Last updated: 17 May 2026
This Privacy Policy explains how Menthol Elf collects, uses, stores, and protects personal data when you visit https://mentholelf.com, contact Menthol Elf, or subscribe to Menthol Elf updates. It is written for parents, carers, teachers, schools, and other visitors who use the site.
Who we are
Menthol Elf is an independent creative project operated by Stephen Pothecary. The website address is https://mentholelf.com.
The web-facing email address for Menthol Elf is info@mentholelf.com. For privacy questions, data requests, newsletter unsubscribe requests, or concerns about how personal data is handled, please use this address.
Menthol Elf is based in the United Kingdom. No public registered office, company registration number, or Data Protection Officer is listed because the site is currently operated as an independent creative project rather than as a regulated organisation requiring a named DPO.
What personal data we collect and why we collect it
Menthol Elf does not currently sell products directly through the website, operate public user accounts for visitors, or ask children to submit personal information. The site is intended to share story, wellbeing, educational, and brand information.
- Technical data, such as IP address, browser type, device type, operating system, pages visited, referral source, approximate location, and time of visit. This is used to keep the site secure, understand site performance, and improve content. The usual legal basis is legitimate interests in running and improving a safe website, and consent where non-essential cookies or similar technologies require it.
- Contact data, such as your name, email address, organisation, and message content if you contact Menthol Elf by email or through any contact feature added in the future. This is used to respond to your enquiry. The usual legal basis is legitimate interests, consent where you choose to send information, and contract or pre-contract steps where your enquiry relates to a possible service, school, licensing, publishing, or collaboration arrangement.
- Newsletter and mailing list data, such as your email address, first name if you choose to provide it, signup source, signup date, consent record, email preferences, list membership, subscription status, unsubscribe status, and basic email engagement data such as delivery, opens, and clicks. This is used to send Menthol Elf news, resources, story updates, launch information, educational materials, and occasional related announcements. The legal basis is consent, or soft opt-in rules where they lawfully apply. You can unsubscribe at any time.
- Admin and contributor data, such as usernames, email addresses, profile details, login records, and publishing activity for people who are given access to manage the website. This is used to operate, secure, and audit the website. The usual legal basis is legitimate interests and, where relevant, contract.
- Comment data, if comments are enabled on any post or page. WordPress may collect the information entered into the comment form, IP address, browser user agent, and comment metadata to support moderation and spam detection. The usual legal basis is legitimate interests in managing public discussion and protecting the site from abuse.
- Cookie and analytics data, including information collected by WordPress, Google Site Kit, Google Analytics, Google Search Console, Google Tag Manager, MailPoet, and similar tools where enabled. This helps understand how visitors find and use the site and how newsletter signups and emails perform. The legal basis is consent where required for non-essential cookies and legitimate interests for low-risk, aggregated site measurement where permitted.
Menthol Elf content discusses feelings, wellbeing, emotional literacy, and mental health awareness. The website does not intentionally ask visitors to submit health data or other special category data. If you choose to include sensitive information in an email or message, it will only be used as needed to understand and respond to that message, unless a legal or safeguarding obligation requires otherwise.
The site is child-friendly in its subject matter, but it is not designed to collect personal data directly from children. Children should not send personal information or subscribe to updates through the website without appropriate adult involvement.
Comments
Comments are not currently intended as a main feature of the Menthol Elf website and are closed by default on standard pages. If comments are enabled on any post or page, WordPress may collect the data shown in the comments form, the visitor’s IP address, browser user agent string, and metadata needed for moderation and spam detection.
If Gravatar is used, an anonymised string created from your email address may be provided to Automattic’s Gravatar service to check whether you use it. The Automattic privacy policy is available at https://automattic.com/privacy/. After approval of a comment, a profile image may be visible publicly beside the comment.
Media
Public visitors cannot currently upload media files to the Menthol Elf website. If media upload access is granted to an administrator, contributor, contractor, or collaborator, uploaded files may be publicly accessible. Anyone uploading images should avoid including embedded location data, such as EXIF GPS data, because visitors may be able to download images and extract that information.
Contact forms and email
The website does not currently include a public WordPress contact form. If one is added later, this policy should be reviewed and updated to name the form provider and explain exactly what is collected.
If you contact Menthol Elf by email at info@mentholelf.com, the information you provide may include your name, email address, organisation, role, and the content of your message. This information is used to respond to your enquiry, manage any relationship with you, and keep appropriate records. Email enquiries are not used for marketing unless you have clearly asked to receive updates or have otherwise given appropriate consent.
Newsletter and mailing list
Menthol Elf uses MailPoet, a WordPress newsletter plugin owned by Automattic, to manage newsletter signup forms, mailing lists, subscription confirmations, unsubscribe links, and newsletter sending. If you subscribe to a Menthol Elf newsletter or mailing list, Menthol Elf may collect your email address, first name if you choose to provide it, signup source, signup date, confirmation status, consent record, email preferences, list membership, unsubscribe status, and technical delivery information.
