Privacy Policy

Effective May 15, 2026

1. Who we are

Little Systems is operated by Corporate Synergy Solutions (the "Company," "we," "us"). When you visit littlesystems.io, join our founder list, or purchase the Crib-to-Bed Masterkit, the Company is the data controller of your personal information.

2. What we collect

From everyone who visits the site

• Cookies + analytics — only if you click Accept all on the cookie banner. Includes Meta Pixel (for ad measurement) and Google Tag Manager (for product analytics). If you click Reject all, none of these fire.
• Server log data — IP address, user-agent string, request timestamps. Held briefly for security and abuse prevention. Logged regardless of cookie consent because it's necessary to serve the page.

From founder list signups

• Email address — what you typed in the signup form
• Source metadata — page URL, referer, UTM parameters at the time of signup (helps us measure ad performance)

From customers

• Purchase information — name, billing address, and purchase amount. Card details are handled by Stripe via ThriveCart and never touch our servers.
• Account access tokens — magic-link login tokens that let you access the Masterkit app

3. What we do with it

• Deliver the product — send your magic-link, fulfill your purchase, give you access to the Masterkit
• Send you the founder list emails — 5-email nurture sequence + occasional product updates
• Customer support — answer your questions, process refunds
• Improve the site — aggregated analytics tell us which sections of the page work and which don't
• Show you better ads — only if you opted into Marketing cookies. Meta Pixel tells Meta which visitors clicked an ad and signed up so Meta's algorithm can find more parents like you.

We do NOT: sell your data, rent your data, share it with data brokers, or use it for anything you didn't sign up for.

4. Who has access

The vendors below process data on our behalf. Each is contractually bound to use your data only for the stated purpose:

• Vercel — hosts littlesystems.io
• Convex — stores the founder list (your email + signup metadata)
• Resend — sends transactional and marketing emails on our behalf
• ThriveCart + Stripe — process purchases (Stripe holds your card data, not us)
• Meta (Facebook) — pixel and conversion API (only with Marketing cookie consent)
• Google — Tag Manager and any tags you've consented to (only with Analytics cookie consent)

5. Your rights

Everyone

• Access — email hello@littlesystems.io and ask for a copy of the data we hold on you
• Deletion — email the same address and we delete it within 30 days (we'll keep purchase records for tax/compliance only)
• Marketing opt-out — every email has an unsubscribe link in the footer; clicking it removes you immediately
• Cookie preferences — adjust at any time via the cookie banner / preferences link

EU / UK visitors (GDPR / UK GDPR)

You have additional rights including portability, the right to object to processing, and the right to lodge a complaint with your local supervisory authority. We process your data under two legal bases: legitimate interest (analytics, security) and contract performance (delivering what you purchased). Marketing consent is revocable at any time.

California residents (CCPA/CPRA)

You have the right to know what we collect, request deletion, opt out of "sale or sharing" of personal information, and limit use of sensitive personal info. We don't sell personal information.

6. Cookies

We use cookies in three categories — necessary (always on), analytics (Google Tag Manager), and marketing (Meta Pixel). The cookie banner you see on first visit lets you accept or reject the non-necessary categories. Your choice is remembered in a single cookie named ls_consent.

For details, see the Meta cookie policy and Google cookie policy.

7. Children

The Masterkit is intended for parents/guardians. We don't knowingly collect personal information from children under 13. The product itself helps you parent your toddler — but it's you, the adult, who interacts with our service. If you believe we've inadvertently collected information from a child, email us and we'll delete it.

8. Data retention

• Founder list emails — held until you unsubscribe or request deletion
• Customer records — held for the lifetime of your access, plus 7 years for tax/compliance after that
• Server logs — purged within 30 days
• Analytics — aggregated and anonymized; identifiable data retained ~14 months by Google Analytics defaults

9. Security

We use HTTPS everywhere, secret values stored as encrypted environment variables, and vetted vendors (Stripe PCI-DSS, Vercel SOC 2, Convex / Resend industry-standard practices). No system is 100% secure; if a breach involving your personal information occurs, we'll notify you within 72 hours.

10. Changes to this policy

We update this page when our practices change. Material changes will be announced via email to subscribers. The "Effective" date at the top reflects the current version.