Draft for the private pilot — placeholders in brackets must be completed before launch.

Privacy notice

Last updated 1 October 2026. This notice is for members in the United Kingdom. If you live in the United States, read our US privacy notice.

This notice explains what personal data DadMode collects, why, who it is shared with, how long it is kept and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018). DadMode is for adults aged 18 or over.

The short version. We use what you tell the coach to coach you. Most of it is encrypted before we store it. An AI provider (OpenAI, or Anthropic or Google as backups when OpenAI is unavailable) reads your messages, and the parts of your saved record a reply needs, so the coach can reply. We do not sell your data, show you adverts or use advertising cookies. You can see, download and delete your data yourself, and deleting your account also cancels your subscription.

1. Who we are

DadMode is provided by [TRADING NAME] ([COMPANY NUMBER IF ANY]), [REGISTERED ADDRESS]. We are the controller of the personal data described here. We are registered with the Information Commissioner’s Office under registration number [ICO REGISTRATION NUMBER].

Contact us about privacy at [CONTACT EMAIL]. You can also send /bug or /feedback to the coach in Telegram, but please use email for formal requests.

2. What we collect

When you use the coach in Telegram

If health tracking is on, we also keep encrypted coaching follow-ups and session feedback from your own messages. This helps the coach remember unresolved concerns and which approaches you said helped or were impractical. Up to 20 concerns can remain open; we retain up to 30 closed concerns, 60 session-feedback records and 30 recent log-write storage checks. A storage check compares saved fields, not the accuracy of food estimates. You can mark a concern resolved or reopen it. These records are included in your account export and removed with health-data or account deletion. Follow-ups use your existing notification choices and contact limits; they do not enable a new reminder subscription.

