Privacy Policy

Little Magic

Version 1.9 | Effective 10 October 2026

In short

• We collect what we need to make and deliver your song or storybook, and very little else.
• We never see your card details. Stripe handles payment.
• A nickname is enough - we never ask for a child's full name, and we never publish what you do give us.
• In the EEA and the UK, our website analytics and session recording do not run until you say yes. Everywhere else they run unless you turn them off - one click in our footer does that. Either way, we never record our order page.
• We never sell your personal information and never share it for advertising.
• You can ask us to delete the child's details at any time - section 4.4 explains the two limits on that.
• Questions or requests: hello@littlemagic.app

1. Who we are

Rhapta Limited, a Hong Kong company trading as Little Magic, is the data controller for the information described here. Little Magic is a brand owned and operated by Rhapta Limited.

• Business Registration Number: 81132587
• Registered address: Two Harbourfront, 22 Tak Fung Street, Hung Hom, Kowloon, Hong Kong
• Privacy contact: hello@littlemagic.app, for the attention of Privacy Contact

We have not appointed a Data Protection Officer; we are not required to.

2. What this policy covers

Our website at https://littlemagic.app, the orders you place there, the messages you send us, and the emails we send you. It does not cover other companies' websites or services you may reach from links on ours, which have their own policies.

3. What we collect and why

3.1 Your order

We need this information to sell to you. Without it we cannot make or deliver your song or storybook.

We do not ask for, and do not accept, photographs. A storybook is made from the details in the table above. We do not create a likeness of the child, or of anyone else, from a photograph or from a description of their appearance, and we ask you not to send one. If a photograph reaches us anyway we do not use it, and we delete it when you ask us to or once we have told you we cannot use it.

3.2 Your payment

Payment is processed by Stripe, on a page hosted by Stripe.

• We never receive or store your full card number, expiry date or security code.
• Stripe collects, directly from you: your card details, your billing address and country, and technical information it uses to prevent fraud. What Stripe does with that is governed by Stripe's own privacy notice.
• We receive back from Stripe: a payment confirmation, an order reference, the amount, the last four digits of the card, and the billing country.

Legal basis: performance of our contract with you. We keep the payment record afterwards because Hong Kong tax law requires it - see section 8 - and for that retention we rely on our legitimate interest in complying with the law we are subject to.

3.3 Your use of our website

We use website analytics providers to understand how people move through our site. This may include the pages you visit, the links and buttons you use, your approximate location from your IP address, your device and browser, and a recording of your session on our site.

We call that out separately because it deserves it: session recording means a replay of your visit, not just a count of clicks.

On our order page we do not record sessions at all. Everywhere else, every field you type into is masked before anything leaves your browser.

Legal basis: your consent. If you are in the EEA or the UK, we ask for it first and nothing runs until you allow it. Everywhere else you give it by continuing to use our site after we have shown you our cookie notice. Either way you can withdraw it at any time, in one click - section 5.3.

3.4 Choosing your currency

We sell in eleven currencies. When you arrive, we read the country your connection appears to come from - a header our hosting provider adds - to decide which one to show you first. You can change it at any time, and your choice is the one that is used.

We do this without any third-party location lookup: nothing about your visit is sent to a geolocation service, and we do not store your IP address for this purpose or use it to build any profile of you.

We read the same header for one other thing, and only one: to work out which of the two consent rules in section 5.2 applies to you. That answer - one of two words, with no identifier attached - is kept in a strictly necessary cookie so we do not have to work it out again on every page.

Legal basis: our legitimate interest in showing you a price in a currency you can use, and in applying the right consent rule to you. You can override the currency with one click.

3.5 Emails we send you

We use an email delivery provider to send order emails and, if you asked for them, marketing emails. It processes your email address and the content of those messages, and records whether a message was delivered.

Legal basis: performance of our contract for order emails; your consent for marketing emails.

3.6 New-song alerts from our song pages

Each song page in our free library has an optional box where you can leave your email address to hear when a new song for that name is added. If you use it, we record your email address, which song page you were on (and so the name that page is for), the language you were reading our site in, the language your browser reports, and the time.

