Legal

Privacy Policy

This policy was last reviewed on 1 November 2026.

This policy explains what personal data BrightPath Audio ("we", "us") collects through brightpathaudio.com, why, and what rights you have over it. We aim to collect as little as possible.

Who we are

BrightPath Audio is the data controller for information collected through this site, operated by Abel Isichei as a sole trader. Address: Abel Isichei trading as BrightPath Audio, Ref 173594, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, United Kingdom. We are registered with the UK Information Commissioner's Office (ICO) as a data controller, registration number ZC258939. You can reach us at hello@brightpathaudio.com.

What we collect

Information you give us

Contact form: name, email address, and the content of your message, plus anything you choose to include.
Email list sign-up: your email address and the date and time you agreed to receive emails. If you sign up through a Facebook or Instagram form, that form may also share your name.
Supporter subscription: your email address, subscription status and plan, and a browser access token so we can unlock episodes. Card payments are handled by Stripe. We never see or store your full card number. Stripe tells us the payment status, card type and last four digits.

Information collected automatically

Server logs: our hosting provider automatically logs IP address, browser type, pages requested, and timestamps, for security and troubleshooting.
Analytics (only with your consent): if you accept analytics cookies via the banner, we use privacy-conscious analytics to understand aggregate site usage (pages viewed, approximate location at country/region level, device type). This does not run before you consent, and you can withdraw consent at any time — see our Cookie Policy.

You don't need an account to listen to free episodes. Our Children's Stories show is for young listeners to enjoy with a grown-up, but this site doesn't collect personal data from children. Email sign-ups, Facebook/Instagram lead forms and subscriptions are for adults (18+). We don't use analytics or advertising cookies on our Children's Stories pages. If you think a child has given us personal data, email hello@brightpathaudio.com and we'll delete it.

Why we use it, and our legal basis

Responding to your message (contact form) — legal basis: your consent, given when you submit the form, and our legitimate interest in responding to enquiries.
Sending you BrightPath emails (email list) — legal basis: your consent, given when you sign up. We send free story packs, new episodes and church resources, and every email has an unsubscribe link.
Keeping the site secure and working (server logs) — legal basis: legitimate interest.
Understanding site usage (analytics) — legal basis: your consent, given via the cookie banner.
Providing your Supporter subscription — legal basis: performance of our contract with you.
Keeping payment and tax records — legal basis: legal obligation (UK tax law).

You can withdraw your consent to marketing emails at any time, and you have an absolute right to object to direct marketing. Withdrawing doesn't affect anything we did before.

How to unsubscribe

Every email we send has an unsubscribe link at the bottom. You can also ask us directly at hello@brightpathaudio.com and we'll remove you.

Who we share it with

We do not sell personal data. We share the minimum necessary with:

Our hosting and email-delivery providers, to operate the site and deliver contact-form messages.
Brevo, our email marketing platform — it stores your email-list details and sends the emails you signed up for.
Make.com, a form-automation service that connects our sign-up form to Brevo. It passes your details straight through and does not otherwise use them.
Stripe (Stripe Payments Europe Ltd, Ireland, and Stripe, Inc., USA): processes subscription payments.
Meta (Meta Platforms Ireland Ltd; Meta Platforms, Inc. outside Europe): only if you sign up through one of our Facebook or Instagram lead-ad forms. Meta hosts the form and passes your answers to us on our behalf. Meta separately uses information about your activity on Facebook/Instagram under its own privacy policy.
An analytics provider, only if you've consented to analytics cookies.
Law enforcement or regulators, only where we're legally required to.

How long we keep it

Contact form messages are kept for up to 24 months for our records, then deleted. Server logs are retained for up to 90 days for security purposes before being purged automatically.

Email-list details are kept for as long as you're subscribed. If you unsubscribe, we move your email to a suppression list purely so we know not to email you again, and delete the rest of your details.

If you're subscribed to emails but haven't opened or clicked one in 24 months, we'll delete your details. Leads downloaded from Meta are deleted once imported into Brevo, and within 90 days at most. Supporter and payment records are kept for 6 years after your subscription ends (UK tax rules). Your access token is deleted when your subscription ends.

Your rights

Under UK GDPR, you have the right to: access the personal data we hold about you; ask us to correct or delete it; object to or restrict certain processing; and request a copy in a portable format. To exercise any of these, email hello@brightpathaudio.com. If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

If you live in the EU (including Ireland), you have the same rights under the EU GDPR and can complain to your local data protection authority (in Ireland, the Data Protection Commission, dataprotection.ie). If you live elsewhere (for example the USA, Canada, Australia, Nigeria, Kenya, Ghana, South Africa, India or the Philippines), you have the rights given by your local law, and we'll honour requests to access, correct or delete your data, or to stop marketing, wherever you live. Email hello@brightpathaudio.com. We reply within one month.

