Privacy Policy

1. Who We Are

Data Controller: The Life Academy (sole trader)
Contact: Contact form
ICO Registration: [to be added on launch]

We operate two products under this policy:

• The Alcohol Myth — an online course hub for exploring your relationship with alcohol
• Blueprint — an alcohol assessment tool at blueprint.alcoholmyth.co.uk

This policy covers both products. Where a section applies only to one product, it is clearly labelled.

2. Information We Collect

The Alcohol Myth (course hub)

• Email address and name (account registration)
• Password (stored hashed — never in plain text)
• Course enrolment, progress, and video watch time
• Journal entries you write in reflection prompts (encrypted with your personal key)
• Purchase records: date, amount, course, transaction ID (via Stripe)
• IP address and browser information (security and fraud prevention)

Blueprint (assessment tool)

• Email address (to link results to your account, if you are a course hub user)
• Quiz responses (your answers to assessment questions)
• Assessment results and scoring history
• IP address and browser/device information
• Campaign attribution data (UTM parameters from ad URLs) — internal use only, to measure which campaigns brought users to the service
• If you visit Blueprint via a paid advertisement: Meta click ID (_fbclid) and hashed email (see Section 9)

3. How We Use Your Information

We never:

• Sell your personal data
• Share your journal entries with anyone
• Share your Blueprint quiz responses with advertisers
• Allow staff to view individual Blueprint responses through normal interfaces
• Use your data to train AI models

4. Who We Share Data With

We share data only with service providers necessary to operate our products:

All providers have signed Data Processing Agreements (DPAs). For US-based providers we rely on Standard Contractual Clauses (SCCs) or the UK Extension to the EU–US Data Privacy Framework (DPF).

5. How Long We Keep Your Data

We will notify you by email 30 days before deleting an inactive account.

6. Your Rights

Under UK GDPR / UK DPA 2018, you have the right to:

7. Data Security

We protect your data with:

• Encryption in transit: All connections use HTTPS/TLS
• Encryption at rest: Database encrypted at rest
• Journal encryption: Journal entries are encrypted with AES-256-GCM using your personal per-user key before storage. Database access alone cannot reveal your journal content.
• Row-Level Security (RLS): Database-enforced access controls ensure users can only access their own data
• Blueprint tokens: Anonymous Blueprint access tokens are cryptographically unguessable (64-character random strings), contain no personal data, and are cleared on browser close, login, or via Settings
• Access controls: Role-based access; admin actions are logged
• Regular backups: Encrypted backups with point-in-time recovery

8. Cookies

We use essential cookies only:

We do not use advertising cookies or third-party analytics that track individuals across sites.

9. Blueprint — Assessment Data and Advertising

Special Category Data

Blueprint asks questions about your alcohol use. This may constitute health-related data, which is special category data under Article 9 UK GDPR. We collect and process this data only with your explicit consent (Article 9(2)(a)), given when you choose to start the assessment. You can delete this data at any time via Settings > Delete Blueprint Results.

AI-Generated Summary

Blueprint may use Anthropic's API to generate a personalised summary of your assessment. Your quiz responses (not your email) are sent to Anthropic under zero-data-retention terms — Anthropic does not store or train on your responses. This summary is informational only; no automated decision-making with legal or significant effect takes place (Article 22 does not apply).

Meta Conversions API (CAPI)

If you arrive at Blueprint via a Meta (Facebook/Instagram) advertisement, we may send the following to Meta via the Conversions API to measure whether the ad led to a completed assessment:

• Hashed email address (SHA-256 — not plain text)
• IP address
• User agent
• Meta click ID (_fbclid)

We do not share quiz responses or assessment results with Meta. Data is transferred to the US under the UK Extension to the EU–US Data Privacy Framework (DPF). This processing is based on legitimate interests (Art 6.1.f). You may object by contacting us.

10. Email Communications

Transactional emails

When you submit the Blueprint quiz or interact with the course hub, we send transactional emails to deliver the service you requested (e.g. your assessment results link, purchase confirmations). These are sent under contract (Art 6.1.b) and cannot be unsubscribed from while you use the service.

Marketing emails

Marketing emails (promotional offers, course information) require explicit opt-in consent and are separate from transactional emails. You can unsubscribe from marketing at any time via the unsubscribe link in any email or via your email preferences, without affecting your access to results or course content.

To stop all emails

To stop all communications and delete your data, see Section 6 (Your Rights).

11. Children's Privacy

The Alcohol Myth course hub is not intended for users under 16. Blueprint is not intended for users under 18, given its subject matter. We do not knowingly collect data from children. If you believe a child has created an account, please contact us immediately.

12. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. For significant changes:

• We will email you at least 14 days before changes take effect
• The updated policy will show the revision date
• Continued use after the effective date constitutes acceptance

13. Contact Us

For privacy questions or to exercise your rights, use our contact form.
Response time: Within 30 days

14. Supervisory Authority

If you are unhappy with how we handle your data, you can complain to:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113