This is a separate list from our orders and from the marketing box on the order page. Signing up does not place an order, and it does not add you to our other marketing. Section 10.6 says exactly what we send.

Legal basis: your consent.

3.7 Releasing your songs to streaming stores

If you ask us to release your songs as an album on streaming stores (Terms section 11A) - by ticking the optional box on the order page, or by pressing the release button on your listen page - we send our music distributor the recordings, the nickname and album title you gave us, the lyrics, and the cover art. The distributor passes them to streaming stores such as Spotify, Apple Music, Amazon Music and YouTube Music, which then make the album public worldwide: anyone can find and play it, and the stores may display the lyrics. We also record that you asked, and when.

You can withdraw at any time: email hello@littlemagic.app and we will ask our distributor to take the release down within 7 business days. Stores and their caches may take longer to catch up, and we cannot recall copies that other people made while the album was public.

Legal basis: your consent.

4. The child's information

4.1 We ask what you call the child - a nickname is enough, and we deliberately do not ask for a full name. We also collect whatever you choose to write in your message. We do not ask for a date of birth, photograph, address or any other identifier, and we ask you not to send them. If you do, we delete them.

4.1A This is a design choice, not a formality. The personalisation you are buying comes from the story you share, not from identifying a child - so the less we hold, the less there is to lose.

4.2 We use the name or nickname only to make and deliver your order, and to answer you about it.

4.3 We do not publish the child's name or nickname in any public listing, sample, testimonial or marketing material, and we never use it for advertising, profiling or marketing of any kind.

The one exception is a release you ask for (section 3.7): if you ask us to release your songs to streaming stores, the nickname and album title you gave us appear as titles, and the lyrics may sing the nickname. That is limited to what Terms section 11A describes, and it ends when you ask for a takedown.

The name on a song page (section 3.6) is different: it is a name from our own public library, not something you tell us about a child. If you sign up there, we record that name only so we know which new songs you asked to hear about.

4.4 You, or a parent or guardian of the child, can ask us to delete everything we hold about the child at any time, whether or not your order is finished. Email hello@littlemagic.app.

Two things you should know before you ask:

• We must keep a minimal payment record - the amount, date, currency and order reference - because Hong Kong tax law requires it (section 8). We strip the name, your message, your lyrics and any storybook details out of it.
• Deleting your details ends our commitment to keep your song and storybook links working, because we will no longer hold what is needed to honour it. Please download your songs and storybook first.

We act within 7 days.

4.5 A parent or guardian may also ask us for a copy of what we hold about the child, or ask us to correct it, on the same contact details.

4.6 Our website is sold to adults and is not directed at children. We do not knowingly collect personal information directly from a child.

5. Cookies, analytics and session recording

5.1 What we use

We keep each of these no longer than we need it for the purpose in the middle column.

The country cookie is one of two words - which rule applies to you - and nothing else. It carries no identifier, and we do not store your IP address to produce it.

5.2 How consent works - and it depends where you are

Two rules, because the law is not the same everywhere. We work out which one applies from the country your connection appears to come from, using a header our hosting provider adds. If we cannot tell, you get the stricter of the two.

If you are in the EEA or the UK, we ask you first, and nothing in the analytics row above loads until you answer. We show you a choice with Allow and Decline given equal weight, and until you pick one the answer is treated as no. Declining is not a lesser option and costs you nothing: the site works exactly as it did before, you are simply not measured. If you decline, we do not ask again on that device unless you change it yourself in the footer.

If you are anywhere else, we show you a notice instead of a question. It says that, by using our website and services, you agree to our use of cookies as described in this policy, and continuing to use the site is how you give that agreement. Analytics runs from the start, and the footer control turns it off - section 5.3.

Strictly necessary cookies run either way, wherever you are. They are what makes the site work, so there is nothing to agree to.

5.3 Changing your mind

Use the Cookie choices link in our footer, at any time, to turn analytics and session recording off - or back on. It takes one click, we do not ask you why, and we remember it on that device. Withdrawing is exactly as easy as agreeing was, wherever you are and whichever of the two rules in 5.2 applied to you.

