CBC Sanctuary Privacy Policy

Version 1.2 | 19 October 2026

Definitions: “Company”, “CBC”, “we”, “us” and “our” mean Calm But Capable Ltd. “Sanctuary” means the Company’s adult educational and personal development membership service and associated personal workspace. “You” and “your” mean the individual whose personal information is processed. “Member” means an individual holding a Sanctuary membership. “Personal information” means personal data as defined by applicable UK data protection law. “Supplier” means an external provider used to operate or support the service.

This policy explains how Calm But Capable Ltd uses personal information when you visit our website, join Sanctuary or contact us. Sanctuary is an adult educational and personal development membership service with an AI personal workspace.

1 Data controller

1.1 Calm But Capable Ltd is the controller of the personal information described here. Company number: 17360057. Address: 2 St Oswalds Crescent, Sandbach, CW11 1RW. Contact hello@calmbutcapable.com for privacy questions or to exercise your rights.

2 Categories of personal data

2.1 We collect account and contact information, such as your name, email address, account preferences and securely hashed password; membership, payment and subscription references; and records of the terms and declarations you accepted, including dates and versions. Our payment provider collects payment details for processing your purchase. Do not put full card details into Sanctuary conversations.

2.2 We store the material you enter or save in Sanctuary, including questions, AI conversations and responses, journals, reflections, notes, goals, projects and plans. Optional check-ins may include energy scores or other personal reflections.

2.3 We also process information needed to operate and secure the service, such as usage and processing records, audit records, export requests, email delivery records, and correspondence about support, complaints or privacy requests. Our email communications provider records email opens and link clicks.

3 Purposes and lawful bases

3.1 To create and manage your account, supply your membership, process payments and provide your saved workspace and AI responses, we use information necessary to perform our contract with you or take steps you request before entering that contract.

3.2 We rely on legitimate interests to maintain service security and reliability, prevent misuse, manage reasonable usage, resolve complaints and establish, exercise or defend legal claims. These interests are running a sustainable service and protecting members and CBC. We consider the effect on your privacy and your rights.

3.3 Where a specific law requires us to keep accounting records or disclose information, we rely on that legal obligation. Where we rely on consent, you can withdraw it within Sanctuary where a control is provided or by contacting us; withdrawal does not make earlier lawful processing unlawful. Marketing is explained in section 7.

4 Special category and sensitive information

4.1 You choose what to write in your workspace. Avoid unnecessary sensitive information and information about other people. Do not enter passwords, authentication codes or confidential material you are not authorised to share.

4.2 Personal reflections may reveal health, beliefs, ethnicity, sexuality or other specially protected information. Simply entering such information or accepting membership terms is not explicit consent to its processing.

4.3 We ask for your explicit consent, separately from agreement to the membership terms, to store and use special category information you choose to provide in your personal workspace, including processing by our AI and hosting suppliers. The consent statement is shown when you join and within Sanctuary. Your choice, the statement version and the date are recorded. You can withdraw consent within Sanctuary or contact hello@calmbutcapable.com. Without consent, new journal entries, check-ins, personal plans and AI requests are paused. Withdrawal does not cancel your subscription or automatically delete existing records. Where necessary for establishing, exercising or defending legal claims, special category records may be retained under the applicable legal-claims condition, subject to section 8. Do not enter criminal conviction or offence information about yourself or others; the personal workspace is not intended to collect that information.

5 AI processing and administrative access

5.1 Your questions and relevant conversation context are processed by an external AI service to generate responses. The AI supplier project currently has global data residency. Model feedback sharing, evaluation and fine tuning sharing, and input and output sharing are disabled. These settings do not mean that processing or logging does not occur. API call logging is enabled.

5.2 Nicholas Castle is currently the only person with administrative access to CBC’s live servers, database and member conversations. Administrative access may be needed to provide support, investigate faults or misuse, address complaints or meet legal obligations. Supplier processing and authorised supplier access may also be necessary to operate their services.

5.3 Sanctuary is not a confidential professional consultation, therapy or an emergency monitoring service. Conversations are not guaranteed to be reviewed by a person. Do not rely on Sanctuary to detect danger or arrange urgent help. No online system can guarantee absolute security.

6 Recipients and international processing

6.1 We use providers of website and backend hosting, managed databases and backups; AI response generation; payment processing and subscriptions; service email delivery; and CBC email communications and email engagement tracking. We also use a search engine webmaster service to manage website search visibility. We can provide current supplier details on request.

