Privacy
Last updated 27 October 2026
- The packs collect nothing. They work offline, with no ads, accounts or tracking.
- When you buy, we keep only what we need to deliver your packs and help you.
- We never sell your information. We send news emails only if you sign up for them, and you can leave any time.
- We follow the DIFC Data Protection Law. You can ask to see, correct or delete your information.
1. Who we are
ProsperityLab Technology Ltd runs this shop. We are a company registered in the Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates, with DIFC commercial licence CL12992. Our registered office is at IH-00-01-01-OF-01, Level 1, Innovation One, DIFC, Dubai, United Arab Emirates. Tinker Penny is part of TWin by ProsperityLab.
We are the “controller” of your personal data: we decide how it is used. We follow the DIFC Data Protection Law (DIFC Law No. 5 of 2020) and its regulations. For any privacy question, write to support@prosperitylab.ai. Please put “Privacy” in the subject.
2. Children
This shop is for grown-ups. Only adults can buy or sign up for our emails, and we don't knowingly collect personal data from children.
The packs themselves collect nothing. A child's name and progress in a guide are saved only in that web browser, on that computer. They are never sent to us, or to anyone else. Clearing the browser's data removes them.
3. What we collect, and why
| What | Why we use it | Our legal reason |
|---|---|---|
| Your name, email address and billing country | To deliver your packs, email you your link, help you, and handle refunds. | To carry out our contract with you |
| What you bought, what you paid, and when | To deliver your packs, and to keep accounting records. | Our contract with you, and our legal duties |
| That you accepted our terms at checkout | To show what you agreed to when you bought. | Our legal duties, and our legitimate interests |
| When a download first starts, how many times each pack is downloaded, and how many times its guide is opened online or its game in Play | To see whether you can still cancel, to keep each link within one family, and to help if a download fails. | Our contract with you |
| Your name and an order code, in your downloaded files, your online guides, your games in Play and your licence certificate | To show the packs are licensed to you, and to trace copies that are shared without permission. | Our contract with you, and our legitimate interests |
| Your email address, if you sign up for our news emails, and when you confirmed it | To email you about new packs and new guides for parents, about once a month. | Your consent. You can take it back at any time |
| Standard server logs, such as IP addresses | To keep the shop secure and working. | Our legitimate interest in a safe shop |
Your card details go straight to Stripe. We never see or store them. We ask for your consent only for our news emails. We don't need it for anything else above. We make no automated decisions about you.
4. Who helps us
We use a small number of trusted services. They handle your data only to provide their service to us, under written agreements:
- Stripe takes payments and keeps our order records. Stripe's own privacy policy also covers what you enter on its checkout page.
- Twilio SendGrid sends your download email, and our news emails if you sign up for them.
- Microsoft Azure hosts the shop and stores the pack files.
We share data with others only if the law requires it, for example with a court or regulator.
5. Sending data outside the DIFC
These services may store data outside the DIFC, including in the United States and the European Union. When data goes to a place the DIFC Commissioner of Data Protection hasn't found to have adequate protection, we use safeguards that the DIFC Data Protection Law allows. For example, we use standard data protection clauses in our agreements, and we check that you would still have rights and remedies there. You can ask us for details.
6. Emails
We email you about your order, for example your download link, or a reply when you write to us. Order emails have no tracking pixels, and their links aren't tracked.
We send news emails only if you sign up, and then confirm your address from the email we send you. They tell you about new packs and new guides for parents, about once a month. Every news email has a link to leave, and you can leave at any time. To help us make them better, our news emails may count whether an email was opened or a link was clicked.
7. Cookies and storage
We don't use analytics or advertising cookies. The shop uses one small cookie to remember your chosen currency. It keeps your bag in your browser's storage. Both are needed only to make the shop work. Play, our web app for the games, keeps your child's stars, stickers and settings, and your order link, in your browser's storage on that device. None of it is sent to us. Play also saves the games on the device so they work offline. Clearing your browser's data, or “Start fresh” in Play's grown-ups corner, removes it. Stripe's checkout page uses its own cookies to keep payments safe.
8. How long we keep it
DIFC company law asks us to keep accounting records, including orders, for at least six years. After that, we delete them. Server logs are kept for a short time only, for security.
If you leave our news emails, we stop sending them straight away. We keep your address on a do-not-send list, so you aren't added again by mistake. You can ask us to delete it completely.
9. Keeping it safe
The shop uses secure (HTTPS) connections. Download links are signed, so they can't be guessed or changed. Anyone who has your link can download your packs, so please keep it within your family. If a data breach puts your rights at high risk, we'll tell you as soon as we can.
10. Your rights
Under the DIFC Data Protection Law, you can ask us:
- to tell you what personal data we hold about you, and give you a copy;
- to correct it if it's wrong;
- to delete it, unless the law asks us to keep it, as with accounting records;
- to limit how we use it, or to stop using it for a purpose you object to;
- to send it to you, or to another company, in a common digital format.
Write to support@prosperitylab.ai. It's free. We reply within one month. If your request is complex, we may need up to two more months, and we'll tell you why within the first month. We may ask you to confirm who you are first.
11. Complaints
If you're unhappy with how we use your data, please tell us first, so we can put it right. You can also complain to the Commissioner of Data Protection in the DIFC. You may also have the right to bring a claim in the DIFC Courts.
If you live in another country, such as in the European Union, the United Kingdom or India, you may also have rights under its data laws. You can contact the data protection authority there too.
12. Changes
If we change this notice, we'll update the date at the top. If a change matters to you, we'll explain it on this page.