Little Magic

Draft - not yet in force

This document is still being prepared and has not been legally reviewed. The highlighted parts are decisions we have not finished making, so please do not rely on it yet.

Privacy Policy

Little Magic

Version 1.7 | Effective 31 August 2026

In short

  • We collect what we need to make and deliver your song, and very little else.
  • We never see your card details. Stripe handles payment.
  • A nickname is enough - we never ask for a child's full name, and we never publish what you do give us.
  • In the EEA and the UK, our website analytics and session recording do not run until you say yes. Everywhere else they run unless you turn them off - one click in our footer does that. Either way, we never record our order page.
  • We never sell your personal information and never share it for advertising.
  • You can ask us to delete the child's details at any time - section 4.4 explains the two limits on that.
  • Questions or requests: hello@littlemagic.app

1. Who we are

Rhapta Limited, a Hong Kong company trading as Little Magic, is the data controller for the information described here. Little Magic is a brand owned and operated by Rhapta Limited.

  • Business Registration Number: 81132587
  • Registered address: Two Harbourfront, 22 Tak Fung Street, Hung Hom, Kowloon, Hong Kong
  • Privacy contact: hello@littlemagic.app, for the attention of Privacy Contact

We have not appointed a Data Protection Officer; we are not required to.

2. What this policy covers

Our website at https://littlemagic.app, the orders you place there, the messages you send us, and the emails we send you. It does not cover other companies' websites or services you may reach from links on ours, which have their own policies.

3. What we collect and why

3.1 Your order

What Why Legal basis (GDPR / UK GDPR)
Your name To address your order and our emails Performance of our contract with you
Your email address To send your order confirmation and your gift email Performance of our contract with you
What you call the child - a nickname is enough It is the subject of the song - the personalisation you are buying Performance of our contract with you
Your message, story or lyrics The words we set to music Performance of our contract with you
Music genres and song languages Creative direction for the songs Performance of our contract with you
Package chosen (Starter, Family or Keepsake) and the currency you paid in To know what to make and deliver, and to keep an accurate payment record Performance of our contract with you
The choices you tick at checkout, and when you made them So we can both prove what was agreed Our legitimate interest in keeping a record of the contract, and compliance with consumer law
Any message you send us by email To answer you and to act on requests such as cancellations Performance of our contract, or our legitimate interest in handling enquiries

We need this information to sell to you. Without it we cannot make or deliver your song.

3.2 Your payment

Payment is processed by Stripe, on a page hosted by Stripe.

  • We never receive or store your full card number, expiry date or security code.
  • Stripe collects, directly from you: your card details, your billing address and country, and technical information it uses to prevent fraud. What Stripe does with that is governed by Stripe's own privacy notice.
  • We receive back from Stripe: a payment confirmation, an order reference, the amount, the last four digits of the card, and the billing country.

Legal basis: performance of our contract with you. We keep the payment record afterwards because Hong Kong tax law requires it - see section 8 - and for that retention we rely on our legitimate interest in complying with the law we are subject to.

3.3 Your use of our website

We use a website analytics provider to understand how people move through our site. This may include the pages you visit, the links and buttons you use, your approximate location from your IP address, your device and browser, and a recording of your session on our site.

We call that out separately because it deserves it: session recording means a replay of your visit, not just a count of clicks.

On our order page we do not record sessions at all. Everywhere else, every field you type into is masked before anything leaves your browser.

Legal basis: your consent. If you are in the EEA or the UK, we ask for it first and nothing runs until you allow it. Everywhere else you give it by continuing to use our site after we have shown you our cookie notice. Either way you can withdraw it at any time, in one click - section 5.3.

3.4 Choosing your currency

We sell in eleven currencies. When you arrive, we read the country your connection appears to come from - a header our hosting provider adds - to decide which one to show you first. You can change it at any time, and your choice is the one that is used.

We do this without any third-party location lookup: nothing about your visit is sent to a geolocation service, and we do not store your IP address for this purpose or use it to build any profile of you.

