Privacy Policy

This policy explains how Gentle Space("we", "us") collects and uses your personal information when you visit our website, read our articles, subscribe to our newsletter, register an account, or post in our community forum.

We take your privacy seriously. Gentle Space is used by people going through a vulnerable stage of life; we hold a high bar for the care of your information.

Who we are

The data controller is [Legal entity name to be confirmed before launch], a UK-based operator. You can contact us at clare@gentlespace.net.

What we collect and why

When you browse articles

• We only load analytics cookies if you accept them in the cookie banner. See our Cookie Policy.
• We receive anonymised, aggregated analytics from Google Analytics 4 (GA4): pages visited, general location, device type. We do not link this to your identity.

When you subscribe to the newsletter

• We store your email address, a timestamp, and a hash of your IP address.
• Lawful basis: consent. You tick the consent box when you subscribe. You can withdraw consent at any time using the unsubscribe link in every email.
• Your email is also synced to Brevo, our email delivery provider, so we can send you the verification email and the newsletter.

When you join the therapy waiting list

• We store your email address, a timestamp, and a hash of your IP address (we never keep the raw IP). We do not ask for your name.
• Lawful basis: consent. You tick the consent box when you join. We use it only to let you know when our flexible therapy service becomes available. We do not send you anything else in the meantime.
• Your email is added to a dedicated waiting-list audience in Brevo, our email provider, so we can send you a confirmation now and let you know when the service is ready. It is not added to the newsletter or any other list.
• You can ask us to remove you from the list at any time by emailing clare@gentlespace.net.

When you register an account

• We store your email, display name, and a password hash (Argon2id, never plaintext).
• Optionally, you can tell us which country you are joining from. This is stored at country level only, never anything more specific, and we use it solely to show that our community is global. You can leave it blank. Lawful basis: consent.
• Lawful basis for your account: performance of a contract (giving you an account so you can participate).

When you post in the forum

• Your display name and post content are public. Your email is never shown to other members.
• Posts are automatically screened for language suggesting acute risk. In those cases, you will see a compassionate reminder of crisis resources before you post.
• Lawful basis: legitimate interests (running a safe community).

Your private journal

• Anything you write in your journal, including your mood check-in, is private to you. It is stored securely in our database and is visible only to you when you are signed in. No other member, moderator or administrator can read it.
• We do not scan, analyse, or use your journal for moderation or any other purpose. It is not screened for crisis language the way public posts are, because it is private.
• You can delete any entry at any time. When you delete your account, your journal is deleted entirely (not anonymised, since there is no reason to keep it).
• Lawful basis: consent, which you can withdraw at any time by deleting your entries.

Who we share data with

We share the minimum necessary information with the following processors, each under a Data Processing Agreement:

• Railway: hosting, Postgres database (where your account data lives), and Redis (rate-limiting counters)
• Brevo: sending transactional emails (account verification, password reset, newsletter confirmation, therapy waiting-list confirmation), and holding newsletter and therapy waiting-list contacts
• OpenRouter: AI-assisted moderation of public forum posts (post content only, no personal identifiers)
• Google Analytics 4: anonymised traffic analytics, loaded through Google Tag Manager (only if you consent)
• Sanity: our content management system (holds our articles, not your personal data)

We do not sell your data. Ever.

How long we keep data

• Newsletter subscribers: until you unsubscribe.
• Therapy waiting list: until the service launches and you decide whether to continue, or until you ask us to remove you, whichever comes first.
• Account data: until you ask us to delete your account. Forum posts are anonymised rather than deleted so conversations stay coherent for the community. Your private journal is deleted in full when you delete your account.
• Moderation logs: retained as an audit record, in line with the Online Safety Act.
• Analytics: retained by Google for up to 14 months.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct information that is wrong
• Delete your account and personal data (note: forum posts are anonymised rather than deleted, as explained above)
• Withdraw consent for analytics or newsletters at any time
• Object to processing or ask us to restrict it
• Port your data to another service

To exercise any of these rights, email clare@gentlespace.net.

You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your data.

Children

This service is designed for adults. We do not knowingly collect data from children under 16. If you believe we have, please contact us and we will remove it.

Changes to this policy

We will update this page when our data practices change and note the date at the top of the page. Material changes will be announced to newsletter subscribers.