Privacy Policy

Last updated: August 4, 2026  ·  Effective: August 4, 2026

1. Introduction

The Mixed-Up Robot (a DBA of Leo Doctrina LLC; "we," "our," or "us") operates the website themixeduprobot.com (the "Site") and associated educational services. This Privacy Policy explains what personal information we collect, how we use and protect it, and what rights you have over it.

We are committed to protecting the privacy of children and families. Our Site is directed to parents, guardians, and educators, not to children under 13. We aim to align our practices with applicable U.S. and international privacy laws, including the Children's Online Privacy Protection Act (COPPA), the California Consumer Privacy Act (CCPA), and the European Union General Data Protection Regulation (GDPR), to the extent they apply to a business of our size.

This Policy applies to all visitors to themixeduprobot.com. Our newsletter, contact form, and resource downloads are intended for adults. If you are under 13, please do not submit any personal information through this Site; see Section 5 for our full children's privacy practices. By using our Site, you agree to this Policy.

2. Information We Collect

2a. Information You Provide Directly

• Newsletter sign-ups: Email address; first name (optional). We do not collect last names unless you voluntarily include them in a message.
• Contact form: Name, email address, and the content of your message.
• Resource downloads: Email address used to deliver the requested resource.

We only ask for the information necessary to provide the service you requested.

2b. Information Collected Automatically

• Website analytics (consent required): Pages visited, session duration, click paths, and referring URLs. Collected via Google Analytics 4 only after you accept analytics cookies.
• Device and connection data: Browser type, operating system, screen resolution, and anonymized IP address. We do not store full IP addresses.
• Cookies and similar technologies: See Section 7 for the full cookie table and consent controls.

We do not collect biometric identifiers, government-issued ID numbers, financial account information, geolocation data, or audio/video recordings through this Site.

2c. Information from Third-Party Platforms

If you interact with our official social media accounts (Facebook, Instagram, X, YouTube, TikTok), those platforms govern the collection of data related to your activity on their services. We do not receive individually identifiable personal data from those platforms.

3. How We Use Your Information

• Send newsletters and book updates you signed up for
• Respond to contact-form inquiries and provide support
• Deliver requested resources, such as worksheets and activity sheets
• Analyze website traffic to improve content and user experience, only with consent
• Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations, such as responding to lawful requests

We do not use your personal information for targeted advertising, behavioral profiling, or sale to third parties.

4. Data Retention

We retain personal information only as long as necessary for the purpose it was collected for:

Data Type	Retention Period
Newsletter subscriber email & name	Until you unsubscribe, then deleted within 30 days
Contact form messages	24 months from receipt, then deleted
Resource-download email addresses	12 months from download, then deleted
Cookie consent records	12 months, then re-prompted

Analytics data is retained according to Google Analytics' standard window and never includes personally identifiable information. When retention periods expire, data is securely deleted or anonymized; we do not retain personal information indefinitely.

5. Children's Privacy (COPPA)

Our Site and its interactive features (newsletter, contact form, resource downloads) are directed to and intended for adults only: parents, guardians, and educators. We do not knowingly collect, use, or disclose personal information from children under 13 years of age.

Age Screening

Our sign-up forms do not invite children to participate, and we do not condition access to any content on a child disclosing more information than necessary. If we have reason to believe a submission was made by a child under 13, we will not process that information and will delete it promptly. If you believe a child under 13 has submitted personal information to us, please contact us immediately at hello@themixeduprobot.com and we will delete it within five (5) business days.

Parental Rights

If you are a parent or guardian and have questions about our practices, or believe your child's information may have been inadvertently collected, you have the right to review it, request its deletion, or refuse further use or collection of it. To exercise these rights, contact us at hello@themixeduprobot.com with the subject line "COPPA Parental Request." We will respond within ten (10) business days.

We are not a "child-directed" service under COPPA's 2025 Rule amendments (effective April 22, 2026), since our Site is not directed to children and we do not knowingly collect their data. We have nonetheless reviewed our practices against those requirements as a best practice for a family-facing brand.

6. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information, and we do not share it for cross-context behavioral advertising. We share information only in these limited circumstances:

• Service providers: We share data with the third-party platforms listed in Section 7 solely to operate our Site and communicate with you. Each is contractually required to protect your data and may not use it for their own marketing.
• Legal requirements: We may disclose information if required by law, court order, or governmental authority, or to protect the rights, safety, or property of our users, ourselves, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via the Site before your information becomes subject to a different privacy policy.
• With your explicit consent: We may share information for purposes not described here when you have given us clear, affirmative consent.

7. Third-Party Services

The following third-party services are integrated into our Site. Each service has its own privacy policy, which governs data they receive.