We read the same header for one other thing, and only one: to work out which of the two consent rules in section 5.2 applies to you. That answer - one of two words, with no identifier attached - is kept in a strictly necessary cookie so we do not have to work it out again on every page.

Legal basis: our legitimate interest in showing you a price in a currency you can use, and in applying the right consent rule to you. You can override the currency with one click.

3.5 Emails we send you

We use an email delivery provider to send order emails and, if you asked for them, marketing emails. It processes your email address and the content of those messages, and records whether a message was delivered.

Legal basis: performance of our contract for order emails; your consent for marketing emails.

4. The child's information

4.1 We ask what you call the child - a nickname is enough, and we deliberately do not ask for a full name. We also collect whatever you choose to write in your message. We do not ask for a date of birth, photograph, address or any other identifier, and we ask you not to send them. If you do, we delete them.

4.1A This is a design choice, not a formality. The personalisation you are buying comes from the story you share, not from identifying a child - so the less we hold, the less there is to lose.

4.2 We use the name or nickname only to make and deliver your order, and to answer you about it.

4.3 We do not publish the child's name or nickname in any public listing, sample, testimonial or marketing material, and we never use it for advertising, profiling or marketing of any kind.

4.4 You, or a parent or guardian of the child, can ask us to delete everything we hold about the child at any time, whether or not your order is finished. Email hello@littlemagic.app.

Two things you should know before you ask:

  • We must keep a minimal payment record - the amount, date, currency and order reference - because Hong Kong tax law requires it (section 8). We strip the name, your message and your lyrics out of it.
  • Deleting your details ends our commitment to keep your song links working, because we will no longer hold what is needed to honour it. Please download your songs first.

We act within 7 days.

4.5 A parent or guardian may also ask us for a copy of what we hold about the child, or ask us to correct it, on the same contact details.

4.6 Our website is sold to adults and is not directed at children. We do not knowingly collect personal information directly from a child.

5. Cookies, analytics and session recording

5.1 What we use

Category What it does When it runs
Strictly necessary Keeps the site working, holds on to an order you are part-way through so a failed payment does not lose it, remembers your cookie choice, and records which country your connection appears to come from so we know which of the two rules in 5.2 applies to you Always. The site does not work without these, and they cannot be turned off
Payment (Stripe) Stripe's own cookies on its checkout page, to take the payment and prevent fraud When you pay - necessary to do so
Analytics and session recording Page views, clicks, funnel steps, and a replay of your visit In the EEA and the UK: only after you allow it. Everywhere else: unless you turn it off in our footer

We keep each of these no longer than we need it for the purpose in the middle column.

The country cookie is one of two words - which rule applies to you - and nothing else. It carries no identifier, and we do not store your IP address to produce it.

5.2 How consent works - and it depends where you are

Two rules, because the law is not the same everywhere. We work out which one applies from the country your connection appears to come from, using a header our hosting provider adds. If we cannot tell, you get the stricter of the two.

If you are in the EEA or the UK, we ask you first, and nothing in the analytics row above loads until you answer. We show you a choice with Allow and Decline given equal weight, and until you pick one the answer is treated as no. Declining is not a lesser option and costs you nothing: the site works exactly as it did before, you are simply not measured. If you decline, we do not ask again on that device unless you change it yourself in the footer.

If you are anywhere else, we show you a notice instead of a question. It says that, by using our website and services, you agree to our use of cookies as described in this policy, and continuing to use the site is how you give that agreement. Analytics runs from the start, and the footer control turns it off - section 5.3.

Strictly necessary cookies run either way, wherever you are. They are what makes the site work, so there is nothing to agree to.

5.3 Changing your mind

Use the Cookie choices link in our footer, at any time, to turn analytics and session recording off - or back on. It takes one click, we do not ask you why, and we remember it on that device. Withdrawing is exactly as easy as agreeing was, wherever you are and whichever of the two rules in 5.2 applied to you.

