Your information, kept to what is needed.
This notice explains how Small Grace uses personal information when you create, pay for, review or receive a Small Grace.
Last updated: 17 September 2026
Who is responsible for your information?
Small Grace is a trading name of John Parr, a sole trader and the data controller for the Small Grace service.
Contact: hello@asmallgrace.com
Correspondence address: Small Grace, 1 Old Hall Street, Liverpool, L3 9HF, United Kingdom. Visits are by appointment only.
What information we use
If you are the sender
We use your display name, email address, age band, order and payment status, message choices, the context you provide, and technical/security records needed to operate the service. If you deliberately choose a Christian tone or Bible reference, we also process that optional faith preference.
If you are the recipient
The sender may give us your first name, their relationship to you, whether you are under 13 or they are unsure, and limited broad context needed to shape the message. This information comes from the sender, not directly from you. Small Grace does not need your phone number, email address or home address.
Please do not submit sensitive recipient information. Senders are told not to provide medical diagnoses or treatment, disability details, religion or beliefs, ethnicity, political views, trade-union membership, sexual-orientation or sex-life information, criminal allegations, or other unnecessary sensitive details about a recipient.
Analytics
On public pages only, optional website analytics are loaded with analytics storage denied by default. Analytics is used only if you choose to accept it. Analytics is not used on private sender, recipient or payment pages.
Why we use information and our lawful bases
Providing the sender's order and personalised service: necessary to take steps at your request and perform our contract with you.
Minimal recipient information: our legitimate interests in providing the private message service requested by the sender. We reduce the impact on recipients by asking for only a first name and broad context, not contacting recipients ourselves, using private unguessable links, limiting access and deleting message content after a short retention period.
Security, fraud prevention and service integrity: our legitimate interests in protecting customers, the service and our systems.
Accounting, tax and other records we must keep: compliance with legal obligations and, where appropriate, our legitimate interests in establishing or defending legal claims.
Optional analytics: your consent. You can decline analytics and still use Small Grace.
Your optional Christian faith preference: your consent under Article 6(1)(a) UK GDPR and your explicit consent under Article 9(2)(a) for that special-category preference. This choice is separate and optional. You can use Small Grace without choosing a faith option and can withdraw that consent by contacting us. Withdrawal does not affect processing already carried out lawfully before withdrawal.
AI-assisted wording
Small Grace uses an AI service provider to help shape the sender's information into wording for a personal message. Where possible, sender and recipient names are replaced with placeholders before generation. The AI component is instructed to treat customer text as data rather than instructions, and generation requests are configured not to be stored by the AI provider for later retrieval through the API.
The sender reviews the result before sharing it. Small Grace does not use AI to make decisions that produce legal or similarly significant effects about the sender or recipient.
Who processes information for us?
We use carefully selected service providers to operate Small Grace, including providers of website delivery and security, secure cloud database and private storage, payment processing, AI-assisted message generation, transactional email delivery and optional website analytics. These providers process personal information only where necessary to provide their respective services and are subject to appropriate contractual and data-protection safeguards.
We do not put the sender's personal circumstances or message text into payment metadata. Payment-card details are handled by our payment processor rather than Small Grace.
International transfers
Some service providers may process information outside the United Kingdom. Where UK data-protection law treats this as a restricted international transfer, we require an applicable lawful transfer mechanism and safeguards, such as UK adequacy regulations or approved contractual safeguards, as appropriate. You can contact us for more information about the safeguards relevant to your information.
Promotional eligibility
To administer the Small Grace launch offer, we store a one-way SHA-256 hash derived from the sender email address together with the offer issue, expiry and redemption record. The plain email address is not stored in the promotional entitlement table. This eligibility record may be retained after private message content is deleted so the one-free-Small-Grace-per-customer limit can be administered and misuse prevented.
How long we keep information
- Unpaid or abandoned draft personal content is normally removed after expiry or around 24 hours of inactivity.
- Paid but unapproved personal message content is removed after 7 days.
- Approved personal message content and private access are removed 30 days after approval.
- Payment, order, compliance, accounting and security records that do not contain the personal message itself may be kept for up to 6 years where needed for tax, accounting, fraud prevention or legal claims.
- Optional analytics data is retained according to our configured analytics retention settings and your consent choice.
The sender and recipient can save or print the approved message before then.
Your data-protection rights
Depending on the circumstances, UK data-protection law gives you rights to ask for access to your personal information, correction, deletion, restriction, portability, and to object to certain processing. Where processing is based on consent, you can withdraw that consent at any time.
To exercise a right, email hello@asmallgrace.com. We may need enough information to verify your identity and locate the relevant record.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority. You can find complaint information at ico.org.uk.
Children
People creating a Small Grace must be at least 13. A sender aged 13–17 may prepare a message, but an adult aged 18 or over must authorise and complete the purchase. A recipient may be younger; in that case Small Grace minimises the information used and does not use AI generation for that recipient.
If sensitive information is submitted by mistake
Small Grace is not designed to collect sensitive details about recipients. If you believe sensitive information was entered by mistake, contact hello@asmallgrace.com as soon as possible and include the Small Grace order reference if you have it. Do not repeat the sensitive information in your email unless necessary.