• Telegram identity: your Telegram chat ID and the first name (or username, if there is no first name) that Telegram shares with the bot.
• Onboarding answers: what you want to be called, age, goals and why they matter, starting point (for example height, weight and training level), training history, weekly availability, equipment, eating pattern, dietary preferences and constraints (which can include allergies or religious requirements), how much tracking you want, schedule constraints, sleep, stress and energy, coaching style, things the coach should never do, your time zone and biological sex.
• Health and medical information you choose to share: injuries, pain, medical conditions, medications, eating-disorder history and advice from clinicians. This is special category data.
• Your messages: text messages and the coach’s replies. We keep the most recent 1,000 entries per person.
• Voice notes: we send the audio to our AI provider to transcribe and store the transcript. We do not store the audio file.
• Photos and images: we send the image to our AI provider for analysis. We store a “[photo]” marker, your caption and the coach’s reply, not the image. With each voice note or image we also keep Telegram’s file reference (a file_id) and basic details such as file type, size, dimensions or duration. Telegram itself may still hold the file under its own terms.
• Documents: if you send a PDF or a text file (Markdown, TXT, CSV, JSON or XML), our service reads the text and sends up to 20,000 characters of it to our AI provider with your message. We store a “[document]” marker, the file name, basic file details and your caption, not the document or its text.
• Restaurant research: when you ask for menu help, the coach can use OpenAI's or our configured Anthropic backup's web tools to find and read public menus. The search request contains the restaurant and branch/location you supplied, and an optional public menu URL; it does not contain your food diary, health data or nutrition goals. Those are combined with the menu inside the normal coaching request. We may reuse a public-menu result for up to six hours, and keep a daily lookup count on your account to control costs. Published nutrition and the coach's estimates are different; menu advice never automatically records a meal as eaten.
• Health screenshots: if you have agreed to us using your health information and send a screenshot that looks like a health or wearable app, our AI provider may read numbers such as resting heart rate, sleep or weight from it, and nothing is added to your health readings until you confirm the numbers. If you have said no, or not answered yet, no numbers are read from it: the coach replies to the picture, and nothing it read or said about it is kept.
• Your data log: logged meals, workouts, body measurements and notes extracted from your messages are stored encrypted to power totals and trends. After the coach replies to a message that looks like a meal, a session, a weigh-in or how you feel, an AI model turns it into short structured records (for example “porridge with banana, about 350 kcal” or “run, 5 km, 28 minutes”) with the date, where it came from (chat, photo or import) and whether the numbers are your own or an estimate. Totals such as daily calories and protein are added up by our code from these records. /today and /log show them, and /undo and /log delete remove them.
• Challenges and goal tracking: if you start a challenge (for example “1,000 press-ups by the end of October”) we keep an encrypted ledger of the challenge, its target, due date and each amount you log. When our own code cannot read a progress report (“did another 25 before the school run”), a small AI model sees only that message and your own list of challenges, and suggests which challenge and amount it means. Our code checks the suggestion before anything is counted. /challenge shows, corrects, pauses and archives challenges.
• Your plan, saved meals and coaching preferences: the current plan the coach is working to and the changes it has made to it, meals you ask it to remember (for example “usual Thai curry”) and how you like coaching presented. All are encrypted. If you choose a behaviour experiment, we also store its type, dates and your reported outcome, encrypted, with one active experiment and up to 20 past results. These are included in your data export and removed when you delete your account. Say “stop the experiment” to stop it.
• Reminders and nudges: reminders you set (the label, time, time zone and how often), a record of the ones we sent, and, if you say yes to them, challenge nudges on days you have not logged. These are encrypted. You can see, pause and delete them in the dashboard or with /reminders.
• Feedback and support: what you send with /feedback or /bug. A bug report also keeps up to the last 8 messages of your conversation, so we can see what went wrong.
• Coach memory: the coach remembers short notes about your preferences and circumstances from your conversations (for example your schedule, kit, an injury to work around or what works for you), plus notes you add with /remember or /feedback and if-then plans you agree to. It never keeps health numbers or other people’s names. These notes are encrypted, used only for your own coaching, and you can see them with /memory and remove them with /forget.
• Safety screening records: when an automated check spots a safety concern (see section 8), we store the category and an encrypted excerpt of up to 400 characters of the message. If the concern is about suicide or self-harm, or comes from a private onboarding answer, we store the category only, never your words.
• Eating-disorder safety marker: if the safety check finds signs of an eating disorder in your own messages, we keep an encrypted marker on your profile (the date and whether the signs were strong or mild). One mild screen pauses calorie targets, deficits and weight-trend advice for 30 days; a hard referral or a repeated mild screen keeps that advice off until a person reviews it. Check-ins stay quieter while the marker applies (see section 8).
• Learning signals: short excerpts of up to 200 characters, automatically redacted to remove things like names, emails, phone numbers, addresses and postcodes, and stored against a pseudonymous code (a keyed hash of your chat ID) rather than your chat ID. If you have agreed to us using your health information and send a health screenshot, a short summary of the numbers read from it can be kept as a learning signal in the same way. Without that agreement nothing read from a screenshot is kept.
• Check-in and message preferences: whether you have muted check-ins and product update messages or turned on the morning readiness note (/mornings), which kinds of check-in, tip or update we sent and when, whether you replied within a day, and (encrypted) the number a check-in was about and how it changed a week later, so we send fewer of the kinds you ignore.
• Usage records: for each AI request, the model used, the number of tokens and the time. We also keep daily usage and message-rate counters.
• Your own API key (founding members only): a few original pilot members use their own OpenAI API key. We store it encrypted and use it only for that member’s coaching. /delete_key deletes it.

Before you share health information. Straight after it checks that you are 18 or over, and before it asks about your body, food, sleep, injuries, conditions, medication or eating history, the coach asks whether we may use the health information you share to coach you. The question says what we collect (your training, food, weight, sleep and health readings), why (to coach you), and who processes it (our hosting provider stores it and our AI provider processes it to write replies), and links both our UK and US privacy notices. We keep a record of your answer, when you gave it and which version of the question you saw. Members who joined before this question existed are asked it at their next message. If you say no, you still get general coaching: we do not keep health readings, weight or meal details, and the coach does not use any we already hold; onboarding skips the health questions; the coach keeps no notes about injuries, conditions or medication; what the coach says about a photo you send is not kept; learning signals keep only their category, not your words; and automatic health imports are switched off. Challenge counts you ask the coach to track (such as reps or distances) are kept either way. Until you answer, the message you sent is held, checked by our safety screen (a voice note is transcribed for that check only) and answered once you reply. Our chat history itself is still kept, as described in section 6. You can change your answer at any time (see section 3).

