Privacy Policy
Activity Atlas is operated by mDropit Ltd, company number 16351304.
Version: 1.4 Last updated: 26 July 2026 Effective: 26 July 2026
1. Who we are
Activity Atlas helps people discover, plan, save and book local activities, and helps activity providers list and manage their activities.
The data controller responsible for your personal data is mDropit Ltd ("Activity Atlas", "we", "us", "our"), a company registered in England and Wales with company number 16351304.
Registered office: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF
Contact: support@activityatlas.co.uk
ICO data protection fee registration: ZC178159. Registered on 19 June 2026; expires on 18 June 2027. You can verify our registration on the ICO public register.
2. What this policy covers
This policy covers the Activity Atlas website, mobile app, provider tools, booking flows and related services. It explains what personal data we collect, why we use it, who we share it with, how long we keep it, and your rights.
Children do not create Activity Atlas accounts. Adults may use Activity Atlas to plan or book activities for children. More child-focused information is in our Children's Privacy Notice.
No ad tracking, no sale of personal data
We do not use advertising identifiers, ad SDKs or cross-app tracking. We do not sell personal data. If we use optional analytics, they only run with your consent and are not used for advertising or to track you across other companies' apps or websites.
If you separately opt in to local activity news, offers or promotions, we may send Activity Atlas-controlled messages about activities or events in your chosen/coarse area, including paid placements from providers. We do not give those providers your contact details for their own marketing.
3. Personal data we collect
Parents and individual users
| Data | Examples | Why we use it |
|---|---|---|
| Account details | email address, optional account name, password if you set one, login/session data | create and secure your account |
| Participant details | private participant code and participant type/protection marker | link planner entries without collecting the participant's identity or age |
| Device-side participant details | optional name, nickname, initials or birth month/year you add for a participant | shown or used for an age-compatible class suggestion on that device; not collected by Activity Atlas |
| Planner and saved activity data | activities saved, added to planner, followed, dates, times, reminder settings and optional activity notes | provide your planner, saved list, reminders and service updates |
| Booking data | activity booked, attendee label or first name/initials where needed, optional birth month/year where supplied, booking status | manage bookings, trials, registers, disputes and provider attendance needs |
| Payments and subscriptions | Stripe or Apple payment identifiers, subscription status, invoice/payment status | process payments, subscriptions, refunds and tax/accounting records |
| Trial anti-abuse data | limited activity-trial redemption records linked to user, programme and participant/code where needed; Parent Plus trial/membership group records, owner-transfer records and payment/subscription status where needed; plus a hashed app install ID where the mobile app provides one | prevent repeated use of the same trial beyond the allowed limit |
| Location and search data | current location if you use "near me", postcode/search area, map preferences and recent on-device location cache | show nearby activities and remember your choices |
| Device and security data | IP address, user agent, device/app version, a random app install ID hashed on our server, security logs, rate-limit records and a human-verification result | keep the service secure, prevent abuse and diagnose problems |
| Communications | support messages; listing reports; adult reporter name, email, phone and optional company; report reason and message; an optional public evidence link; and a server-created snapshot of the reported provider/activity/venue and map location | investigate corrections, ownership/identity concerns and complaints, respond where needed, and keep appropriate records |
Public report and contact forms use Cloudflare Turnstile to distinguish a person from automated abuse. The Turnstile token is checked by the server and is not saved in the report. Activity Atlas does not use Turnstile for advertising and does not store the raw token or a raw IP address in the report record.