International transfers

Brevo (France) and Make.com (Czech Republic) store data in the EU, which the UK recognises as adequate. Meta, Stripe and our analytics provider may process data in the USA. Where data leaves the UK, we rely on the UK-US Data Bridge (for US companies certified to it) or the UK International Data Transfer Agreement/Addendum to the EU Standard Contractual Clauses. For EU users, the equivalent EU safeguards apply (the EU-US Data Privacy Framework or the EU Standard Contractual Clauses).

My Name Story (personalised stories)

This section explains how we use personal information when a parent or guardian orders My Name Story: a personalised audio story with a child's first name in it, and a printable certificate. It adds to the rest of this privacy policy. If anything here is different from the rest of the policy, this section applies to My Name Story.

Who we are

BrightPath Audio is the controller of this information, which means we decide how it's used and we're responsible for it. BrightPath Audio is run by Abel as a UK sole trader. Address: Brightpathaudio, 173594, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, United Kingdom. Email: hello@brightpathaudio.com. We're registered with the UK Information Commissioner's Office (ICO): registration number ZC258939.

For grown-ups only

Only a child's parent or guardian, aged 18 or over, may order. We never collect information from children. Children don't use this service: they don't visit an account, log in or fill anything in. A grown-up gives us the child's first name, and a grown-up receives the story.

What we collect, and where it comes from

From you, on the short form after checkout:

your child's first name (or up to three first names for siblings);
an optional note on how to say each name;
which of our three stories you'd like;
the email address you used at checkout, and your order number if you have it;
your tick to confirm you've checked the spelling.

At checkout (run by Payhip): your name, email address, billing details, order details, and your two confirmations (that you're the child's parent or guardian and aged 18 or over, and that you understand the cancellation rules for a personalised item). Payment is handled by Stripe. We never see your full card details.

Your child's first name comes from you, not from your child or anyone else.

We don't ask for, and please don't send us, your child's surname, age, date of birth, school, address, photos, or voice or video recordings. If you send anything like this by mistake, we won't use it and we'll delete it.

You don't have to give us any of this information, and no law requires you to. But we can't make a personalised story without a first name, or send it to you without an email address.

What we use it for

To make your child's story and certificate, check them, and email them to you.
If we need to, to email you one question about how to say a name.
To fix a mistake, give you a refund, or deal with a question or complaint.
To keep a simple record that each story was checked and sent, and when it's due to be deleted. This record doesn't include your child's name.

We don't use any of this for marketing (ordering doesn't add you to our mailing list). We don't use it to build a profile of you or your child, and we don't sell it.

Our lawful basis: legitimate interests

The law says we need a "lawful basis" to use personal information. For My Name Story we rely on legitimate interests (Article 6(1)(f) of the UK GDPR and, for customers in the EU, the EU GDPR). This means we use the information because there's a genuine reason to, the use is limited to what's needed, and it doesn't override your or your child's interests. The interests are:

yours: to receive the personalised story you asked for, as a gift for your child;
your child's: to enjoy a gentle story with their own name in it;
ours: to run our small business making and selling personalised stories, and to put things right if there's a problem.

Because a child's information is involved, we've given your child's interests extra weight. We wrote down our assessment (a "legitimate interests assessment") and took extra steps to protect children: first name only, a person checks every story, no marketing, no public sharing, and deletion after 30 days. You can ask us for a summary of the assessment at hello@brightpathaudio.com.

We keep basic business records (order number, date, product, price and any refund) because UK tax law requires it (legal obligation, Article 6(1)(c)). These records don't include your child's name.

How we use AI

Episodes are created and narrated with AI. Some episodes publish automatically. After publishing, the BrightPath team checks every episode for quality and child safety.

Each personalised story is listened to by a person before it is sent.

For My Name Story in particular:

The stories are written in advance. To make the audio, we put your child's first name into the story and send that story text to our AI voice provider, which turns it into speech. We don't send them your email address or anything else about you or your child.
We use a ready-made AI voice. We never record, use or copy your child's voice, or anyone else's.
We switch off ElevenLabs' option to use our content to train its AI before we make any story, and we delete each story from our ElevenLabs account after we've sent it to you.
No decisions about you or your child are made by automated means alone. A person listens to every story before it's sent.
We never type your child's name into AI chat tools.