When you use the dashboard

• Sign-in: the dashboard uses Netlify Identity with Google sign-in. Netlify Identity holds your account email address and the basic profile details Google shares. Our coaching data store keeps only an opaque account ID that links your login to your Telegram coaching account.
• Opening the dashboard from Telegram: if you open the dashboard with the Dashboard button in Telegram, you are signed in with the Telegram account details Telegram shares with the dashboard (your Telegram user ID and name). No Google sign-in is needed, and we use these details only to check it is you, not to store anything new.
• Diary entries: notes you write in the dashboard. These are encrypted before we store them.
• Optional symptom diary: if you enable it, your own dated observations, optional severity, location, duration, everyday impact, context, what helped or aggravated it, medicines you report taking, notes and appointment questions. Entries and settings are encrypted. You separately choose whether the coach may retrieve the diary for relevant coaching; diary-only mode keeps it out of automatic coaching context. An explicit request to read or summarise your diary still allows the AI provider to process the requested entries for that reply. Choose and confirm changes in Telegram or the dashboard. You can download a dated appointment summary or CSV, correct/delete entries, or erase the diary. Nothing is automatically shared with a clinician. Guidance links do not send your observations to the source website. This is not diagnosis or emergency monitoring.
• Health readings (optional, with your consent): if you connect Health Auto Export on iPhone (or a compatible Health Connect export app on Android), send readings to the coach or confirm numbers from a screenshot, we keep only these daily values: resting heart rate, heart-rate variability, sleep time, deep sleep time, time in bed, steps, body weight, body-fat percentage, lean mass, active energy, resting energy, a readiness score and a short note of up to 280 characters. We also keep where each reading came from and when it arrived, plus a record of your consent. Everything else in an export is thrown away and the raw export is not stored. Health readings are encrypted before we store them.
• Health import key: a private key that lets your export app send readings to your account. We store only a one-way hash of it, and connecting again replaces it. It is deleted when you stop imports or delete your health data.

Connected tools (optional)

• If you create a personal access token with /connect, the apps you give it to can read your DadMode data and add notes; you can revoke tokens any time with /disconnect.
• What we keep: for each token, a one-way hash of it (never the token itself), the label you chose, and when it was created and last used. We also keep the last 30 notes your apps add, with their source and type. Notes that match a safety topic are marked with its category, and the coach sees your notes from the last 7 days.
• Your coaching brief and profile answers can also be updated by tools you connect; the coach follows your brief unless it conflicts with its safety rules.

Payments (paid membership)

• Your Stripe customer ID, subscription ID, subscription status, the date the current billing period ends and whether you have used a free trial. Card details go straight to Stripe and we never see them. Stripe also collects the email address and billing details you enter at checkout. We share your Telegram chat ID with Stripe as a reference so we can match payments to your account.
• If you use a tester discount code, Stripe records which code was applied to your subscription.

The pilot waitlist

• If you join the waitlist on the pilot page without an invite, we keep your email address, the sport or activity you picked and the date you joined. It is encrypted and is not linked to a DadMode account.

Security records

• To stop people guessing pilot invite codes, admin passwords or import keys, we count attempts using a one-way hash of your IP address (or of the import key), with a counter and a timestamp. We do not store the IP address itself. Our hosting provider also processes IP addresses in its own request logs.
• Our application logs use shortened one-way hashes instead of Telegram chat IDs.

Cookies and browser storage

• dadmode_pilot_invite: set on the private pilot page when you enter a valid invite. It lasts 30 days and contains a keyed hash (HMAC), not the invite code.
• dadmode-dashboard-link: stored in your browser’s session storage for the dashboard. It holds the one-time link from Telegram until your account is linked, is then removed, and is cleared when you close the tab.
• dadmode-telegram-launch: stored in your browser’s session storage when you open the dashboard from Telegram. It holds only the value “1”, so that after a reload the dashboard asks you to reopen it from Telegram. Your Telegram sign-in details are never stored in the browser. It is cleared when you close the dashboard.
• Netlify Identity keeps you signed in to the dashboard using its own cookies and browser storage.

All of these are strictly necessary for the service to work, so we do not ask for cookie consent. We do not use advertising or analytics cookies, and our pages load no third-party fonts, scripts or trackers.

