How we look after personal information — yours, and the child you're sending post to.
The Little Post is a personalised monthly postal subscription for children. An adult — usually a grandparent, aunt, uncle or family friend — buys a subscription as a gift, and each month the child receives a printed edition in the mail.
This policy is issued by [ENTITY] (ABN [ABN]), trading as The Little Post. We're an Australian business, our customers are in Australia, and we're bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy explains how we meet those obligations.
Any questions about privacy, and anything you'd like changed or deleted: hello@thelittlepost.com.au.
We ask for your first name, email address, your relationship to the child (grandparent, aunt, and so on), and the child's age range. For a free sample we also ask for your postcode, so we know where to post it.
This is stored in Australia, in our own database in Sydney. We don't record your IP address, your browser details, or which page you came from when you fill in one of our forms.
We use it to send you the sample, to let you know when we launch, and to understand who our product is for. You can unsubscribe from anything we send you, at any time, using the link at the bottom of the email.
| What | Why |
|---|---|
| Your name and email address | To set up the subscription and keep in touch with you about it |
| Your billing address | Required by our payment provider |
| The child's first name | To personalise the booklet and the letter |
| The child's delivery address | To post the edition |
| Your preferences for the edition | To make the right thing |
Order details are stored in our database in Sydney.
We never see or store your card details. Payments are handled by Stripe on their own secure checkout page. Your card number never reaches our systems.
There's a separate section on recordings below — it's the most personal thing we handle, so it gets its own explanation.
Like any website, ours is served by a hosting provider that processes ordinary technical information — your IP address and browser type — as part of delivering the pages to you. We don't store that information ourselves or attach it to anything else we hold about you.
We also use advertising cookies from Meta (Facebook and Instagram) to measure whether our ads are working. These don't run unless you agree to them. When you first visit, we ask. If you decline, they don't load, and nothing about your visit goes to Meta. You can change your mind at any time by clearing your cookies and choosing again. We don't send Meta your email address, your name, or any other detail you've given us — not in any form, hashed or otherwise.
You can limit or block this now by turning on tracking protection in your browser (Safari, Firefox and Brave block it by default), by adjusting your Facebook or Instagram ad preferences, or at youronlinechoices.com.au. If you'd like us to confirm we hold nothing about you, just email us.
Almost everything we do involves a child who isn't our customer. We think that deserves saying plainly rather than burying.
Their first name, their delivery address, their approximate age, and — if someone has made one — a voice recording addressed to them. That's all. We don't ask for a child's surname, date of birth, email address, phone number or photo. Children don't have accounts with us and never log in to anything.
This is the honest heart of it. A grandmother buys a subscription and gives us her granddaughter's name and address. She isn't the child's parent, and under Australian privacy law she can't give permission on the parent's behalf.
So this is what we do instead:
If a parent and a gift-giver disagree, the parent decides. If a child's parent or guardian asks us to stop, we stop — even if the person paying would rather we didn't. We'll let the buyer know their subscription has ended and refund anything they've paid for editions not yet sent.
A child's name and address are used to make and post their edition, and for nothing else. We don't send children advertising, we don't build a profile of them, we don't track them, and we don't pass their details to anyone for marketing. Every message we send goes to the adult who bought the subscription.
The recording is always a real human voice. We never clone, synthesise, or artificially generate anyone's voice. What the child hears is exactly what was recorded — converted to a different audio format so it plays on any device, but never altered, edited, or re-created.
We never make a transcript. Your recording is not sent to any transcription or speech-recognition service, no written version of what you said is ever produced, and nothing is stored except the audio itself. The only thing done to a recording is a format conversion.
The recording is stored alongside the child's subscription, which includes their first name and delivery address. We don't collect any new information about the child for this feature, and children don't log in or have accounts.
Recordings are not public. They aren't listed anywhere, they aren't indexed by search engines, and they're never sold, rented or used for advertising. They can only be reached through a private link that can't be guessed. The audio files are held in private storage and are served only through links that expire after a short time.
When your recording is ready we email it to you so you can listen back and make sure you're happy with it. Separately — and this is the part that matters — a person at The Little Post listens to every recording and has to approve it before a child can hear it. Nothing is ever published automatically, and there is no timer. If anything is flagged, by you or by us, the recording is held back and never plays.
Because approval happens by hand, there may be a short wait between a recording being made and it becoming available. If a child scans their QR code before then, they'll see a friendly note asking them to try again soon.