Withdrawing does not affect anything collected before you withdrew it, and we delete any session recordings of your visits on request - email hello@littlemagic.app.

6. Who we share your information with

Only the providers we need to run the business, and only for that purpose. We do not sell your personal information, and we do not share it for advertising.

6.1 The categories

We use service providers to process your payment, to send our emails, to host our website, for website analytics and session recording, and to generate the musical elements of your song and the text and illustrations of your storybook. We also use professional advisers - accountants, tax advisers and lawyers - who see order and payment records where they need to.

Each provider gets only what it needs for that job. Each is bound by a written contract to use your information only on our instructions and only for that purpose, and none of them is permitted to use it for its own marketing or to sell it on.

6.2 One worked example: Stripe

Payment is processed by Stripe, on a page hosted by Stripe rather than by us.

• Stripe gets: your name and email address, your card and billing details (entered by you, directly into Stripe), and the order reference and amount.
• We get back: a payment confirmation, the order reference, the amount, the last four digits of the card, and the billing country.

Stripe acts partly as our service provider and partly on its own account, for example for fraud prevention and its own legal obligations. Stripe's own privacy notice governs that part.

6.3 Why we do not list them all

We do not publish the full list of our suppliers and business partners, because who we work with is commercially confidential. What we publish instead is the purpose each category serves, above, and what your information is used for throughout this policy - which is what actually determines what happens to it.

If you want to know who handles your information for a particular purpose, ask us and we will tell you: hello@littlemagic.app.

6.4 Everyone else

We may also disclose information where the law requires it, or to establish or defend legal claims.

7. Where your information is handled

7.1 We are based in Hong Kong, and we handle your information there. Our providers handle it in other countries too, including the United States and countries in the European Union.

7.2 If you are in the EU or the UK, you are giving your information directly to a company outside those regions. Hong Kong is not covered by an EU or UK adequacy decision, so it has not been formally assessed as offering equivalent protection. You should know that before you order.

7.3 What protects it. Wherever your information is handled, we apply this policy, our security measures in section 11, and your rights in section 9 - which we honour regardless of where you live.

8. How long we keep things

We store your personal data for as long as is necessary for the proper business needs of our company, and no longer. We do not keep things because they might one day be interesting.

In practice, what sets the period is one of these:

• your order - we keep what we need while we are making and delivering your song or storybook, and while a revision, a question or a complaint about it is still possible;
• the promises in our Terms - we keep enough to re-issue a broken song or storybook link and to give you notice before we stop hosting your songs and storybooks, for as long as those promises run (Terms sections 10.1 and 10.4);
• your marketing choice - we keep your name and email address while you are subscribed, and afterwards we keep a record that you unsubscribed, because that record is how we make sure we do not email you again. A song-page sign-up (section 3.6) is kept the same way, for as long as you want to hear about new songs for that name;
• a release you asked for - an album released to streaming stores (section 3.7) stays public until you ask us for a takedown, and we keep the record that you asked for it, and of any takedown, for as long as the release or its takedown could be questioned; and
• the law - in particular, the Hong Kong Inland Revenue Ordinance requires us to keep business records of our income and expenditure for a minimum number of years after the transactions they relate to. Our payment and accounting records therefore outlive everything else, and we have no choice about that.

Where we must keep a payment record but no longer need the personalised content, we strip the content out and keep only what the record requires - the amount, the currency, the date and the order reference. This is how we reconcile the tax rule with the deletion right in section 4.4.

When a period ends, or when you ask us to delete under section 4.4, we delete the information or strip it of anything that identifies you.

If you want to know how long we will hold something in particular, ask us at hello@littlemagic.app and we will tell you.

9. Your rights

9.1 If you are in the EU or the UK

You have the right to:

• be told what we do with your information - this policy;
• get a copy of what we hold about you;
• correct anything wrong;
• have it deleted, in the circumstances the law allows;
• restrict or object to how we use it;
• receive it in a portable format, or have us send it to another provider; and
• withdraw consent at any time where we rely on consent, without affecting what we did beforehand.