3. Why we use your data and our lawful bases

Explicit consent and how to withdraw it. We use health information only with the explicit consent you give when the coach asks (section 2), and we keep a record of it. You can withdraw consent at any time:

• send /consent no in Telegram, or use “Withdraw health-data consent” in the dashboard. From then on we do not store new health information, and health imports stop. What is already stored stays until you delete it, and we tell you how;
• send /consent delete to delete the health information we hold (health readings, your data log, saved meals, the health answers in your profile and coach-memory notes about injuries) while keeping your account;
• send /disconnecthealth, or use “Stop health imports” in the dashboard, to stop new imports (existing readings stay until you delete them);
• send /deletehealth, or use “Delete health readings” in the dashboard, to delete stored health readings and your import key;
• send /delete_me confirm, or delete your account in the dashboard, to delete everything, including onboarding answers; or
• email [CONTACT EMAIL] to ask us to remove particular information.

Withdrawing consent does not affect anything we did before. Without health information the coach can only give more general advice.

Objecting to service improvement. You can object to your redacted signals being used by emailing [CONTACT EMAIL] or by deleting your data with /delete_me confirm. Approved lessons are general coaching rules. They are checked so they do not contain names, contact details or information about any one person, and they are not linked to you.

We do not sell your data or use it for advertising.

4. Who we share data with

We use these providers to run DadMode. Where they act as our processors, they may only use the data on our instructions.

• Netlify, Inc. (United States): hosts the website and dashboard, runs parts of our service, stores DadMode’s data (Netlify Blobs) and provides dashboard sign-in (Netlify Identity).
• Telegram: carries your messages to and from the coach, and delivers voice notes, photos and documents to our service. Telegram handles your messages as its own controller under its privacy policy. Chats with bots are not end-to-end encrypted by Telegram.
• OpenAI (United States): writes coaching replies, transcribes voice notes, reads images, documents and health screenshots, turns messages about meals, training, weigh-ins and how you feel into your data log, reads challenge progress reports the goal tracker cannot settle on its own, picks out coach-memory notes from your recent messages and helps suggest general lessons from redacted signals. To write a reply, the coach sends OpenAI your message with your recent conversation and a summary of your recent record. When your message needs it (for example “what did I log for that protein bar in June?”), the coach can also look up older parts of your own saved record — your food and training log, a past day, your health readings, saved meals, plan, challenges, coach memory, notes from your connected tools and earlier messages — and what it finds is sent to OpenAI with that request only. These look-ups read only your own record and never change it. If you have said no to us using your health information, or have not answered yet, they do not reach your food, training, weight or health records. We use OpenAI’s API under its API terms, which do not use API data to train models by default, and we ask OpenAI not to store our requests as saved responses. OpenAI may keep API data for a limited time, for example to monitor abuse. If you use /meal, the meal description you type is sent to OpenAI’s image model to draw the picture; charts and session cards are drawn on our own servers and are not sent to any third party other than Telegram, which delivers them to you. Founding members on their own API key send their coaching requests to OpenAI under their own OpenAI account.
• Anthropic (United States) and Google (Gemini API) (United States): backup AI providers. When OpenAI cannot answer (for example it is down, overloaded, or our OpenAI account has run out of credit), the same request — your message with your recent conversation, a summary of your recent record and anything a look-up found — is sent to Anthropic’s Claude instead, and if Claude cannot answer either, to Google’s Gemini. For that request they do what OpenAI would have done: write the coaching reply, read images, documents and health screenshots, build your data log, read challenge progress reports and pick out coach-memory notes. When OpenAI cannot transcribe a voice note, Gemini transcribes it (Claude does not handle audio). We use Anthropic’s API under its commercial terms, which do not use API data to train models, and Google’s Gemini API as a paid service, under which Google does not use prompts or responses to improve its products. Both may keep API data for a limited time to detect and prevent abuse. Founding members on their own OpenAI API key are never sent to a backup provider.
• Google (United States): sign-in for the dashboard, through Netlify Identity. Google receives the fact that you signed in to DadMode.
• Stripe: processes membership payments and runs the billing portal. Stripe acts as our processor for payments, and as its own controller for things like fraud prevention and its legal duties.
• Dropbox, Inc. (United States): stores our nightly backup files. They are encrypted before they leave our computer, and Dropbox cannot read them (see section 6).
• Apps you connect yourself: if you give a personal access token to another app or bot, that app can read your DadMode data and add notes. It is your choice and runs under that app’s own terms; we do not send data to it unless it asks with your token.
• Nutrition databases (Open Food Facts, USDA FoodData Central, FatSecret, Nutritionix and Edamam): when you describe food, we may send a short food search phrase taken from your message (for example “porridge with banana”, up to 120 characters), or a product barcode you send, to one or more of these databases to look up nutrition values. Open Food Facts is always used; the others only when we have an account with them. We do not send your name, chat ID or account details, and the request comes from our server, not your device.
• Uptime monitoring: our message-processing service sends a regular “still running” signal to a monitoring service. It contains no personal data.
• Health Auto Export and other export apps that you install are provided by other companies under their own terms. They send data from your phone to us; we do not share data with them.