We use a small number of providers to run this feature:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Stores the audio and our database | Sydney, Australia |
| Railway | Converts the audio so it plays on any device | United States |
| Resend | Sends you the preview email | United States |
| Netlify | Serves the recording and playback pages | United States |
Your recording is converted overseas, once. After you make a recording, we send it to a processing service in the United States, which converts it into a format that plays on any device and sends it straight back. The stored copies — the original and the converted version — are held in Sydney, Australia.
That conversion is the only thing that happens to your recording overseas. It isn't sent to any transcription service, any artificial intelligence service, or anyone else, and no copy is kept overseas afterwards. Our conversion provider handles it under a contract that requires them to use it only to perform that task and to keep it secure.
We'd rather this step happened in Australia too. Our current provider doesn't offer an Australian region, and we're working on moving it. If and when we do, we'll update this page.
Recordings are meant to be kept. They're a keepsake, and a child may want to hear a grandparent's voice again years from now. So we keep them for as long as you want us to, even after a subscription ends.
Email hello@thelittlepost.com.au and tell us which recording. Either the person who made it, or the child's parent or guardian, can ask — and if they disagree, the parent decides. We don't need a reason. We'll action it and confirm when it's done, normally within a few days and always within 30.
We're a small business and we use established providers rather than building everything ourselves. Each of them only handles what they need to, under contracts that require them to keep it confidential and use it only for us.
| Provider | What they handle | Where |
|---|---|---|
| Supabase | Our database and stored files — recordings, form submissions, orders, names and addresses | Sydney, Australia |
| Railway | Converting recordings into a playable format | United States |
| Netlify | Hosting and serving our website | United States |
| Stripe | Payments — card details, billing name and address | United States and globally |
| Resend | Sending our emails — recipient addresses and message content | United States |
| Meta | Advertising measurement — browsing activity only, no identifiers from us | United States |
| Australia Post | Delivering editions — the child's name and address | Australia |
We never sell personal information, and we don't share it with anyone for their own marketing.
Some of the providers above are based in the United States. That means some information is handled overseas: your email address and the contents of emails we send you, payment and billing details, technical information from serving the website, and — as described above — voice recordings during the format conversion step.
Where that happens we take reasonable steps to make sure the provider handles the information consistently with Australian privacy law, including through the data protection terms in our contracts with them. Under the Privacy Act we remain responsible for how they handle it.
What stays in Australia: every stored copy of a voice recording, every waitlist and sample enquiry, every order record, and every child's delivery address. We've deliberately kept the most sensitive things we hold onshore.
| What | How long |
|---|---|
| Waitlist entries | 2 years, or until you ask us to remove you |
| Free sample requests that don't lead to a subscription | 12 months |
| Order and payment records | 7 years — we're required to keep financial records |
| A child's delivery address | 12 months after their last edition is posted, then deleted |
| Voice recordings | Kept as a keepsake — see above |
| Email delivery logs | 90 days |
When we no longer need something, we delete it. If you'd like something gone sooner, just ask.
We take reasonable steps to protect what we hold, but no system is completely secure and we won't pretend otherwise. If something ever goes wrong in a way that's likely to cause you serious harm, we'll tell you and we'll tell the Office of the Australian Information Commissioner, as the law requires.
You can ask us for a copy of the personal information we hold about you. We'll respond within 30 days and there's no charge. We may need to confirm it's really you before we send anything.
If something's wrong — a misspelt name, an old address — tell us and we'll fix it.
Email us and we'll delete what we hold, except for records we're legally required to keep, like payment records for tax purposes. We'll tell you if anything falls into that category.
If someone has bought a subscription for your child and you'd rather they hadn't, email hello@thelittlepost.com.au. We'll stop deliveries and delete everything we hold about your child. You don't need to give a reason, and you don't need the buyer's agreement.
You're welcome to ask us general questions without giving your name. We can't post an edition to a child without a name and address, for obvious reasons.
If you think we've mishandled personal information, email hello@thelittlepost.com.au with the subject line "Privacy complaint". We'll acknowledge it within 5 business days and give you a written response within 30 days.
If you're not satisfied with how we've handled it, you can take it to the Office of the Australian Information Commissioner: oaic.gov.au, or 1300 363 992. They're the independent regulator and their service is free.
If The Little Post is ever sold, or if we close down, we'll tell you before anything you've given us moves anywhere. If we close, recordings will be made available for you to download before they're deleted. We won't hand a child's details or a family's recordings to a new owner without telling you first and giving you the chance to say no.
If we change how we handle personal information, we'll update this page and change the date below. If it's a significant change — somewhere new that data goes, something new we collect — we'll email everyone with an active subscription rather than quietly editing the page.
Last updated: [date]
Questions: hello@thelittlepost.com.au