6.2 CBC’s website, backend and managed database are hosted in London, United Kingdom. Daily backups of both hosting servers and the database are kept for seven days. Our service email sending region is Ireland, EU-West; its stated retention period is 30 days. Other suppliers may process information outside the UK. An email sending region does not establish the location of all supplier processing.

6.3 CBC does not sell your personal information or disclose your journals or conversations for third-party marketing. We use external service providers to host and operate Sanctuary and generate AI responses. Information is disclosed to those providers where necessary for those purposes. We may also disclose relevant information where legally required or lawfully necessary to address a serious safety concern or establish, exercise or defend a legal claim. Any disclosure must have an applicable lawful basis and, where required, an additional condition for processing special category data.

6.4 Where suppliers process personal information outside the United Kingdom, their applicable data processing agreements provide transfer safeguards, including Standard Contractual Clauses supplemented by the UK International Data Transfer Addendum where required. Transfers may also take place under an applicable UK adequacy regulation. These safeguards address protection of information transferred overseas; they do not mean that all supplier processing takes place in the UK. Contact hello@calmbutcapable.com for information about the safeguards applicable to a supplier or to request a copy, subject to necessary redactions.

7 Electronic communications and marketing

7.1 When you join Sanctuary, your email address is added to our CBC email communications service unless you opt out before transfer. These emails include CBC information and promotions about our own similar services. Each email provides an unsubscribe option. You can also contact hello@calmbutcapable.com to stop marketing.

7.2 For these marketing emails, we rely on legitimate interests together with the customer soft opt-in only where we collected your details during a sale or negotiations for a sale, the emails concern our own similar products or services, and we gave you an opportunity to opt out when collecting your details and in every message. Where those conditions do not apply, we need your consent before sending unsolicited marketing emails.

7.3 Unsubscribing from marketing does not stop necessary account, payment, security or service messages. We may retain a minimal suppression record to respect your opt-out.

7.4 Email open and click tracking. Our email management service records when optional CBC emails are opened and which links are clicked. We use this information to understand engagement and improve our communications. If you do not wish to receive these tracked emails, you can opt out before your details are added to the email service or unsubscribe using the link in any optional email. Opting out does not affect your Sanctuary membership. Necessary account, payment, security and service messages will continue.

8 Retention and deletion

8.1 We keep your account and saved workspace while your account remains open. Our retention policy for account, membership and associated service records, including journals, questions and AI responses, is six years after your account closes or a related complaint is finalised, whichever is later. These records preserve the context of the service and communications where necessary for complaints and legal claims.

8.2 Retention under clause 8.1 is subject to applicable data protection law. We review whether continued retention is necessary and consider requests for deletion, restriction or objection. Information may be deleted earlier where retention is no longer justified or your rights require it.

8.3 We may retain relevant records longer where a specific legal obligation, ongoing proceedings or a necessary legal hold requires it. Accounting records follow applicable statutory requirements. At the end of the applicable period, information is deleted or anonymised.

8.4 Backup copies follow the seven-day backup cycle. Supplier operational records may have different retention periods from the records in your CBC account. Our service email supplier states a 30-day retention period. We keep marketing contact records while you remain subscribed, subject to necessary suppression records when you opt out.

9 Data subject rights

9.1 Depending on the circumstances, you can ask for access to your personal information, correction, deletion, restriction of use or a portable copy. You can object to processing based on legitimate interests and always object to direct marketing. Where processing depends on consent, you can withdraw it. Rights may be subject to lawful exceptions, including necessary legal-claims retention.

9.2 Contact hello@calmbutcapable.com. We may need to verify your identity securely. We normally respond within one month; where the law permits an extension for complexity or the number of requests, we will explain it.

9.3 You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/ or call 0303 123 1113. You may contact us first, but you do not have to do so before contacting the ICO.

10 Account closure and provision of information

10.1 Contact us if you want to close your account or request deletion. Stopping subscription renewal, closing an account and requesting deletion are separate actions; tell us which you want so that we can address your request properly. Ask for a copy of saved work before closure.

10.2 Account and payment information needed for membership must be provided for us to supply that service. You choose what to put in your journals and conversations. If you do not provide information needed for a particular feature, we may be unable to provide that feature.

