How we look after personal information — yours, and the child you're sending post to.
The Little Post is a personalised postal subscription for children — available as an ongoing monthly plan, or as a prepaid 3-month or 6-month gift. An adult — usually a grandparent, aunt, uncle or family friend — buys it as a gift, and the child receives a printed edition in the mail for each month of the plan.
This policy is issued by Santana Concepts Pty Ltd (ABN 59 701 532 925), trading as The Little Post. We're an Australian business — the buyer doesn't need to be in Australia, though the child's delivery address and the reply-card return address do — and we're bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy explains how we meet those obligations.
Any questions about privacy, and anything you'd like changed or deleted: privacy@thelittlepost.com.au.
We ask for your first name, email address, your relationship to the child (grandparent, aunt, and so on), and the child's age range. For a free sample we also ask for your postcode, so we know where to post it.
This is stored in Australia, in our own database in Sydney. We don't record your IP address, your browser details, or which page you came from when you fill in one of our forms.
We use it to send you the sample, to let you know when we launch, and to understand who our product is for. You can unsubscribe from anything we send you, at any time, using the link at the bottom of the email.
| What | Why |
|---|---|
| Your name and email address | To set up the subscription and keep in touch with you about it |
| Your phone number | So we can reach you quickly if there's a problem with your order or an edition in production. We don't use it for marketing. |
| Your billing address | Required by our payment provider |
| Your postal address, if you'd like a reply card | So the child's reply card can be addressed back to you |
| The child's first name | To personalise the booklet and the letter |
| The child's delivery address | To post the edition |
| Your preferences for the edition | To make the right thing |
Order details are stored in our database in Sydney.
We never see or store your card details. Payments are handled by Stripe on their own secure checkout page. Your card number never reaches our systems.
We store the text of the letter you write, so it can be typeset and printed into the child's booklet. We also keep a private preview link so the child's parent or guardian can see the letter before it's sent — nothing needs their approval, but we like to keep them in the loop. The letter is used only to make and post the child's edition, and for nothing else.
There's a separate section on recordings below — it's the most personal thing we handle, so it gets its own explanation.
Like any website, ours is served by a hosting provider that processes ordinary technical information — your IP address and browser type — as part of delivering the pages to you. We don't store that information ourselves or attach it to anything else we hold about you.
We also use advertising cookies from Meta (Facebook and Instagram) to measure whether our ads are working. These don't run unless you agree to them. When you first visit, we ask. If you decline, or haven't made a choice, they don't load, and nothing about your visit goes to Meta — in any form. You can change your mind at any time by clearing your cookies and choosing again.
If you accept, and you go on to buy a subscription, we may also send Meta a securely hashed (one-way, unreadable) version of your email address and phone number, along with browser identifiers Meta itself sets, so Meta can match your purchase back to the ad that led you here. We never send Meta your child's name, their delivery address, letters, voice recordings, guardian details, or any other product content — regardless of your cookie choice. Only your own purchaser details, and only if you've said yes.
You can limit or block this now by turning on tracking protection in your browser (Safari, Firefox and Brave block it by default), by adjusting your Facebook or Instagram ad preferences, or at youronlinechoices.com.au. If you'd like us to confirm we hold nothing about you, just email us.
Almost everything we do involves a child who isn't our customer. We think that deserves saying plainly rather than burying.
Their first name, their delivery address, the month and year they were born, and — if someone has made one — a voice recording addressed to them. That's all. We ask for the month and year so we can pitch the booklet at the right reading level and surprise them with something extra around their birthday — we don't ask for the exact day, their surname, email address, phone number, or a photo. Children don't have accounts with us and never log in to anything.
This is the honest heart of it. A grandmother buys a subscription and gives us her granddaughter's name and address. She isn't the child's parent, and under Australian privacy law she can't give permission on the parent's behalf.
So this is what we do instead:
When we contact the parent or guardian directly, we ask for their name, email address and phone number, so we can reach them and so they have a way to reach us. We only use these to run the subscription and to keep them in the loop about their child's edition — never for marketing.
If a parent and a gift-giver disagree, the parent decides. If a child's parent or guardian asks us to stop, we stop — even if the person paying would rather we didn't. We'll let the buyer know. What happens to money already paid depends on the plan:
A child's name and address are used to make and post their edition, and for nothing else. We don't send children advertising, we don't build a profile of them, we don't track them, and we don't pass their details to anyone for marketing. Every message about the subscription goes to an adult — the person who bought it, a parent or guardian, or a reply pen pal where one's involved — never to the child directly.
The recording is always a real human voice. We never clone, synthesise, or artificially generate anyone's voice. What the child hears is exactly what was recorded — converted to a different audio format so it plays on any device, but never altered, edited, or re-created.
We never make a transcript. Your recording is not sent to any transcription or speech-recognition service, no written version of what you said is ever produced, and nothing is stored except the audio itself. The only thing done to a recording is a format conversion.
The recording is stored alongside the child's subscription, which includes their first name and delivery address. We don't collect any new information about the child for this feature, and children don't log in or have accounts.
Recordings are not public. They aren't listed anywhere, they aren't indexed by search engines, and they're never sold, rented or used for advertising. They can only be reached through a private link that can't be guessed. The audio files are held in private storage and are served only through links that expire after a short time. We can also switch off a child's QR code entirely at any time — for example if an edition is lost in the mail, or if a parent asks us to remove a recording.
