Privacy notice
Last updated: 25 October 2026.
Who is responsible?
BumpOnIt is operated by Birthsparks Ltd, a company registered in Scotland, number SC437142, at 6 Alloway Place, Ayr, Scotland, KA7 2AA. Birthsparks Ltd is the controller of the personal information described here. Contact cass@birthsparks.com about privacy, your information or this notice.
What we collect and why
| Information | Purpose and lawful basis |
|---|---|
| Account information supplied to Clerk, such as your email address, optional name, authentication information and account identifier. | To register and authenticate you and provide the account features you request: performance of our agreement with you. Security and abuse prevention also serve our legitimate interests in protecting users and the service. We do not receive your plain-text password. |
| Names you give your wishlists, saved product identifiers and creation/update times. | To store and display your private lists across devices: performance of our agreement with you. Lists are not public registries and are not sold to advertisers. |
| Seller-interest or other enquiry details you provide, such as your business name, contact email, website and message. | To respond, assess your enquiry and maintain relevant correspondence: our legitimate interests in communicating with prospective partners, or steps you request before a contract where applicable. Registering interest does not subscribe you to marketing. |
| Technical connection/security information, such as IP address, browser details, request logs and hashed anti-abuse identifiers; admin change records for team accounts. | To deliver, secure and troubleshoot the service and prevent misuse: our legitimate interests in maintaining a reliable and secure website. We minimise information used by application anti-spam controls. |
| Your choices for individual external-player providers. | To remember your choices and prevent optional players loading against your wishes. Selecting a clearly labelled load button beside its privacy explanation enables that provider. You can withdraw permission through . |
We do not ask for pregnancy dates, medical histories, children's profiles or payment-card details. Please do not enter medical or other sensitive information in wishlist names or enquiry messages. The service is intended for adults. Contact us if a child has supplied personal information.
Who helps us provide the service?
We use Vercel for hosting and public editorial image storage, Neon for application data, Clerk for accounts, and Resend for transactional email. Authorised Birthsparks staff and contractors may access information only as needed for their work. Professional advisers or authorities may receive information when necessary to meet legal obligations or establish or defend legal claims.
These providers may process information in the UK, EEA, United States or other countries. Restricted transfers require applicable safeguards, such as an adequacy decision or appropriate contractual safeguards. Contact us for details of the relevant provider arrangements and safeguards. Optional-player consent does not replace the safeguards required for our own service-provider transfers.
Retailers, sources and external media
Purchases take place on retailers' websites, under their own privacy notices. An affiliate link may identify BumpOnIt as the referring publisher. We do not send your private wishlists or account email to retailers as part of following these links. Retailers and affiliate networks may apply their own cookies or tracking after you visit; review their choices and notices.
YouTube, Vimeo and Spotify players are optional and never load automatically. Choosing the named provider's load button enables its player; this can involve cookies and device information for playback, analytics and advertising, including processing outside the UK/EEA. Choices are separate for each provider and can be withdrawn in Privacy choices. Cover images do not depend on player permission. Genuine episode thumbnails from supported YouTube, Vimeo and Spotify image hosts are delivered through a restricted BumpOnIt server relay. The relay fetches only the public image and does not forward your browser's cookies, sign-in details, IP address or request headers to the image provider. The provider receives the server's network request. Images may be cached for up to one day on our delivery network and one hour in your browser before being refreshed. Uploaded covers and other approved image hosts continue to work normally; their hosts receive ordinary image requests. Original thumbnail URLs and creator credits remain in the post. Original-source links remain available without enabling embeds. Other approved product/editorial image hosts may receive ordinary image-request information, such as your IP address. See our cookies and external-media notice.
How long do we keep information?
- Account and wishlist information is used while your account remains active. You can remove individual lists yourself. Account deletion triggers removal of associated BumpOnIt wishlists; provider backups expire according to their configured recovery cycles.
- Pending email content is erased after successful sending, or expired through the operational cleanup process after the retry period. Minimal delivery records are retained to prevent duplicate messages; the welcome record is removed when its account is deleted.
- Anti-abuse counters expire after their short control windows. Hosting and email-provider logs are subject to provider retention settings.
- Enquiry correspondence is reviewed at least annually and deleted when no longer needed. An ongoing business relationship or a legal requirement may justify longer retention. Copies in the receiving business inbox are managed by Birthsparks, separately from this website.
- Admin and security records are retained only as needed for accountability, security, resolving disputes and applicable legal obligations. We review retention periodically. A deletion request may not require erasing records we are legally entitled or required to retain.
- Your media choice is remembered for up to six months on this browser.
Your rights and choices
Depending on the circumstances, UK GDPR and EU GDPR provide rights to access, correct, erase, restrict or receive a portable copy of personal data, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting processing already carried out lawfully. We do not use your account or wishlists for automated decisions producing legal or similarly significant effects.
You can edit or delete lists in Wishlists and manage your account through account settings. To request other information, correction or deletion, email cass@birthsparks.com. We may need to confirm your identity, and normally respond within one month; we will explain any lawful extension or restriction. Do not send passwords, verification codes or unnecessary identity documents.
Your account tools
Sign in to use these tools. For a wider information request, contact us by email.
Questions or complaints
Please contact us first so we can try to resolve your concern. You can complain to the UK Information Commissioner's Office. If EU GDPR applies to your information, you may also contact the competent EEA supervisory authority, including where you live, work or believe an infringement occurred.
Changes to this notice
We will update this page when the service or our use of information changes, and provide additional notice where legally required.