Email hello@littlemagic.app to exercise any of these. We do not charge. We reply within one month. If your request is unusually complex we may take up to two further months, and we will tell you within the first month if that happens.

You can also complain to a regulator. In the EU, the data protection authority where you live or work. In the UK, the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first.

9.2 If you are in Hong Kong

Under the Personal Data (Privacy) Ordinance you may ask whether we hold personal data about you, ask for a copy, and ask us to correct it if it is wrong.

Send requests to Privacy Contact at hello@littlemagic.app, or to our registered address. We do not charge for this, although the Ordinance would permit us to.

You may complain to the Office of the Privacy Commissioner for Personal Data at pcpd.org.hk.

9.3 If you are in California

We do not sell or share personal information as those terms are used in California law, and we do not use it for cross-context behavioural advertising. If you are a California resident and want to exercise a privacy right, email hello@littlemagic.app and we will handle your request the same way as section 9.1.

9.4 Everywhere else

Wherever you live, email hello@littlemagic.app and ask us what we hold, ask us to correct it, or ask us to delete it. We will help regardless of whether a law compels us to.

10. Marketing

This section is the full and governing statement of how we market to you. Section 20 of our Terms and Conditions summarises it; where the two differ, this section applies.

10.1 We only market to you if you asked us to

We always send emails about your own order - that is part of the service you bought.

We only send marketing emails if you ticked the optional box on the order page. That box is unticked by default, is never a condition of buying, and is separate from every other box on the form.

The one other thing we send, and only if you asked for it, is a new-song alert from a song page - section 10.6. That is a separate, narrower list: signing up there does not tick the order-page box, and ticking that box does not sign you up there.

10.2 What we use, and what we send you

We are required to tell you this specifically, so here it is in full.

Legal basis: your consent.

10.3 We never pass your details to anyone else

We do not provide your personal data to any other party for their own marketing - whether in return for money or anything else, and whether or not they are connected to us. If that ever changed we would have to come back and ask you first, separately.

10.4 Stopping

Every marketing email has an unsubscribe link. You can also email hello@littlemagic.app and simply say stop.

• It is free, you do not have to give a reason, and we act on it without delay.
• We apply it across all our marketing, not only the message you clicked.
• Unsubscribing never affects your order, your songs, your storybook, your links, or the emails we send about them.

10.5 Withdrawing consent

Marketing consent is consent, so you can withdraw it whenever you like and it costs you nothing. Withdrawing does not make anything we sent beforehand unlawful. We keep a record that you unsubscribed, and when - that record is how we make sure we do not email you again.

10.6 New-song alerts from our song pages

If you left your email address on one of our song pages (section 3.6):

Sections 10.3, 10.4 and 10.5 apply to these alerts too: we never pass your address to anyone else, and you can stop at any time by replying to any alert or emailing hello@littlemagic.app, free and without giving a reason.

Legal basis: your consent.

11. How we protect your information

• All traffic to our site is encrypted in transit (HTTPS).
• Card details never reach our servers. Stripe handles them under PCI DSS.
• Access to our order inbox and provider accounts is limited to the people who need it and protected by two-factor authentication.
• We keep personal information out of analytics event data and out of page addresses. Every field on the order form, and the email field of the song-page sign-up, is marked so our analytics tool cannot capture it, and an automated test checks on every build that no analytics request carries the child's nickname or your email address.
• No system is perfectly secure. If a breach affects your information and the law requires it, we will notify you and the relevant regulator without undue delay.

12. Automated decisions

We do not profile you, and we do not make decisions about you by purely automated means that produce legal or similarly significant effects for you. One exception is worth naming: Stripe's fraud screening may automatically decline a payment. If that happens and you think it is wrong, email hello@littlemagic.app and a person will look at it.

13. Changes to this policy

We may update this policy. The version number and effective date at the top tell you which version is current. If a change materially affects how we use your information, we will tell you by email or by a notice on the site before it takes effect.

14. Contact us

hello@littlemagic.app - for anything in this policy, including access, correction and deletion requests.

Rhapta Limited, Two Harbourfront, 22 Tak Fung Street, Hung Hom, Kowloon, Hong Kong