Service	Purpose	Data Sent	Policy
Google Analytics 4	Website traffic analysis. Only loaded after analytics consent is granted.	Anonymized IP, page views, session data	Google Privacy Policy
Kit (ConvertKit)	Email newsletter delivery and subscriber management.	Email address, first name (if provided), open/click events	Kit Privacy Policy
Ko-fi / Stripe	Voluntary supporter donations. Only activated when you click "Support on Ko-fi."	Payment and session data handled entirely by Ko-fi and Stripe; we do not receive or store card details.	Ko-fi Privacy Policy
Google Fonts	Typography served from Google's CDN for consistent rendering.	IP address sent to Google servers on page load.	Google Privacy Policy

We do not use advertising networks, data brokers, or affiliate tracking pixels on this Site.

8. Cookies and Local Storage

We use browser cookies and localStorage to keep our Site functional and, with your consent, to understand how visitors engage with our content. We do not use advertising, behavioral targeting, or cross-site tracking cookies.

You can manage or withdraw consent at any time using the "Manage Cookies" link in the site footer. Withdrawing consent stops future data collection but does not delete data already collected. Consent records expire after 12 months and you will be prompted again.

Category	Purpose	Duration	Consent Required?
Essential	Remembers your cookie preference so we don't ask again on every visit	12 months	No
Analytics (Google Analytics)	Distinguishes unique visitors for traffic analysis. Only set after you accept.	Up to 2 years	Yes
Payment session (Ko-fi / Stripe)	Payment security. Set only when you open the Ko-fi support panel.	Session	No (set on interaction, not pre-loaded)

Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal. Our consent-first approach means analytics are blocked by default until you explicitly grant permission, which provides protections equivalent to or exceeding DNT.

9. Data Security

We maintain a written information security program that includes the following measures:

• Encryption in transit: All traffic to this Site is served over HTTPS (TLS 1.2 or higher).
• Access controls: Access to subscriber and contact data is limited to authorized personnel only.
• Vendor security: We select third-party processors with documented security practices and require them to protect data under confidentiality obligations.
• Data minimization: We collect the minimum data necessary and delete it when the purpose is fulfilled.
• Regular review: We periodically review our privacy and security practices to ensure ongoing compliance.

No method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security, but we take reasonable precautions to protect your information.

Data Breach Notification

In the event of a data breach that is reasonably likely to result in harm to affected individuals, we will notify impacted users by email (where we have an email address) and post a notice on this Site within the timeframes required by applicable law.

10. Your Rights

Depending on where you live, you may have some or all of the following rights over your personal information. To exercise any of these rights, email us at hello@themixeduprobot.com with the subject line "Privacy Rights Request." We will respond within 30 days, or the timeframe required by your jurisdiction.

• Access: Request a copy of the personal information we hold about you and how we use it.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: Request that we delete your personal information, subject to certain exceptions such as legal obligations.
• Portability: Request your data in a structured, commonly used, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of prior processing. For cookies, use the "Manage Cookies" footer link; for email, use the unsubscribe link in any newsletter.
• Opt Out of Sale or Sharing: We do not sell or share personal information for advertising, so this right is already honored.
• Non-Discrimination: You will not receive less favorable service for exercising any privacy right.

We will verify your identity before processing a request, and we do not charge a fee for reasonable requests.

California residents have these same rights under the CCPA, as amended by the CPRA. We collect only identifiers (email address, optional first name) and, with consent, browsing activity on our Site; we do not sell personal information, share it for cross-context advertising, or collect sensitive personal information as defined by the CPRA. To submit a California-specific request, use the contact method above with "California Privacy Request" in the subject line; we will respond within 45 days.

EEA, UK, and Switzerland residents have rights under the GDPR in addition to those listed above, including the right to lodge a complaint with your local data protection authority (for example, the ICO in the UK). We do not engage in automated decision-making that produces legal effects. Where we rely on legitimate interests as our legal basis for processing, you may object at any time. Our Site is operated from the United States, so information you provide is transferred to and stored there; we only send data outside your region through processors with appropriate safeguards in place.

11. Email Communications (CAN-SPAM)

Our newsletters comply with the U.S. CAN-SPAM Act. Every marketing email we send includes:

• Our physical mailing address
• A clear "unsubscribe" link that honors your request within 10 business days
• An honest "from" name and subject line

You can unsubscribe at any time using the link at the bottom of any email or by emailing hello@themixeduprobot.com.

12. Governing Law

This Privacy Policy is governed by the laws of the State of Iowa and the United States of America, without regard to conflict-of-law principles. Any disputes arising from or relating to this Policy that are not resolved informally will be subject to the exclusive jurisdiction of the state and federal courts located in Polk County, Iowa (Des Moines).

13. Changes to This Privacy Policy

We may update this Policy periodically. When we make material changes, we will update the "Last updated" date at the top of this page and, where feasible, send notice to newsletter subscribers. We encourage you to review this page periodically. Continued use of the Site after changes are posted constitutes acceptance of the updated Policy.

14. Contact Us

For privacy questions, rights requests, parental COPPA requests, or data breach concerns:

• Email: hello@themixeduprobot.com
• Mailing Address: The Mixed-Up Robot (Leo Doctrina LLC), Des Moines, IA, USA
• Website: www.themixeduprobot.com

We aim to respond to all privacy inquiries within 10 business days.