11 Browser storage and automated processing

11.1 We use optional Meta Pixel advertising measurement on the four public marketing pages listed in section 11.3, only after you allow advertising cookies. We do not currently use a separate general visitor analytics service. A search engine webmaster service is used for website search visibility. Sanctuary uses browser local storage to keep your login token, navigation choices, daily visit and check-in markers, saved step drafts, introductory notes and reflections, including saved AI reflections. This supports signing in, returning to your work and remembering your choices. Local storage remains in that browser until removed by the service or cleared through your browser settings; the Sanctuary local storage described in this paragraph has no automatic expiry in the current implementation. Our separate advertising preference is explained below. Signing out removes your login token and last-view setting but does not clear all saved local content. Resetting the step flow clears its previous draft; using the flow again may save a new draft. You can clear the website’s stored data in your browser settings, which signs you out and may remove locally saved work. Clearing browser data does not delete records held on CBC’s servers. On shared devices, sign out and clear site data when you have finished. External payment and linked services operate their own browser storage under their own notices.

11.2 AI generates responses, which may contain mistakes. CBC does not describe those responses as decisions with legal or similarly significant effects about you. You remain responsible for considering suggestions and choosing your actions.

Optional advertising measurement on public pages

11.3 With your consent, we use Meta Pixel to measure visits to /business-owners, /career-change, /finish-your-project and /start-a-side-business. This helps us assess Facebook and Instagram advertising. The browser integration sends a PageView event. With a current advertising consent choice, a separate server integration can send a Purchase event after Stripe verifies a completed, paid membership checkout. Purchase measurement is disabled until the server integration is configured. It is not loaded on the homepage, login or membership confirmation pages, or inside private Sanctuary workspaces. We do not send journal entries, conversations, reflections, goals, passwords or account form contents to Meta through this integration. Automatic configuration is disabled and we do not supply customer details for advanced matching.

11.4 If you allow advertising cookies, your browser connects to Meta Platforms and Meta receives information such as your IP address, browser and device information, the page address and referrer, event timing and cookie or advertising identifiers. Public page addresses may include advertising click identifiers or campaign parameters. Meta may associate activity with your Meta account and use information for its own advertising and measurement purposes as explained in its notices. Meta is an additional recipient of this public-page advertising information; this does not give Meta access to your private Sanctuary workspace. See Meta’s Privacy Policy and Meta’s Cookies Policy for its processing, international transfers, retention, cookie durations and account controls.

11.5 We rely on your consent for this optional advertising measurement and its cookies. No Meta script is loaded by this integration before you select “Allow advertising cookies”. You can select “Reject advertising cookies” and continue using the website. On any of the four public pages listed above, select “Advertising cookies” to reopen the controls and change your choice. Rejecting after previously allowing revokes consent and reloads the page to stop this integration. Withdrawal does not undo information already sent to Meta. Advertising consent is separate from email preferences and consent to process personal workspace information.

11.6 We store your advertising choice and its date in this browser under the local storage key cbc-meta-consent-v2. The website treats that choice as valid for 180 days, then asks again; the stored record itself remains until replaced or cleared. If browser storage is unavailable, your choice may not persist between visits. After acceptance, Meta may set cookies such as _fbp and, where an advertising click identifier is present, _fbc. Their duration is controlled by Meta and browser settings and is separate from the 180-day CBC preference period. Changing your choice stops future use by this integration but may leave existing cookies stored in your browser. You can remove them through your browser’s site-data controls. Clearing all CBC site data also removes your sign-in and locally saved work as described in section 11.1. Meta account privacy and advertising controls are available through Meta’s notices linked above.

11.7 Purchase measurement uses Meta’s Conversions API directly from CBC’s server. On your return from Stripe, the confirmation page checks your current advertising choice in this browser before requesting measurement. The server checks the payment with Stripe and sends only the purchase event time, an opaque event identifier, actual initial invoice amount paid, currency, a confirmation-page address without the checkout query string, your browser user agent and available Meta browser/click identifiers (_fbp and _fbc). We do not send your email address, telephone number, payment-card information, Stripe checkout reference, account form contents or private workspace contents to Meta through this integration. The Meta browser script is not loaded on the confirmation page. No purchase is reported when advertising consent is rejected, expired or unavailable. Withdrawing consent stops future measurement requests but cannot recall a purchase already shared. CBC stores a hashed checkout-based delivery marker to prevent duplicate reports; it contains no customer contact data or saved browser identifiers and is handled as an associated service record under section 8. If you close the page before measurement completes or your browser blocks the required identifiers, the purchase may not be measured. Subscription renewals are not reported by this integration.

12 Changes to this policy

12.1 We update this policy when our services or data handling change. We will make the current version available on the website and communicate significant changes where appropriate.