Privacy on
this website.

Who looks after your information?

Surprise Bear is the trading name of Kyle Hutchison, based in Edinburgh, Scotland, United Kingdom. Kyle is responsible for how the information described here is used (the data controller). Contact support@surprisebear.com with privacy questions or requests.

This notice covers our public product and support pages and correspondence with support. The app, lesson-download service and private content editor have different data flows; this website notice does not describe those services.

When you visit

Our hosting service receives technical information needed to deliver the pages and images: your IP address, request time, requested address, response status, browser information and a referring address when your browser supplies one. Hosting systems use records for service operation, troubleshooting, security and hosting statistics.

These public pages have no advertising trackers, third-party analytics, external fonts or third-party scripts. Their code does not set cookies or use browser storage. Choices in the illustrated examples and interactions with Orlo stay in the page’s memory: we do not submit your answers or interaction events, or save them for another visit. Requests for page files and images can still appear in ordinary hosting logs.

When you email for help

We receive your email address, message, delivery information and any attachments you send, so we can reply and investigate a problem. Providing this information is voluntary, but without a reply address and enough detail we may be unable to help. Emailing us does not subscribe you to marketing.

Please have a grown-up contact support. Leave out children’s names, photos, answers, religious beliefs and other private details. Check screenshots before attaching them. We do not need that information to answer an ordinary support question.

Why we use this information

We rely on legitimate interests in delivering and protecting this website, investigating technical problems and answering support that people request. We limit this use to those purposes; a visit or support email is not marketing consent.

Services that help us

Namecheap provides our website hosting and support mailbox. Jellyfish filters incoming mail for spam. Support correspondence is also accessed using email apps on our devices, including the Gmail app.

Our primary hosting location is the UK. Processing may also involve the United States and the provider’s contracted service providers. Namecheap’s Data Processing Addendum sets out contractual data-protection and international-transfer provisions, including UK-specific terms for international transfers. Follow that link or contact us for a copy and information about applicable safeguards.

We may also disclose information where a legal obligation requires it or where necessary to deal with a specific security incident or legal claim.

How long information is kept

We keep each support request while we deal with it, then for 12 months after it is resolved. A new request from the same person does not restart the clock for an older resolved request. We keep information longer only for a specific legal or security reason, and only for as long as that reason applies.

Hosting, mail-security and backup records follow the provider’s service, recovery and legal retention criteria. Our account is configured to remove the previous month’s archived raw access logs at month-end. That setting does not define the lifetime of every server log, statistics record or backup. Deleting a message from the live mailbox does not immediately erase copies in provider backups.

Your questions and rights

You can ask to access or correct your information, request deletion or restriction, and exercise other rights that apply under data-protection law. Rights and any exceptions depend on the circumstances. Contact support@surprisebear.com; we may need proportionate information to verify a request.

You can object to our use of your information based on legitimate interests. Email us to explain your objection, and we will consider it under the applicable rules.

You can complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator. You can contact us first, but you do not have to.

We will update this page when these practices change. The date above identifies the current notice.