Our message-processing service runs on a computer we control in the United Kingdom. It receives your Telegram messages, calls the providers above, writes to our data store at Netlify and makes the nightly encrypted backup. Admin alerts (for example that a crisis referral was sent, or a payment was disputed) go to our own admin Telegram chat and name you only by a pseudonymous code, never your words.

We may also disclose data if the law requires it, to protect someone’s safety, or as part of selling or reorganising the business (in which case this notice would still apply).

5. International transfers

Netlify, OpenAI, Anthropic, Google (sign-in and the Gemini API), Stripe, Dropbox and some nutrition databases process data in the United States or other countries outside the UK, and Telegram runs its service from several countries. Where we send personal data outside the UK, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where the provider is certified) or, where a provider is not covered, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in our agreement with that provider. [CONFIRM TRANSFER MECHANISM FOR EACH PROVIDER] Contact us for a copy of the relevant safeguards.

6. How long we keep data

When you delete your account, we first cancel any subscription and delete your customer record at Stripe (if Stripe cannot be reached, nothing is deleted and you can try again). We then delete the data listed above from DadMode’s store, including redacted learning signals linked to your pseudonymous code, and we try to delete your dashboard login. If deleting the login fails, we tell you and finish the job manually. For 7 days afterwards we keep a marker holding only your chat ID, so that a message still being processed when you deleted cannot re-create your data. Deletion does not remove copies held by Telegram, your phone or your export app, or data a provider keeps for a limited time under its own terms. We keep a one-way marker that a free trial was used, to prevent repeat trials. It cannot be turned back into your chat ID.

Backups. Every night our service makes a copy of our whole data store, encrypts it so that it can be opened only with a separate, passphrase-protected recovery key, and stores it on our own computer and in Dropbox. Records that are encrypted in our store stay encrypted inside the backup as well. Each backup is deleted after 30 days, so your data can stay in a backup for up to 30 days after you delete your account. To make sure a restore from backup can never bring it back, we keep a deletion record for one year: a one-way code derived from your chat ID with a secret key, the date of deletion and the pseudonymous code of your learning signals. It holds no chat ID, name or content, and it is used only to skip your data when a backup is restored. It is then deleted.

7. Your rights

You have the right to:

• access your data;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use your data;
• receive your data in a portable format (portability);
• object to uses based on legitimate interests; and
• withdraw consent at any time.

How to use them:

• Dashboard: download a JSON copy of your data (your profile, stored health readings, your full data log, up to 1,000 recent conversation entries, your diary, notes from your connected tools, your coaching brief, coach memory, your plan, challenges, reminders and their delivery history, check-in state and outcomes, saved meals, coaching preferences, your personal access tokens (label and dates only), redacted learning excerpts, feedback, support tickets, safety records, your credit ledger and checkout sessions, and a usage summary); stop or delete health imports; see, pause and delete reminders; or delete your account.
• Telegram: /export shows a summary of what is stored; /today and /log show your data log, and /undo and /log delete remove items from it; /memory and /forget show and remove coach memory; /challenge corrects or archives challenges; /reminders manages reminders; /restart_onboarding lets you redo your answers; /deletehealth deletes health readings; /connections lists your personal access tokens and /disconnect revokes them; /delete_me confirm deletes your coaching data; reply “mute” to stop check-ins, tips and update messages.
• Email: [CONTACT EMAIL] for anything else, including a full copy of your data or a correction.

We will reply within one month. For complex requests we can extend this by up to two more months, and if so we will tell you why. We may need to confirm who you are first.

