Privacy notice

Who we are

Mindset Reset Hub runs this website and the membership known as the Reset Vault. For the purposes of UK data protection law we are the data controller for the personal data described here, which means we decide what is collected and why.

You can reach us about anything in this notice by email at support@mindsetresethub.com, by phone on 07901 572017, or through the contact form.

We do not have a statutory Data Protection Officer. Enquiries about your data go straight to the person who runs the business.

What we collect and why

We collect the least we can and still run a membership. There is no tracking, no profiling and no advertising here.

Where we rely on legitimate interests, we have considered whether our interest is fair to you. Blocking spam, keeping a record of enquiries and knowing that a password reset arrived are all things a reasonable person would expect a business to do, and none of them involve building a profile of you.

We do not collect special category data. Please do not send us health information through the contact form. If you do, we will use it only to answer you and we will delete it once the enquiry is closed.

Where your data comes from

Almost all of it comes from you: what you type when you register, what you edit in My Account and what you send us through the contact form. Payment and subscription details come back to us from Stripe after you pay. Playback positions and log entries are created by the site as you use it. We do not buy lists or take data from third parties.

Who we share it with

We do not sell your data and we do not share it for anyone else's marketing. We use a small number of suppliers to run the service. Each one processes data on our written instructions.

We will also disclose data where the law requires it, for example to HMRC for tax records or in response to a valid court order, and to our professional advisers if we need advice on a dispute.

Transfers outside the UK

The application, its database and your media files are hosted in the United Kingdom. Some of our suppliers process data outside the UK, principally in the European Economic Area and the United States. Where that happens, the transfer is covered by UK adequacy regulations, the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework, depending on the supplier.

You can ask us for details of the safeguards that apply to any particular transfer.

How long we keep it

How we keep it safe

• The whole site is served over HTTPS.
• Passwords are stored as one-way hashes. Nobody at Mindset Reset Hub can read your password, and we will never ask you for it.
• Card numbers never touch our servers. Payment happens on Stripe's own pages.
• Membership media is stored outside the public part of the server and served only through an authenticated route that re-checks your entitlement on every single request. There are no guessable file links.
• Access to the admin area is restricted to accounts that hold the administrator role.
• Backups run nightly and are kept for 14 days.

No system is perfect. If we ever suffer a breach that is likely to put your rights at risk, we will tell you and report it to the Information Commissioner's Office within 72 hours of becoming aware of it.

Cookies

This site sets only the cookies it needs to keep you signed in and to protect its forms. There is no analytics, no advertising and no third-party tracking, and the fonts are served from our own server rather than from Google. The cookie notice lists every cookie by name.

Emails and your preferences

There are two kinds of email here, and they are handled separately.

• Account emails. Email verification, password resets, payment problems and cancellation notices. These are part of running your membership, so we send them for as long as you have an account.
• New-content alerts. A short monthly email listing what has just been released. Every one of them carries an unsubscribe link, and you can also switch them off in My Account. Turning them off never stops your account emails.

Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted, where we do not have to keep it for a legal reason;
• ask us to restrict how we use it while a question about it is resolved;
• receive the data you gave us in a portable, machine-readable format;
• object to processing we carry out under legitimate interests; and
• withdraw consent at any time, where we relied on consent.

You can do some of this yourself: your name and email address are editable in My Account, new-content alerts have a switch there, and My Account also has a delete-my-account option that closes the account and removes your personal data, keeping only the payment records the law requires us to keep.

For anything else, email support@mindsetresethub.com and tell us what you want. We will reply within one month. There is no charge unless a request is clearly unfounded or excessive, and we will tell you before doing anything that would incur one. We may ask you to confirm your identity first, so that we do not hand your data to someone else.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at any time.

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. ico.org.uk

Changes to this notice

We will update this notice when what we do changes. The date at the top always shows when it last changed. If a change materially affects how we use your data, we will tell members by email rather than relying on you to check.