DRAFT: not legal advice. Needs review by a solicitor before use.
Privacy policy
Last updated: [TO DECIDE: date]
This policy explains what personal data Warm Welcome collects, why, who we share it with, how long we keep it, and your rights. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
The data controller is [TO DECIDE: seller of record, full legal name], [TO DECIDE: company number, if a company], of [TO DECIDE: company address]. [TO DECIDE: ICO registration number, if registered.]
Contact for anything about your data: [TO DECIDE: contact email address].
What we collect
| What | Examples | Why |
|---|---|---|
| Account details | Your email address, and your name if you give it | To create your account, send you sign-in links and tell you about your purchases |
| Purchase details | What you bought, when, the amount, and a customer reference from our payment provider | To give you access to what you paid for, handle refunds and keep financial records |
| Your project content | Product links you give us, the text we read from those pages, your interview answers, any writing samples or past emails you paste in, your edits, and the emails and other content the tool writes for you | To write your funnel. This is the service you are paying for. |
| Your story library | The stories taken from your interview and past emails | So you can reuse your stories in later projects |
| Technical data | Sign-in session records and basic logs of how the service is running | To keep your account secure and the service working |
We don't need your card details: payments are handled by Stripe, and we never see or store your full card number.
[TO DECIDE: list any cookies or tracking, for example a Meta pixel on the sales pages, and whether consent is asked. The spec notes cookie consent where the pixel runs.]
Your interview answers are personal data
The interview asks about moments from your own life and work. Your answers are personal data, and they may mention other people. Please only share stories you are comfortable with us using to write your emails, and think about the privacy of anyone you mention.
Sensitive subjects
Some subjects count as special category data under UK GDPR, for example information about health, religious beliefs or sex life. The tool never asks about subjects like loss, illness, divorce, addiction or trouble with the law.
If you raise one yourself, the tool asks whether you'd like it used in your emails. We only use it in your emails if you clearly say yes. That yes is your explicit consent, and you can withdraw it at any time by editing or deleting the story, or by deleting your data. [TO DECIDE: solicitor to confirm. The interview guide also says consent should be asked at the start of the interview. Confirm how the answer is stored if you say no.]
Our legal bases
- Contract: to provide the service you bought, including processing your interview answers and project content.
- Legal obligation: to keep financial and tax records.
- Legitimate interests: to keep the service secure, prevent abuse and fix problems.
- Explicit consent: for any special category data you choose to let us use.
- [TO DECIDE: if you send marketing emails to buyers, the basis for that, and how they can opt out.]
Who we share your data with
We use these service providers ("processors") to run the tool. They only process your data on our instructions.
| Provider | What they do | What they receive |
|---|---|---|
| Anthropic | Provides the AI model that reads product pages and writes your content | Your project content, including interview answers, as needed to write each piece |
| Cloudflare | Hosts the website and app, and stores your projects and exported files | All data held in the app |
| Stripe | Takes payments | Your email address and payment details, which you give to Stripe directly at checkout |
| [TO DECIDE: email provider, to be confirmed] | Sends sign-in links and account emails | Your email address and the content of those emails |
[TO DECIDE: solicitor to check each provider's data processing terms, where each stores data, and the safeguards for transfers outside the UK. Confirm Anthropic's terms on retention and on not training models with API data, from Anthropic's own current documentation.]
We never use your answers, stories or content in anyone else's output. Your stories are only ever used in your own projects.
We don't sell your data.
How long we keep it
| What | How long |
|---|---|
| Project content, interview answers and story library | Until you delete it, or delete your account. [TO DECIDE: and/or a set period after your last sign-in, for example X months.] |
| Account details | Until you delete your account |
| Purchase records | [TO DECIDE: period required for tax and accounting records. An accountant can confirm.] |
| Technical logs | [TO DECIDE: period] |
Deleting your data
You can delete your data from your account page at any time ("Delete my data"). This deletes your projects, interview answers, story library and account, and signs you out everywhere.
We keep only what we must for payment and tax records: a record of each purchase and the payment provider's customer reference, marked as deleted.
You can also ask us to delete your data by emailing [TO DECIDE: contact email address].
[TO DECIDE: confirm whether service providers' backups or logs keep copies for a short time after deletion, and say how long.]
Your rights
Under UK GDPR you have the right to:
- see the personal data we hold about you,
- have it corrected,
- have it deleted,
- restrict or object to how we use it,
- receive a copy of it in a portable format, and
- withdraw consent at any time, where we rely on consent.
To use any of these rights, email [TO DECIDE: contact email address]. We'll reply within one month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate the chance to put things right first.
Changes to this policy
If we make an important change, we'll tell you by email or in the app.