Activity providers
| Data | Examples | Why we use it |
|---|---|---|
| Provider profile | business name, description, address/venue, phone, website, social links, logos/images | publish and manage listings |
| Provider account and staff data | emails, names, roles, invitations, login/session data | manage provider access and permissions |
| Provider-submitted trust data | provider attestations, insurance/safeguarding/licence information where supplied by a registered or claiming provider | review provider-managed claims, decide whether trust markers can be displayed, and handle moderation |
| Schedule and booking data | programmes, sessions, prices, trials, bookings and attendance information | provide booking, scheduling and provider dashboard features |
| Payments and payouts | Stripe account IDs, subscription status, fees, payout status | process provider subscriptions, booking payments and payouts |
Children and participants
The people added to a planner are called participants. Participants can be children or adults. For privacy, a participant name is optional. The label you type, such as a name, nickname or initials, is designed to stay on your own device/browser. Optional birth month/year and any age derived from it also stay on that device. The app can use this locally to preselect one unambiguous provider-published class, but the adult always confirms the exact class. On our servers, Activity Atlas stores a private participant code, a participant protection marker and minimal planning data, not a participant name or age.
If you make a booking, a provider may need limited attendee details to run the session safely, such as a first name or initials and, only where needed, birth month/year or age information. Booking attendee data is separate from your private planner label.
Location privacy in the mobile app
If you allow location access, Activity Atlas uses your location while you use the app to show nearby activities. The app may keep a recent current-location fix only on your device to make nearby searches faster. When you search nearby, the app may send your search area or coordinates to our servers so we can return nearby activities, but we do not store a live location history, track your location in the background, or use your location for advertising.
4. Why we use data and our legal bases
| Purpose | Legal basis |
|---|---|
| Create accounts and provide the website/app | contract |
| Provide planner, saved activities, follows, bookings and reminders | contract |
| Send service messages, booking confirmations, cancellation notices and security messages | contract and legitimate interests |
| Send updates about providers or activities you follow, have booked or have connected to your planner | contract and legitimate interests; your choice to connect, which you can turn off at any time |
| Suggest connecting a planner item when a provider lists an activity you already planned, by comparing the item's venue and activity type with the new listing | legitimate interests; the suggestion has no effect unless you accept it |
| Process payments, subscriptions, refunds, payouts and accounting records | contract, legal obligation and legitimate interests |
| Prevent fraud, abuse, repeated trial misuse and security attacks | legitimate interests |
| Store minimal child/participant planning information added by a parent or authorised adult | consent for child-data authority, supported by our contract with the adult account holder |
| Use essential cookies and local storage | legitimate interests and contract |
| Use non-essential cookies or analytics, if enabled | consent |
| Send marketing, offers, local activity news or paid local placements | consent |
| Keep suppression records so we do not contact people who opted out | legal obligation and legitimate interests |
| Comply with legal requests, tax/accounting duties, safeguarding duties and disputes | legal obligation and legitimate interests |
Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing that happened before withdrawal.
5. Marketing and service updates
Service updates are messages needed to provide the service, such as booking confirmations, cancellations, reminder-related messages, account security emails, provider changes for activities you follow or have connected to your planner, and payment/subscription notices.
Marketing is different. We will only send promotional offers, local activity news or similar marketing where you have opted in. This may include paid local placements from providers, selected and sent by Activity Atlas using your chosen preferences and coarse area. You can opt out of marketing at any time.
6. Who we share data with
We do not sell your personal data.
We share personal data only where needed:
- with activity providers when you book their activity, so they can manage attendance and deliver
the activity;
- with payment providers such as Stripe and Apple to process payments, subscriptions and payouts;
- with hosting, storage, email, app distribution and technical service providers who help run the
service under contract;
- with Cloudflare where needed to deliver and protect the website and perform
human verification on public write forms;
- with professional advisers, insurers, regulators, authorities, courts or law enforcement where
required or reasonably necessary;
- with a buyer, successor or reorganised business if Activity Atlas is sold or reorganised, subject
to appropriate safeguards.
Providers receive only the booking/attendance information they need for the activity. We do not give providers your contact details for their own marketing in V1. Provider service messages and any opted-in local news or promotions are sent through Activity Atlas. If you connect a planner item to a provider's activity, the provider sees only aggregate numbers (for example, how many families are connected or were notified about a cancellation) — never which families, and never names or contact details.
