Privacy Policy
Last updated: 24 July 2026 · Version 1.0
Owner to confirm before launch: registered company number, registered office address, ICO registration number, and a contact email (e.g. privacy@theactiontaker.co.uk). These placeholders are marked throughout in [brackets].
1. Scope
This policy explains how we collect, use, share and protect your personal data when you use our website, mobile apps and related services (together, the "Service"), and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. The data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (stored only as a secure hash), membership tier | You, at sign-up |
| Authentication data | Sign-in and verification codes, social sign-in identifiers (Google/Apple/Facebook), 2FA status | You / your chosen provider |
| Transaction data | Subscription status, payment records, amounts and dates (card details are handled by Stripe — we never store full card numbers) | You / Stripe |
| Support data | Messages you send us and our replies | You |
| Usage & analytics data | Pages viewed, episodes watched, approximate location (country), device type, referrer | Collected automatically, only with your cookie consent |
| Communications | Newsletter subscription status and email preferences | You |
3. How and why we use it (lawful bases)
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Create and run your account; provide episodes and membership | Performance of a contract |
| Process payments and manage subscriptions | Performance of a contract |
| Secure the Service (2FA, login lockout, audit logging, fraud prevention) | Legitimate interests (keeping the Service and accounts secure) |
| Send you the weekly newsletter and product emails | Consent (you can withdraw at any time) |
| Analytics to understand and improve content | Consent (via the cookie banner) |
| Comply with legal, tax and accounting obligations | Legal obligation |
4. Cookies and analytics
We use strictly necessary cookies to run the Service, and — only after you accept — analytics cookies (Google Analytics 4 and the Meta Pixel) and first-party analytics. Nothing non-essential runs until you click "Accept". See our Cookie Policy for the full list and how to change your choice at any time.
5. Sharing your data
We do not sell your personal data. We share it only with processors and partners that help us run the Service, under contract and only as needed:
- Stripe — payment processing.
- Email/SMS/push providers — to deliver verification codes and messages you've consented to. [Owner to confirm provider, e.g. Postmark, Twilio.]
- Google, Apple, Meta — where you choose social sign-in, or where you've consented to analytics.
- Hosting/infrastructure provider — [Owner to confirm].
- Authorities — where required by law.
Some providers may process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or adequacy regulations.
6. How long we keep it
We keep account and transaction data for as long as your account is active and then as required for legal, tax and accounting purposes (generally up to 6 years for financial records). When you close your account we anonymise your personal data (soft-delete) so it can no longer identify you, retaining only what the law requires. Analytics data is retained for up to 26 months.
7. Your rights
Under UK GDPR you have the right to: access your data; correct it; erase it; restrict or object to processing; data portability; and withdraw consent at any time. You can:
- Download your data — from your account, or by emailing [privacy@theactiontaker.co.uk]. Signed-in members can export via the account area (a machine-readable copy).
- Delete your account — from your account settings ("Delete my account"), which triggers erasure/anonymisation, or by contacting us.
- Unsubscribe — from any newsletter via the link in the email or in your account.
We respond to rights requests within one month. If you're unhappy with how we handle your data you can complain to the ICO at ico.org.uk or 0303 123 1113.
8. Security
We protect your data with measures including: passwords stored only as salted bcrypt hashes; two-factor authentication on sign-in; automatic lockout after repeated failed logins; encrypted connections (HTTPS/HSTS); a strict Content-Security-Policy; verified payment webhooks; and an internal audit log of sensitive actions. No system is perfectly secure, but we work to protect your data and will notify you and the ICO of any breach where the law requires.
9. Children
The Service is intended for users aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us and we will delete it.
10. Changes
We may update this policy. We'll post the new version here with a revised date and, for material changes, notify you by email or in-app.
11. Contact
Data controller: Global Tech Develop Ltd, [registered office address]. Email: [privacy@theactiontaker.co.uk]. ICO registration: [number].