When your recording is ready we email it to you so you can listen back and make sure you're happy with it. Separately — and this is the part that matters — a person at The Little Post listens to every recording and has to approve it before a child can hear it. Nothing is ever published automatically, and there is no timer. If anything is flagged, by you or by us, the recording is held back and never plays.
Because approval happens by hand, there may be a short wait between a recording being made and it becoming available. If a child scans their QR code before then, they'll see a friendly note asking them to try again soon.
We use a small number of providers to run this feature:
| What they do | Where |
|---|---|
| Stores the audio and our database | Sydney, Australia |
| Converts the audio so it plays on any device | United States |
| Sends you the preview email | United States |
| Serves the recording and playback pages | United States |
Your recording is converted overseas, once. After you make a recording, we send it to a processing service in the United States, which converts it into a format that plays on any device and sends it straight back. The stored copies — the original and the converted version — are held in Sydney, Australia.
That conversion is the only thing that happens to your recording overseas. It isn't sent to any transcription service, any artificial intelligence service, or anyone else, and no copy is kept overseas afterwards. The conversion service receives only the audio file itself and a destination filename — never the child's name, address, or your email. Our conversion provider handles it under a contract that requires them to use it only to perform that task and to keep it secure.
We'd rather this step happened in Australia too. Our current provider doesn't offer an Australian region, and we're working on moving it. If and when we do, we'll update this page.
Recordings are meant to be kept — they're a keepsake, and a child may want to hear a grandparent's voice again. We keep them, along with the letter and the child's delivery address, for 12 months after the subscription ends (or, for a one-time edition, 12 months after the final edition is posted).
Email privacy@thelittlepost.com.au and tell us which recording. Either the person who made it, or the child's parent or guardian, can ask — and if they disagree, the parent decides. We don't need a reason. We'll action it and confirm when it's done, normally within a few days and always within 30.
We're a small business and we use established providers rather than building everything ourselves. Each of them only handles what they need to, under contracts that require them to keep it confidential and use it only for us.
| What they handle | Where |
|---|---|
| Our database and stored files — recordings, form submissions, orders, names and addresses | Sydney, Australia |
| Converting recordings into a playable format | United States |
| Hosting and serving our website | United States |
| Stripe — payments, card details, billing name and address | United States and globally |
| Sending our emails — recipient addresses and message content | United States |
| Meta — advertising measurement; purchaser matching details only with your consent, see above | United States |
| Australia Post — delivering editions, the child's name and address | Australia |
We never sell personal information, and we don't share it with anyone for their own marketing.
Some of the providers above are based in the United States. That means some information is handled overseas: your email address and the contents of emails we send you, payment and billing details, technical information from serving the website, and — as described above — voice recordings during the format conversion step.
Where that happens we take reasonable steps to make sure the provider handles the information consistently with Australian privacy law, including through the data protection terms in our contracts with them. Under the Privacy Act we remain responsible for how they handle it.
What stays in Australia: every stored copy of a voice recording, every waitlist and sample enquiry, every order record, and every child's delivery address. We've deliberately kept the most sensitive things we hold onshore.
| What | How long |
|---|---|
| Waitlist entries | 2 years, or until you ask us to remove you |
| Free sample requests that don't lead to a subscription | 12 months |
| Order and payment records | 7 years — we're required to keep financial records |
| A child's delivery address, and any letter written to them | 12 months after the subscription ends (or after the final edition is posted, for one-time editions) |
| Voice recordings | 12 months after the subscription ends — see above |
| Email delivery logs | 90 days |
When we no longer need something, we delete it. If you'd like something gone sooner, just ask.
We take reasonable steps to protect what we hold, but no system is completely secure and we won't pretend otherwise. If something ever goes wrong in a way that's likely to cause you serious harm, we'll tell you and we'll tell the Office of the Australian Information Commissioner, as the law requires.
You can ask us for a copy of the personal information we hold about you. We'll respond within 30 days and there's no charge. We may need to confirm it's really you before we send anything.
If something's wrong — a misspelt name, an old address — tell us and we'll fix it.
Email us and we'll delete what we hold, except for records we're legally required to keep, like payment records for tax purposes. We'll tell you if anything falls into that category.
If someone has bought a subscription for your child and you'd rather they hadn't, email privacy@thelittlepost.com.au. We'll stop deliveries and delete everything we hold about your child. You don't need to give a reason, and you don't need the buyer's agreement.
You're welcome to ask us general questions without giving your name. We can't post an edition to a child without a name and address, for obvious reasons.
If you think we've mishandled personal information, email privacy@thelittlepost.com.au with the subject line "Privacy complaint". We'll acknowledge it within 5 business days and give you a written response within 30 days.
If you're not satisfied with how we've handled it, you can take it to the Office of the Australian Information Commissioner: oaic.gov.au, or 1300 363 992. They're the independent regulator and their service is free.
If The Little Post is ever sold, or if we close down, we'll tell you before anything you've given us moves anywhere. If we close, recordings will be made available for you to download before they're deleted. We won't hand a child's details or a family's recordings to a new owner without telling you first and giving you the chance to say no.
If we change how we handle personal information, we'll update this page and change the date below. If it's a significant change — somewhere new that data goes, something new we collect — we'll email everyone with an active subscription rather than quietly editing the page.
Last updated: 25 August 2026
Questions: privacy@thelittlepost.com.au