Newsletter emails may include updates about Menthol Elf stories, resources, website content, launches, educational materials, events, availability, and related project news. Newsletter messages are sent only where you have given consent or where another lawful marketing basis applies. You can withdraw consent or unsubscribe at any time by using the unsubscribe link in an email, using any MailPoet manage-subscription page made available, or by contacting info@mentholelf.com.
MailPoet stores subscriber and mailing list information in this website’s WordPress database. If the MailPoet Sending Service, MailPoet account services, support, or related Automattic services are used, relevant newsletter data may also be processed by MailPoet or Automattic to send emails, keep delivery logs, prevent abuse, provide support, and produce basic delivery and engagement statistics.
MailPoet newsletters may use tracking pixels and tracked links to report whether emails were delivered, opened, or clicked. These statistics help Menthol Elf understand whether newsletters are useful and functioning properly. Some email providers and privacy tools may block, mask, or automatically trigger opens and clicks, so these statistics are treated as approximate rather than as a precise record of individual behaviour.
If you unsubscribe, Menthol Elf and MailPoet may keep a limited suppression record, such as your email address and unsubscribe status, to make sure you are not accidentally added back to the list. Menthol Elf does not sell newsletter subscriber details.
MailPoet privacy information is available through Automattic at https://automattic.com/privacy/, and MailPoet’s information about data collected and stored by MailPoet is available at https://kb.mailpoet.com/article/361-data-collected-and-stored-by-mailpoet.
Cookies
Cookies are small files stored on your device. The site may use essential cookies, preference cookies, login cookies for administrators, analytics cookies, newsletter signup cookies, and cookies or similar technologies set by third-party services.
WordPress may set cookies for logged-in users and administrators. Login cookies usually last for two days, screen preference cookies may last for one year, and a “Remember Me” login may last for two weeks. If a visitor leaves a comment and chooses to save their name, email address, and website in cookies, those comment cookies may last for one year. A temporary login-page cookie may be set to check whether the browser accepts cookies and is discarded when the browser closes.
Google services connected through Google Site Kit may set analytics or measurement cookies to understand visits, page views, referral sources, device information, and site performance. MailPoet may use cookies, tracking pixels, or tracked links to support newsletter signup forms, email delivery, opens, clicks, unsubscribe handling, and signup form performance. Google explains how it uses data at https://policies.google.com/privacy and provides information about Google Analytics privacy and safeguards at https://support.google.com/analytics/answer/6004245.
You can control cookies through your browser settings. If a cookie banner or consent tool is added to the website, you may also be able to manage non-essential cookie choices through that tool.
Analytics
The site uses Google Site Kit, which can connect Google services such as Google Analytics, Google Search Console, and Google Tag Manager. These tools help understand how visitors find the website, which pages are used, and whether the site is working properly.
Analytics data may include technical information such as IP-derived approximate location, browser, device, pages visited, referral source, and interaction events. MailPoet may also provide statistics about signup form performance, email delivery, opens, clicks, and unsubscribes. Reports are generally viewed in aggregated form. Menthol Elf does not use analytics data to identify individual children or make decisions about individual visitors.
You can reduce or block analytics tracking by using browser privacy controls, rejecting non-essential cookies where a consent tool is available, or using Google’s browser add-on for opting out of Google Analytics where supported: https://tools.google.com/dlpage/gaoptout.
Embedded content from other websites
Pages and posts may include embedded content from other websites, such as videos, images, maps, social posts, or linked resources. Embedded content behaves as if you visited the other website directly. Those websites may collect data about you, use cookies, run third-party tracking, and monitor your interaction with the embedded content, especially if you are logged into that service.
Who we share your data with
Menthol Elf does not sell personal data. Personal data may be shared with service providers where necessary to run, secure, measure, communicate through, and send updates from the website:
- IONOS, the website hosting and infrastructure provider, may process server logs, IP addresses, technical request data, backups, and security information needed to host and protect the site. IONOS data protection information is available at https://www.ionos.co.uk/terms-gtc/privacy-policy/.
- Google, through Google Site Kit, Google Analytics, Google Search Console, Google Tag Manager, and email services, may process analytics, technical, and communication data. Google’s privacy policy is available at https://policies.google.com/privacy.
- WordPress and Automattic services may process data where WordPress features, Gravatar, anti-spam, Jetpack-style services, MailPoet, or related tools are enabled. Automattic’s privacy policy is available at https://automattic.com/privacy/.
- MailPoet, owned by Automattic, may process newsletter subscriber email addresses, first names if provided, consent records, mailing preferences, delivery records, unsubscribe records, and email engagement data so Menthol Elf can send and manage newsletters lawfully.
- Professional advisers or authorities, if needed for legal, tax, accounting, security, safeguarding, or regulatory reasons.
If you request a password reset for an authorised account, WordPress may include your IP address in the reset email. If comments or spam-detection features are enabled, visitor comments may be checked through automated spam detection services.
