Privacy Policy - Scary But Brave, LTD

1. Who we are

Scary But Brave, LTD (“Scary But Brave”, “we”, “us” or “our”) is a company registered in England and Wales under company number 15388504. We are the controller of the personal data described in this policy.

Our website is www.scarybutbrave.com.

Contact us about privacy or your personal data:

Email: Amber@ScaryButBrave.com
Registered office: 3 Carney Place Carney Place, Flat 11, London, England, SW9 8GH

If we appoint a Data Protection Officer or another privacy contact, we will update this policy with their contact details.

The UK supervisory authority for data protection is the Information Commissioner’s Office (ICO). You can contact the ICO at www.ico.org.uk, or write to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

2. Who and what this policy covers

This policy explains how we collect, use, store and share personal data when you visit our website, contact us, join our membership, take part in our community, attend or enquire about a retreat or event, use our trainings and other services, or interact with us in another way.

Our services include a membership community hosted on Skool, private WhatsApp groups, retreats and events in locations including London, Thailand and Florida, expert-led trainings and live challenges, weekly co-working sessions, monthly check-ins, weekly meditations and journal prompts, a Vault of past trainings, and discounts on retreats and events.

“Personal data” means information that identifies or could identify you. This policy applies alongside any specific privacy information we give you when you book or use a particular service.

3. Personal data we collect

The data we collect depends on how you interact with us. It may include:

Identity and contact details: name, email address, telephone number, postal address, country and other details you provide.
Account and membership information: account identifiers, membership status, profile information, preferences, access records and information needed to administer your membership.
Billing and payment information: billing address, payment status, transaction details, invoices and payment records. If an external payment provider processes your payment, it may collect your card details directly. We generally receive transaction and payment-status information from that provider.
Bookings and event information: booking details, attendance, travel or accommodation information where relevant, and communications about a retreat or event.
Dietary, accessibility and health information: information you choose to give us so we can plan for your participation or make reasonable arrangements. Some health information, and some information that reveals health or other protected characteristics, may be special category data under data protection law.
Community content and messages: posts, comments, messages, questions, reactions, information you share in groups, and your interactions with other members or our team.
Communications: enquiries, support requests, correspondence, and records of communications with you.
Feedback and testimonials: reviews, survey responses, suggestions, testimonials, and any associated name, image or other information you agree to provide.
Technical and usage data: information such as IP address, device and browser details, website pages viewed, approximate location derived from technical data, and information about how you use the website. Cookies and similar technologies may collect some of this information.
Marketing preferences: whether you have opted in or out of marketing, your communication preferences, and records of consent or withdrawal.
Information from service providers: where relevant, information provided to us by platforms or providers that support our services, such as account, payment, booking, attendance or delivery status.

Some information is necessary to set up or provide a membership, process a booking or payment, or respond to a request. If you do not provide it, we may be unable to provide the relevant service. Marketing choices are optional. Providing dietary, accessibility or health information is also optional, but without it we may not be able to make the arrangements you request.

4. How we collect your data

We collect personal data:

directly from you when you contact us, create an account, join, book, make a payment, complete a form, attend an event, or post or communicate in a community;
automatically when you use our website, subject to your cookie choices and applicable law; and
from platforms and service providers that help us operate our membership, communications, payments, bookings, events and website.

Please do not provide personal data about another person unless you are authorised to do so and have informed them, where appropriate.

5. How and why we use your data

We use personal data only where we have a lawful basis under the UK GDPR and the Data Protection Act 2018. Depending on the purpose, the basis is:

Contract: processing necessary to enter into or perform a contract with you, including membership or booking terms.
Legitimate interests: processing necessary for our legitimate interests, where those interests are not overridden by your rights. Our interests may include running and improving our services, supporting members, maintaining a safe and well-managed community, and protecting our business. We consider the impact on your rights when relying on this basis.
Legal obligation: processing necessary to comply with legal or regulatory requirements.
Consent: processing where you have freely agreed to a specific use of your data. You may withdraw consent at any time, without affecting processing carried out before withdrawal.