Withdrawing does not affect anything collected before you withdrew it, and we delete any session recordings of your visits on request - email hello@littlemagic.app.

6. Who we share your information with

Only the providers we need to run the business, and only for that purpose. We do not sell your personal information, and we do not share it for advertising.

6.1 The categories

We use service providers to process your payment, to send our emails, to host our website, for website analytics and session recording, and to generate the musical elements of your song. We also use professional advisers - accountants, tax advisers and lawyers - who see order and payment records where they need to.

Each provider gets only what it needs for that job. Each is bound by a written contract to use your information only on our instructions and only for that purpose, and none of them is permitted to use it for its own marketing or to sell it on.

6.2 One worked example: Stripe

Payment is processed by Stripe, on a page hosted by Stripe rather than by us.

  • Stripe gets: your name and email address, your card and billing details (entered by you, directly into Stripe), and the order reference and amount.
  • We get back: a payment confirmation, the order reference, the amount, the last four digits of the card, and the billing country.

Stripe acts partly as our service provider and partly on its own account, for example for fraud prevention and its own legal obligations. Stripe's own privacy notice governs that part.

6.3 Why we do not list them all

We do not publish the full list of our suppliers and business partners, because who we work with is commercially confidential. What we publish instead is the purpose each category serves, above, and what your information is used for throughout this policy - which is what actually determines what happens to it.

If you want to know who handles your information for a particular purpose, ask us and we will tell you: hello@littlemagic.app.

6.4 Everyone else

We may also disclose information where the law requires it, or to establish or defend legal claims.

7. Where your information is handled

7.1 We are based in Hong Kong, and we handle your information there. Our providers handle it in other countries too, including the United States and countries in the European Union.

7.2 If you are in the EU or the UK, you are giving your information directly to a company outside those regions. Hong Kong is not covered by an EU or UK adequacy decision, so it has not been formally assessed as offering equivalent protection. You should know that before you order.

7.3 What protects it. Wherever your information is handled, we apply this policy, our security measures in section 11, and your rights in section 9 - which we honour regardless of where you live.

7.4 When we pass information on to the providers described in section 6, and those transfers leave the EU or the UK, we rely on [[CONFIRM - the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, contained in each provider's data processing agreement]]. You can ask us for details at hello@littlemagic.app.

8. How long we keep things

We store your personal data for as long as is necessary for the proper business needs of our company, and no longer. We do not keep things because they might one day be interesting.

In practice, what sets the period is one of these:

  • your order - we keep what we need while we are making and delivering your song, and while a revision, a question or a complaint about it is still possible;
  • the promises in our Terms - we keep enough to re-issue a broken song link and to give you notice before we stop hosting your songs, for as long as those promises run (Terms sections 10.1 and 10.4);
  • your marketing choice - we keep your name and email address while you are subscribed, and afterwards we keep a record that you unsubscribed, because that record is how we make sure we do not email you again; and
  • the law - in particular, the Hong Kong Inland Revenue Ordinance requires us to keep business records of our income and expenditure for a minimum number of years after the transactions they relate to. Our payment and accounting records therefore outlive everything else, and we have no choice about that.

Where we must keep a payment record but no longer need the personalised content, we strip the content out and keep only what the record requires - the amount, the currency, the date and the order reference. This is how we reconcile the tax rule with the deletion right in section 4.4.

When a period ends, or when you ask us to delete under section 4.4, we delete the information or strip it of anything that identifies you.

If you want to know how long we will hold something in particular, ask us at hello@littlemagic.app and we will tell you.

9. Your rights

9.1 If you are in the EU or the UK

You have the right to:

  • be told what we do with your information - this policy;
  • get a copy of what we hold about you;
  • correct anything wrong;
  • have it deleted, in the circumstances the law allows;
  • restrict or object to how we use it;
  • receive it in a portable format, or have us send it to another provider; and
  • withdraw consent at any time where we rely on consent, without affecting what we did beforehand.

