to processing, and withdraw consent at any time, by writing to privacy@pencilpace.com. You can also complain to the Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Changes

This is version 2026-10-20. We record which version you accepted with each order.