Who we share it with

We share information only with companies that help us provide the story, under contracts that require them to protect it and use it only on our instructions:

Tally (Tally BV, Belgium) runs the short form after checkout. It stores your child's first name(s), pronunciation note, story choice and your email until we delete them.
ElevenLabs (Eleven Labs Inc., USA), our AI voice provider, receives the story text with your child's first name in it.
Hostinger provides our email (hello@brightpathaudio.com), so the delivery email and any messages about your order pass through it.

These companies make their own decisions about information they collect for their own purposes, under their own privacy policies:

Payhip (Payhip Ltd, London) runs our checkout and shop. It never receives your child's name, pronunciation note or story choice. Payhip says it keeps transaction details for 10 years for tax purposes, and we can't delete these. See payhip.com/privacy.
Stripe processes card payments. It never receives your child's name. See stripe.com/gb/privacy.

We may also share information if the law requires it (for example, a court order).

We'll never show or share your child's name publicly (for example on our website, in social media posts or in a podcast) unless you've given us written permission first. You can withdraw that permission at any time.

Information sent outside the UK

Tally stores form answers in the European Union (Belgium). The UK government has decided the EU protects personal information properly (UK "adequacy regulations"), so no extra safeguards are needed.
ElevenLabs stores data in the USA. Its contract with us includes the standard contractual clauses approved for the UK (the "UK Addendum"), which require it to protect the information. ElevenLabs also says it is certified under the UK Extension to the EU-US Data Privacy Framework.
Hostinger (Hostinger International Ltd, Cyprus, EU) may store email in the UK or the EU. The EU is covered by the UK adequacy regulations mentioned above.
Stripe may transfer payment information to the USA under its own safeguards (described in Stripe's privacy policy).

You can ask us for a copy of the safeguards we rely on: email hello@brightpathaudio.com.

How long we keep it

Your child's first name, the pronunciation note, your story choice, the form, our copies of the story and certificate, and our emails about the order: deleted 30 days after we send the story to you. Please save the files when they arrive: we can't send them again after that.
If you tell us within those 30 days that something's wrong, we fix it and re-send it, and the 30 days start again from the re-send. If we refund instead, we delete within 30 days of the refund.
If you ask us to delete sooner, we will (see "Your rights").
Some of our providers keep backup copies for a short time after we delete something. These are removed on the provider's normal schedule (Tally says within 90 days at most) and aren't used.
Business records (order number, date, product, price and any refund; no child's name): kept for as long as UK tax law requires, normally 6 years.
Payhip's own records of the order: kept by Payhip under its own policy (see above).

Your rights

You can ask us to:

give you a copy of the information we hold about you or your child (access);
correct it if it's wrong (rectification);
delete it (erasure);
limit how we use it while a question is sorted out (restriction).

(The right to "data portability" doesn't apply when we rely on legitimate interests, but we'll always give you a copy of what we hold if you ask.)

As the parent or guardian, you can use these rights on your child's behalf. To ask, email hello@brightpathaudio.com. We may need to check that the request comes from the person who placed the order. We'll reply within one month. It's free.

Your right to object. Because we rely on legitimate interests, you have the right to object to us using your or your child's information, at any time. Just email hello@brightpathaudio.com. If you object before we've sent the story, we'll stop, delete your child's name and give you a full refund. If you object after, we'll delete our copies straight away rather than waiting 30 days.

Complaints

If you're unhappy with how we've handled your or your child's information, please tell us first at hello@brightpathaudio.com. We'll confirm we've received your complaint within 30 days, look into it promptly, keep you updated, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113. If you live in the EU, you can also complain to the data protection authority in your country.

Children's privacy, wherever you live

We designed My Name Story to collect as little as possible about children: a first name, given to us by a parent or guardian, used only to make the story you asked for, checked by a person, and deleted 30 days after delivery.

UK and EU: the UK GDPR and, for customers in the EU, the EU GDPR apply.
USA: we don't collect personal information from children. A parent or guardian gives us the child's first name, and we use it only to make the story they ordered.
Elsewhere: if your country has its own data protection law, you have the rights that law gives you, and we'll help you use them.

Changes to this section

If we change how we use information for My Name Story, we'll update this section before the change takes effect. We'll never start using information already collected for something new without telling you first.

Changes to this policy

We'll update this page if how we handle your data changes, and update the "last reviewed" date above.

Contact

Questions about this policy: hello@brightpathaudio.com.