Purpose	Examples of data used	Lawful basis
Set up and administer membership, provide access to Skool, the Vault, trainings, challenges and other membership benefits	Identity, contact, account, profile, payment and membership information	Contract; legitimate interests for administration and service security
Provide community support, co-working sessions, check-ins, meditations and journal prompts	Account, profile, participation, community content and communications	Contract; legitimate interests in operating and moderating the community
Arrange and administer retreat and event enquiries, bookings and attendance	Identity, contact, booking and relevant event information	Contract; legitimate interests in organising and managing events
Make dietary, accessibility or health-related arrangements you request	Relevant dietary, accessibility or health information	Consent for ordinary personal data where appropriate; explicit consent where required for special category data
Process payments, refunds, invoices and membership renewals	Identity, billing, payment and transaction information	Contract; legal obligation for required financial records
Respond to enquiries, provide customer service and send service-related notices	Contact details, account information and correspondence	Contract where related to a service; legitimate interests in responding to enquiries and administering our relationship
Maintain community standards, moderate content, protect members, prevent fraud and address misuse	Account, usage, community content and relevant communications	Legitimate interests; legal obligation where applicable
Operate, secure and improve our website and services	Technical, usage and service feedback data	Legitimate interests; consent for non-essential cookies or similar technologies where required
Send direct marketing about our services and events	Contact details and marketing preferences	Consent where required by law; otherwise, legitimate interests only where permitted by applicable marketing rules
Collect and use feedback or publish a testimonial, image or story	Feedback, testimonial and related identity or image information	Legitimate interests for private service improvement; consent where needed for publication or promotional use
Meet legal, tax, accounting and regulatory duties and establish or defend legal claims	Identity, transaction, communication and relevant service records	Legal obligation; legitimate interests in protecting and defending our legal rights

We do not use your personal data to make decisions about you based solely on automated processing that produce legal or similarly significant effects.

6. Marketing communications

We may send you information about Scary But Brave memberships, retreats, events, trainings and related services.

Where the law requires consent, we will ask for it before sending marketing electronically. In limited circumstances, the law may allow us to send marketing to existing customers about our own similar services without separate consent, if the applicable conditions are met. You can opt out when we collect your details and in every marketing message.

You can withdraw consent or object to direct marketing at any time by using the unsubscribe link in a message or emailing Amber@ScaryButBrave.com. We will retain a limited record of your preference so we can respect your request.

Service messages needed to administer a membership, booking, payment or event are not marketing messages.

7. Cookies and similar technologies

Our website may use cookies and similar technologies. These can include:

Strictly necessary technologies, which are needed to operate the website or provide a service you request. Our cookie choice control stores your preference so we can remember your selection.
Analytics or performance technologies, which help us understand how the website is used and improve it. When enabled, our website analytics are provided by PostHog. They measure page visits and interactions to help us understand how the website is used and improve it. PostHog data collection is off by default and is enabled only if you choose “Accept analytics”.
Advertising, personalisation or social media technologies, which may be used to support marketing, tailor content or enable third-party features.

Where required by law, we will ask for your consent before placing or accessing non-essential cookies or similar technologies. You can change or withdraw your choices at any time using the “Cookie settings” link in the website footer, and can also manage cookies through your browser settings. Blocking some cookies may affect website features.

The specific cookies and providers in use may change. Information about them, including their purpose and duration, should be available through the website’s cookie notice or consent controls.

8. Who we share data with

We may share personal data with service providers who help us deliver and administer our services. Depending on the services in use, these may include:

Skool, for our membership community and related platform features;
WhatsApp and Meta, for private community groups and communications;
payment processors, for payment collection and related transaction services;
email and marketing providers, for communications and marketing preference management;
booking, event and accommodation tools or providers, where needed to arrange a booking or event;
website hosting, analytics, security and technical support providers; and
professional advisers, auditors, insurers, regulators, law enforcement or other authorities, where necessary for legal, regulatory or business-protection purposes.