How long we retain your data
Retention depends on the type of data and why it is held:
- Email enquiries are normally kept for up to 24 months after the last meaningful contact, unless a longer period is needed for legal, safeguarding, accounting, publishing, licensing, or dispute reasons.
- Newsletter subscriber records are kept while you remain subscribed. If you unsubscribe, a limited suppression record may be kept so that you are not accidentally re-subscribed. Consent records may be kept for as long as reasonably needed to show when and how consent was given or withdrawn.
- MailPoet delivery and engagement records are kept according to the MailPoet settings and services in use. Where MailPoet Sending Service is used, MailPoet states that logged emails from users sending with the service are automatically erased after 3 months.
- Analytics records are retained according to the Google Analytics, Site Kit, and MailPoet settings in use. Menthol Elf aims to use aggregated reports for trend analysis rather than keeping identifiable analytics records.
- Server logs and security records are retained for the periods set by the hosting provider and website security configuration, usually only as long as needed for security, troubleshooting, abuse prevention, and legal compliance.
- If comments are enabled, approved comments and related metadata may be retained indefinitely so follow-up comments can be recognised and moderation history can be preserved.
- Authorised user account data is kept for as long as the account is needed, and for a reasonable period afterwards for administration, security, and audit purposes.
- Legal, copyright, licensing, financial, or safeguarding records may be kept for longer where necessary to protect rights, meet obligations, or respond to claims.
What rights you have over your data
Depending on the circumstances and applicable law, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal data held about you. You may also withdraw consent where processing is based on consent, including newsletter consent, and unsubscribe from marketing or newsletter messages at any time.
To make a privacy request or unsubscribe request, email info@mentholelf.com. Menthol Elf may need to verify your identity before responding. You also have the right to complain to the UK Information Commissioner’s Office. The ICO website is https://ico.org.uk/.
Where your data is sent
Menthol Elf is operated from the United Kingdom. Website, analytics, email, and newsletter data may be processed in the United Kingdom, the European Economic Area, the United States, or other locations where service providers such as IONOS, Google, WordPress, Automattic, MailPoet, email providers, or newsletter infrastructure providers operate.
MailPoet states that, if you use MailPoet account services or the MailPoet Sending Service, some data may be processed on MailPoet servers in Germany and Finland, and MailPoet also relies on third-party services in Europe and the United States to maintain its services.
Where personal data is transferred internationally, Menthol Elf relies on the safeguards offered by its service providers, such as data processing terms, UK or EU adequacy arrangements, standard contractual clauses, the UK International Data Transfer Agreement or Addendum where applicable, and other recognised transfer safeguards.
Visitor comments, if enabled, may be checked through automated spam detection services. Analytics, newsletter, and security data may also be processed by third-party providers outside the UK or EEA.
Contact information
For privacy-specific concerns, data requests, newsletter unsubscribe requests, or questions about this policy, contact:
Menthol Elf
Email: info@mentholelf.com
Website: https://mentholelf.com
Menthol Elf is not currently required to appoint a Data Protection Officer. If that changes, this section will be updated.
How we protect your data
Menthol Elf uses reasonable technical and organisational measures to protect personal data. These may include HTTPS encryption, reputable managed hosting, WordPress access controls, limited administrator access, password protection, plugin and theme maintenance, backups, spam and abuse controls, careful handling of email enquiries, and appropriate access controls for MailPoet and any newsletter or mailing list provider.
No website, email system, or mailing list system can be guaranteed completely secure, so visitors should avoid sending highly sensitive personal information unless it is necessary.
What data breach procedures we have in place
If Menthol Elf becomes aware of a suspected personal data breach, including a breach affecting newsletter or mailing list data, the issue will be reviewed, steps will be taken to contain and investigate it, and records will be kept of what happened. Where required by law, affected individuals and the Information Commissioner’s Office will be notified within the applicable timescales.
What third parties we receive data from
Menthol Elf may receive technical and aggregated reporting data from Google Site Kit, Google Analytics, Google Search Console, hosting tools, WordPress administration tools, and MailPoet. This helps understand website performance, search visibility, email delivery, newsletter engagement, errors, and security issues. Menthol Elf does not buy personal data lists or receive advertising profiles about individual visitors.
Automated decision making and profiling
Menthol Elf does not use visitor or subscriber data for automated decision making that has legal or similarly significant effects. The site, Google tools, and MailPoet may use analytics to group visitors or subscribers into aggregated reports, such as page views, traffic sources, devices, approximate regions, email opens, clicks, and unsubscribes, but these reports are not used to make decisions about individual people.
Industry regulatory disclosure requirements
Menthol Elf provides educational storytelling and wellbeing-related content. It is not a medical, therapeutic, counselling, safeguarding, financial, legal, or regulated clinical service. Menthol Elf stories and resources are not a substitute for professional advice, diagnosis, treatment, crisis support, or safeguarding procedures.
Changes to this policy
This policy may be updated as the website develops, for example if contact forms, mailing lists, downloads, shop features, memberships, comments, advertising, or additional analytics tools are added or changed. The date at the top of the page will show when it was last updated.