Privacy Notice

1. Who controls your data

Isaac Mullins is the data controller for Isaac Mullins Yoga. He trades as a sole trader, not through a company. Write to hello@isaac.yoga with any question about your personal data.

2. What we hold

Your email address and name.

Session records: when you sign in, together with the IP address and user agent (browser and device information) used to sign in.

A Stripe customer reference, so we can find your subscription and payments.

Records of your purchases and of the consents you gave at checkout (for example, agreeing to lose your 14-day cancellation right for immediate access).

A security record of account events (signing in, signing out and deleting an account), separate from the session record above. This can include the IP address used for a sign-in or sign-out, and, only if you delete your account, the email address you deleted it from.

While an email to you is waiting to be sent: your address, which message it is, and the details needed to send it. Those details are cleared once the email has gone.

3. Why we hold it

To perform our contract with you: creating your account, running your membership or course access, and taking payment.

To meet a legal obligation to keep transaction records.

4. Who we share it with

Stripe processes your payments and holds your card and billing details on our behalf; we never see or store your card number.

Resend sends transactional emails on our behalf, such as sign-in links and receipts.

Both act only on our instructions, as processors, and do not use your data for their own marketing.

5. How long we keep it

If you delete your account (in /account/), your account record - including your name, password and session records - is deleted immediately.

Purchase records and the record of the consents you gave at checkout are not deleted with your account, and are instead kept for six years. This is because a sole trader must keep transaction records for six years, and the consent record is the evidence that you validly agreed to waive your 14-day cancellation right. What remains after your account is deleted is an account reference, the item bought, the amount and the date - not your name or email.

We also keep a security record of account and sign-in events, which is not deleted when your account is and is not linked back to it. This includes the email address recorded at the moment you delete your account, and IP addresses recorded against sign-in and sign-out events. We keep this for six years too, in line with the transaction records above.

6. Your rights

Under UK GDPR you can ask to see the personal data we hold about you, have it corrected, have it erased, restrict how we use it, object to our use of it, or receive a copy in a portable format.

To exercise any of these rights, write to hello@isaac.yoga. You can also complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with how we have handled your data.

7. Deleting your account

You can delete your account at any time from /account/. This deletes your account record - your name, password and session records - immediately.

As explained in clause 5, purchase and consent records survive this, and so does a security record of the deletion itself, which necessarily includes the email address you deleted it from. None of these are linked back to your account once it is gone.

8. Cookies

The only cookie Isaac Mullins Yoga sets is the session cookie that keeps you signed in.

It is strictly necessary, under PECR regulation 6(4), to provide the service you have asked for, so it does not need your consent and there is no cookie banner.

We do not use analytics or advertising cookies.