Privacy policy

We treat your sleep, self-check, and account information as sensitive, and we build for the smallest data footprint that still lets the product work. This policy explains what we collect, why, and the control you have.

Who we are

The data controller is Voll Studios Ltd, [Registered address — founder to supply]. You can reach us about your data at sthoyem@gmail.com. Our ICO registration number is [ICO reg no. — founder to supply].

What we collect, and why

• Account: your email address and a securely hashed password, so you can log in and access what you bought.
• Sleep diary: the bed/wake/rise times and minutes you enter, used only to compute your sleep efficiency and suggest a sleep window. This is health-adjacent information and we store it only with your explicit consent.
• Marketing email: your email address, if you ask for the free guide or our tips, with your separate marketing consent.
• Self-check: answered anonymously and computed in your browser or transiently on our server. We do not store your answers, and we store the coarse band only if you explicitly opt to save or email it.
• Safety screen: we record only that you were shown and acknowledged the safety information, and a non-medical blocked/allowed flag. We do not store which health condition you selected.
• Payment: handled by Stripe. We keep a purchase record (amount, currency, status, timestamps) but never your full card details.
• Analytics: Google Analytics (GA4) for aggregate usage. It sets analytics cookies only after you accept our cookie banner, and we send no personal data in analytics events (see below).

Lawful bases

We rely on contract for your account and purchase, and on your explicit, unbundled consent for diary storage, marketing email, and saving a self-check outcome. You can withdraw any consent at any time without affecting the parts you still use.

Consent

Consent is granular, versioned, and time-stamped. Each type (account, diary, marketing, self-check outcome) is asked for separately, and we record which version of the wording you agreed to and when. Withdrawing consent is a single action in your account.

Analytics and cookies

We use Google Analytics (GA4) to understand how the site is used, in aggregate. We send no personal data in analytics events. Analytics and advertising storage are denied by default (Google Consent Mode), so no analytics cookies are set until you choose Accept on our cookie banner; if you choose Reject, no such cookies are set. We enable no advertising features, and we honour Do Not Track. See our cookie policy for the full list of what is stored in your browser.

Storage and security

Data is encrypted in transit and at rest, secrets live only in environment configuration, database access is least-privilege, and we keep personal data out of logs and analytics events.

Keeping and deleting your data

You can delete your account and data at any time, from your account page. Deletion anonymises your account and irreversibly erases your diary, sleep windows, course progress, and email-list records. You can also export a copy of your data first.

One exception: we retain purchase (financial) records for the period required by UK tax, accounting, and chargeback rules, on the basis of our legal obligation and legitimate interest in handling refunds and disputes. We decouple those records from your identifying details rather than deleting them, and we do not delete records held by Stripe.

Your rights

You can ask us to access, correct, export, or delete your personal data, and you can object to or restrict certain processing. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk. Contact us first at sthoyem@gmail.com and we will help.

International representatives

Where required, our UK and EU representatives under Article 27 are listed here: [Article 27 representative(s), founder to supply].

Changes

If we change this policy we will update the version here and, where the change is material, tell subscribers by email.