Our providers may process data on our instructions as processors. Some platforms may also process your data as separate controllers under their own privacy terms—for example, when they operate their platform, account, messaging or security functions. You should review the relevant provider’s privacy information before using its service.

We require service providers acting for us to protect personal data and use it only in accordance with our instructions and applicable law. We do not disclose more data than is reasonably needed for the relevant purpose.

We may also disclose information where required by law, to protect someone’s rights or safety, or in connection with a business reorganisation or transfer, subject to applicable data protection requirements.

9. International transfers

Some of our service providers or their systems may be located outside the United Kingdom, or may access or store data in another country. That country may have data protection laws different from those in the UK.

Where UK data protection law requires a safeguard for an international transfer, we will use an applicable transfer mechanism. Depending on the destination and the provider, this may include UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses. We will take any further steps required by law for the transfer.

You can contact us at Amber@ScaryButBrave.com to ask for further information about relevant transfer safeguards, subject to any lawful restrictions.

10. How long we keep your data

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including to provide services, meet legal requirements, resolve disputes and protect our legal rights. Retention depends on the type of information and the reason we hold it.

Our general retention approach is:

Membership and account records: while your membership is active and, ordinarily, for up to 24 months after it ends, unless we need to keep particular records for a longer period for a legal, accounting or dispute-related reason.
Payment, invoice and accounting records: for up to six years after the end of the relevant financial year, or longer if required by law or needed for a specific legal matter.
Event and retreat records: booking and practical attendee information is ordinarily kept for up to 12 months after the event. Financial records are retained under the period above. We may keep specific incident, insurance or legal-claim records for as long as reasonably needed.
Community content: content may remain available while you are a member. When an account is closed, we will take reasonable steps to remove or de-identify content linked to your account where appropriate. Messages or content already shared with other members, copied by recipients or retained by a platform may not be removable from their accounts or systems.
Marketing records: until you unsubscribe or withdraw consent. We may retain a minimal suppression record afterwards so we do not send you marketing again.
Website and technical records: for as long as needed for security, troubleshooting and analytics purposes, subject to the retention periods and controls of the relevant provider and cookie.

Where information is no longer needed, we will delete it or anonymise it securely.

11. How we protect your data

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration or disclosure. Measures may include access controls, limiting access to people who need it, secure service providers and systems, and reviewing the personal data we collect and how long we keep it.

No online service or method of storage is completely secure. You should use appropriate care when sharing information online and protect your account credentials.

12. Community privacy and member information

We want our community to be supportive and respectful. If you participate in a Skool or WhatsApp group or another member space, information you share may be visible to other members and to the platform provider.

Members are expected to respect the privacy of other members and not to share their stories, contact details, messages, images or other personal information outside the community without permission. However, we cannot guarantee that other members will comply, or that information shared in a third-party platform will remain confidential. Please think carefully before posting sensitive personal, business, health or financial information.

The platform provider may process data under its own privacy terms. Please also review the relevant platform’s privacy information and settings.

13. Your data protection rights

Subject to applicable law and any relevant exemptions, you may have the right to:

Access your personal data and receive information about how we use it.
Rectify inaccurate or incomplete data.
Erase your data in certain circumstances.
Restrict processing in certain circumstances.
Object to processing based on legitimate interests. You have an absolute right to object to direct marketing.
Port certain data to you or another organisation where the right applies.
Withdraw consent at any time where we rely on consent. This will not affect processing carried out before withdrawal.
Complain to the ICO.

To exercise a right, or ask a question about your data, email Amber@ScaryButBrave.com. We may need to verify your identity before responding. We will respond within the period required by law. Some rights are not absolute and may not apply in every situation.

You can complain to the ICO at www.ico.org.uk. We would appreciate the opportunity to address your concern first, but you are entitled to contact the ICO directly.

14. Changes to this policy

We may update this policy to reflect changes in our services, data practices or legal requirements. We will publish the current version on our website and update the “Last updated” date above. If a change materially affects how we use your data, we will provide additional notice where required by law.

15. Important notice

This document is provided for general informational purposes and is not legal advice. It should be reviewed and approved by a licensed solicitor before publication.