7. Where data is stored and international transfers
Our main application and database are hosted in Germany, in the European Economic Area, using netcup GmbH. UK to EEA transfers are covered by the UK's adequacy recognition of the EEA.
Some third-party services, such as payment platforms, app-store platforms, email services or storage providers, may process data in other countries. Where personal data is transferred outside the UK or EEA, we rely on an appropriate transfer mechanism such as adequacy regulations, standard contractual clauses, the UK International Data Transfer Addendum, or equivalent safeguards.
8. How long we keep data
We keep personal data only as long as needed for the purposes in this policy.
| Data | Retention approach |
|---|---|
| Account and planner data | kept while your account is active; deleted or anonymised within 30 days after account deletion unless we need a limited record for legal, security, accounting or dispute reasons |
| Device-side participant labels | kept on your own device/browser until you change, clear or remove them |
| Recent mobile current-location cache | kept on your own device for a short period to make nearby searches faster; can be removed by clearing app data, reinstalling the app or changing device permissions |
| Booking and payment records | kept for up to 7 years where needed for tax, accounting, chargeback, legal or dispute purposes |
| Booking attendee labels and any attendee birth month/year or exceptional date of birth | normally anonymised 90 days after the activity or after any active dispute window closes, while non-identifying booking/payment records may be retained |
| Trial anti-abuse records | kept while needed to prevent repeated trial misuse, including Parent Plus trial restarts through family owner or payment-owner changes; limited anti-abuse records, including server-side hashes such as the app install ID hash, may be retained for up to 24 months after account deletion |
| Provider profile/listing data | kept while the provider account/listing is active, then deleted, archived or anonymised when no longer needed |
| Support, refund and complaint messages | normally kept for up to 2 years, or longer if needed for a legal, safeguarding, payment or dispute issue |
| Security logs and rate-limit records | kept for a limited security period and then deleted or aggregated unless needed to investigate abuse |
| Marketing preferences and suppression records | kept until changed, and suppression records may be kept longer to respect opt-outs |
| Backups | retained for operational recovery and overwritten or deleted on our backup cycle; if a backup is restored, we take steps to re-apply deletion or anonymisation where required |
9. How we protect data
We use technical and organisational measures designed for a small production service, including:
- HTTPS/TLS for data in transit;
- private server and database access;
- role-based access controls and least-privilege staff access;
- rate limiting and abuse prevention;
- audit logging for important account/provider actions;
- minimisation of child and participant data;
- local device/browser labels for participant names;
- short retention and anonymisation for booking attendee details;
- no child names or booking details in push/notification payloads where avoidable;
- reminder alarms scheduled and stored on your device, with an on-device record of which account
set them; they are switched off on that device when you sign out, switch account or lose access to an item, while the activities you planned stay in your account.
No internet service can be guaranteed perfectly secure, but we work to prevent, detect and respond to security issues.
10. Your rights
Under UK data protection law, you may have the right to:
- access a copy of your personal data;
- correct inaccurate data;
- delete data;
- restrict or object to some processing;
- receive certain data in a portable format;
- withdraw consent where we rely on consent;
- complain to the ICO.
You can export a copy of account data and delete your account from the product settings where those features are available. You can also contact us at support@activityatlas.co.uk. We normally respond to rights requests within one month.
You can complain to the ICO at ico.org.uk, although we would appreciate the chance to help first.
11. Automated decision-making
We do not make decisions about you that have legal or similarly significant effects using solely automated processing. We do not profile children for marketing.
When a provider joins Activity Atlas and lists an activity you already have in your planner, we may match on the venue and activity type to suggest connecting the two. The suggestion is only a prompt: nothing changes unless you accept it, the matching never uses your child's details, and providers are not told who matched.
12. Cookies
Our Cookie Policy explains how we use cookies, local storage and similar technologies.
13. Changes
We may update this policy. If we make material changes, we will notify users in a reasonable way, for example in the app, on the website, by email, or by asking for renewed acceptance where appropriate.