Privacy notice

Squidge Squadge Pty Ltd, trading as Little World, operates the indoor play centre and the booking system on this site. We are the data controller for your information. Movimento Agency (movimentoagency.com.au) operates the booking software on our behalf as our processor.

Questions: email bookings@squidgesquadge.com.au.

• Your name, email and (optional) phone number when you book.
• The ticket types you choose — the age tier you tick implies your child's age range. We don't collect your child's name, date of birth or other identifying details except for annual pass holders, where we record the child's first name to tie the pass to its owner.
• Card payments are tokenised by Square — Little World never sees or stores your card number or CVV.
• Booking metadata: session date and time, ticket counts, total paid, any promo or pass code used, attendance status.
• Technical metadata: IP address and user agent on admin actions (for security auditing).

• To confirm your booking and email you the QR code.
• To contact you if a session changes (e.g. closure, illness, weather).
• To process refunds when you cancel.
• To meet our legal obligations under Australian tax law (retention of transaction records).
• To protect our system from abuse (rate limiting, fraud prevention).

• Square — payment processing. Receives your card token, billing email, and order amount.
• Resend — transactional email delivery. Receives your email, name and booking details.
• Supabase — database hosting (Sydney region). Holds all the booking data we collect.
• Vercel — application hosting. Sees IP and request metadata but no card data.
• Movimento Agency — our software contractor, under a written processor agreement.

We do not sell your information. We do not use it for marketing from third parties.

• Confirmed bookings: 7 years from session date (Australian tax record retention).
• Cancelled or expired bookings: phone number purged after 90 days; aggregate data kept for capacity analytics.
• Session Packs: kept until valid_until + 7 years.
• Admin audit log: 2 years.
• Payment provider event logs: 90 days then redacted.

• Access: ask us for a copy of the personal information we hold about you.
• Correct:ask us to fix anything that's wrong.
• Erase: ask us to delete your information, subject to legal retention duties (we may need to keep tax records).
• Complain:if you're unhappy with how we handled your data, contact us first. If you're still not satisfied, the Office of the Australian Information Commissioner (oaic.gov.au) can investigate.

Email bookings@squidgesquadge.com.au with your request. We respond within 30 days.

Our centre is for children. Where the ticket tier you choose implies your child's age (e.g. under-1, under-2), or where you register a pass in your child's name, we treat that data with extra care: no marketing emails, no third-party sharing beyond the processors listed above, and shorter staff-access defaults.

We use one strictly-necessary cookie for the staff admin login. We do not use marketing or analytics cookies on the booking flow. If we add analytics in future we'll update this notice and put it behind a banner.

We'll update this page if our practices change. The date at the top of the notice reflects the most recent revision.