Email hello@littlemagic.app to exercise any of these. We do not charge. We reply within one month. If your request is unusually complex we may take up to two further months, and we will tell you within the first month if that happens.

You can also complain to a regulator. In the EU, the data protection authority where you live or work. In the UK, the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first.

9.2 If you are in Hong Kong

Under the Personal Data (Privacy) Ordinance you may ask whether we hold personal data about you, ask for a copy, and ask us to correct it if it is wrong.

Send requests to Privacy Contact at hello@littlemagic.app, or to our registered address. We do not charge for this, although the Ordinance would permit us to.

You may complain to the Office of the Privacy Commissioner for Personal Data at pcpd.org.hk.

9.3 If you are in California

We do not sell or share personal information as those terms are used in California law, and we do not use it for cross-context behavioural advertising. [[REVIEW AS TRAFFIC GROWS - SEE NOTE 5]] If you are a California resident and want to exercise a privacy right, email hello@littlemagic.app and we will handle your request the same way as section 9.1.

9.4 Everywhere else

Wherever you live, email hello@littlemagic.app and ask us what we hold, ask us to correct it, or ask us to delete it. We will help regardless of whether a law compels us to.

10. Marketing

This section is the full and governing statement of how we market to you. Section 20 of our Terms and Conditions summarises it; where the two differ, this section applies.

10.1 We only market to you if you asked us to

We always send emails about your own order - that is part of the service you bought.

We only send marketing emails if you ticked the optional box on the order page. That box is unticked by default, is never a condition of buying, and is separate from every other box on the form.

10.2 What we use, and what we send you

We are required to tell you this specifically, so here it is in full.
The personal data we use for marketing Your name and your email address. Nothing else - and never the child's name, your note, or your lyrics.
What we send you Emails about new Little Magic songs and packages, seasonal offers, and product news.
What we sell or promote Our own personalised song packages and related services. Nothing belonging to anyone else.
How often no more than twice a month.
Who sends it Us, through our email delivery provider.

Legal basis: your consent.

10.3 We never pass your details to anyone else

We do not provide your personal data to any other party for their own marketing - whether in return for money or anything else, and whether or not they are connected to us. If that ever changed we would have to come back and ask you first, separately.

10.4 Stopping

Every marketing email has an unsubscribe link. You can also email hello@littlemagic.app and simply say stop.

  • It is free, you do not have to give a reason, and we act on it without delay.
  • We apply it across all our marketing, not only the message you clicked.
  • Unsubscribing never affects your order, your songs, your links, or the emails we send about them.

10.5 Withdrawing consent

Marketing consent is consent, so you can withdraw it whenever you like and it costs you nothing. Withdrawing does not make anything we sent beforehand unlawful. We keep a record that you unsubscribed, and when - that record is how we make sure we do not email you again.

11. How we protect your information

  • All traffic to our site is encrypted in transit (HTTPS).
  • Card details never reach our servers. Stripe handles them under PCI DSS.
  • Access to our order inbox and provider accounts is limited to the people who need it and protected by two-factor authentication.
  • We keep personal information out of analytics event data and out of page addresses. Every field on the order form is marked so our analytics tool cannot capture it, and an automated test checks on every build that no analytics request carries the child's nickname or your email address.
  • No system is perfectly secure. If a breach affects your information and the law requires it, we will notify you and the relevant regulator without undue delay.

12. Automated decisions

We do not profile you, and we do not make decisions about you by purely automated means that produce legal or similarly significant effects for you. One exception is worth naming: Stripe's fraud screening may automatically decline a payment. If that happens and you think it is wrong, email hello@littlemagic.app and a person will look at it.

13. Changes to this policy

We may update this policy. The version number and effective date at the top tell you which version is current. If a change materially affects how we use your information, we will tell you by email or by a notice on the site before it takes effect.

14. Contact us

hello@littlemagic.app - for anything in this policy, including access, correction and deletion requests.

Rhapta Limited, Two Harbourfront, 22 Tak Fung Street, Hung Hom, Kowloon, Hong Kong