8. Automated decisions and profiling

Every message, transcript and document goes through an automated safety check before the coach replies. If a message suggests a situation that needs a clinician or specialist support (for example thoughts of suicide or self-harm, signs of an eating disorder, pregnancy, some medical conditions or medications, performance-enhancing drugs, dangerous weight cutting, or that you are under 18), the coach may decline to give a plan and point you to appropriate help instead. The coach may also reply more cautiously. If the check finds signs of an eating disorder in your own messages, we also keep the safety marker described in section 2, so the coach stops giving calorie and weight advice from then on. After a safety concern, reminders, nudges and check-ins pause for a while.

Profiling. To personalise your coaching, our code automatically analyses your data log (meals, workouts, body measurements and notes), your health readings if you have connected them, your coach memory and your check-in history. From these it works out:

• a daily readiness call (Go, Caution or Back off) from your sleep, heart-rate variability, resting heart rate and training load;
• trends and personal baselines, such as your usual sleep, training volume, protein and weight trend;
• drifts, which are patterns worth mentioning, such as shorter sleep or fewer sessions than usual;
• where it is safe to do so, a calorie suggestion based on your logged food and weight trend. It is never given if the safety check, your answers or your preferences rule calorie advice out; and
• which check-in to send, if any, and when. This includes sending fewer of the kinds of check-in you tend to ignore.

This analysis only shapes the coach’s messages. It has no legal or similarly significant effect on you: it does not decide your price, your access to the service or anything outside coaching, and how you feel always counts for more than the numbers. You can turn it down or off at any time: reply “mute” or send /mute to stop all check-ins; send /mornings off to stop the morning readiness note; send /disconnecthealth or /deletehealth to stop using or delete health readings; remove items from your data log with /undo or /log delete; remove memory notes with /forget; or delete everything with /delete_me confirm. You can also object by emailing [CONTACT EMAIL].

None of these checks has legal or similarly significant effects on you. The under-18 check blocks coaching; if you have a subscription, contact us and we will cancel and refund it. If you think a check got it wrong, including the eating-disorder safety marker, email [CONTACT EMAIL] and a person will look at it.

If you are in crisis. The coach is not a crisis service. In an emergency call 999. You can call Samaritans free on 116 123, any time, or text SHOUT to 85258.

9. Age

DadMode is only for people aged 18 or over. If someone tells the coach they are under 18, their account is blocked from coaching straight away. They, or a parent or guardian, can delete everything at once with /delete_me in Telegram, or by contacting us, and we will delete any account we confirm belongs to someone under 18.

10. How we protect your data

• Your chat history (including voice-note transcripts and photo captions), your profile answers, coaching brief and notes, coach memory, health readings, data log, challenges, reminders, plan, saved meals, coaching preferences, diary entries, your own API key if you have one, redacted learning excerpts, and the text of feedback, support messages and safety records are encrypted at rest with AES-256-GCM by our own service, on top of our hosting provider’s storage security. Each kind of data has its own key derived from our master secret, and each record is bound to its own account, so an encrypted record cannot be read as someone else’s. The few fields our systems need to route messages and billing without decrypting anything stay readable to them: account and chat IDs, whether onboarding is finished, subscription and funding status, opt-outs and blocks, and dates.
• Data is sent over encrypted connections (TLS) between your device, our services and our providers.
• Dashboard access needs both a sign-in and a one-time link sent in your Telegram chat, or opening it from Telegram, which confirms your Telegram account with a signature we check. Each login can see only its own linked account.
• Logs use hashed identifiers, and security records store hashed IP addresses.
• Only authorised people can open the admin tools, which need a separate admin sign-in. Learning excerpts, feedback, support messages and safety records are shown there against pseudonymous codes, not chat IDs.
• Backups are encrypted with a key pair: the computer that makes them holds only the half that locks them, and the half that opens them is protected by a separate passphrase.

DadMode is not end-to-end encrypted. Our service holds the keys: Telegram messages, transcripts, documents and image analyses are decrypted and processed in readable form by our service and our AI provider so the coach can reply, and authorised admins see feedback, support and safety records in readable form. Usage, billing and subscription records are protected by our hosting provider’s storage security rather than our own extra encryption. No system is completely secure. If a breach puts your rights at high risk, we will tell you and the ICO as the law requires.

11. Complaints

Please contact us first at [CONTACT EMAIL]. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

12. Changes to this notice

We will update this notice when our practices change and change the date at the top. If a change materially affects how we use your data, we will tell you in Telegram or the dashboard before it takes effect.

See also our terms of use. Members in the United States: US terms · US privacy notice.