Last updated: 4 September 2026
Contact: Contact us here or write@unwrittensocialrules.com
Address: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Company Number: 16732668
ICO Number: ZC026746
In brief: We collect your name and email to deliver the document you buy and, if you opt in, to send you essays. If you choose to email us about running a protocol, that email may say something about your health; we hold it only with your clear agreement, only to reply to you and revise the protocol, and never for marketing. We do not use analytics or advertising, and we never sell your data.
We are Mane Mentis Ltd, a UK-registered company trading as Unwritten Social Rules. We write and sell protocol documents for adults with ADHD, delivered as a PDF by email, and we publish free essays.
The documents are written from one person's experience. They are not therapy, medical advice or a substitute for professional care, and no outcome is promised. We operate globally.
We are the data controller for the personal data described in this notice. We are registered with the Information Commissioner's Office (ICO) as a data controller.
Data Protection Officer: we have not appointed one and are not required to under Article 37 UK GDPR: we are not a public authority and we do not monitor anyone. We do process a small amount of special category data (Section 2), on explicit consent and at small scale. We keep a record of our processing activities (Article 30 UK GDPR) and review it whenever a processor or a purpose changes.
We are responsible for demonstrating compliance with the UK GDPR principles (Article 5(2)).
We collect data directly from you when you buy a document, subscribe to our essays, email us, or contact us through the form. We collect only what is needed for each purpose (Article 5(1)(c), data minimisation).
We collect:
We do not collect:
Cookies and tracking: we use only the essential functional cookies that Kit and Stripe need to deliver the page and take the payment. We do not use analytics, advertising or tracking cookies, and we set no cookies ourselves. For the cookies those platforms set, see Kit's and Stripe's privacy policies.
Why we need this data: your email address and payment are needed to form and perform the contract (Article 6(1)(b)). Without them we cannot deliver the document or process a refund. Everything else is optional.
We use your data to:
Report-back emails. We read your email and reply to you, and we use what you tell us to revise the protocol. Our basis for holding the email is our legitimate interest in improving the document and answering the people who buy it (Article 6(1)(f)). For anything in it about your health, our basis is your explicit consent (Article 9(2)(a)), which you give by sending the email after reading this sentence, which appears beside every report-back ask:
By sending this email you agree to me holding what you write, including anything about your health, to reply to you and to revise the protocol. You can withdraw that at any time by asking me to delete it.
The purpose is exactly what the document itself promises, and no wider. Your email is read by me. It is not passed to anyone, and it is not used for anything else. Your words will never be quoted, published, or turned into a testimonial. Not anonymised, not "with permission", not ever. A revised edition of the protocol may be written from what report-backs teach us, but it never contains your words.
One exception. Nothing you write is passed on, with one exception: if we believe you or someone else is at serious risk, we may contact the emergency services. That is our legitimate interest in preventing serious harm (Article 6(1)(f)) and, for health data, the vital-interests condition (Article 9(2)(c)). If what you write tells us you are in danger, our reply will point you to the crisis lines named in the document.
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of what was done before. To withdraw consent for a report-back email, reply to it or email us and ask us to delete it; we do, and confirm.
We do not use your data for profiling or automated decision-making.
We share your data only with the service providers we need to deliver the document and run the business. We do not sell, rent or share your data with anyone for their own marketing.
Mane Mentis Ltd is the controller. The processors below act on our instructions under written terms that meet Article 28 UK GDPR.
Kit (Kit, Inc., USA) hosts our website pages, takes the order, delivers the PDF, sends the receipt, the post-purchase emails and our essays, and holds the buyer list. Kit processes your email address, name if given, purchase record and email engagement data. Kit's privacy policy: kit.com/privacy
Stripe (Stripe Payments Europe Ltd / Stripe, Inc.) takes the payment underneath Kit's checkout. Stripe processes your card details, billing information and the transaction record. Card data never touches our systems. Stripe's privacy policy: stripe.com/privacy
Google (Google Workspace, provided to us by Google Cloud EMEA Limited under the Google Workspace Data Processing Addendum) is our email provider. Every email you send us, including a report-back email, is received, stored and replied to in our Google Workspace account. Google holds it as our processor and does not read it or use it for its own purposes. Google's privacy policy: policies.google.com/privacy
Substack (Substack Inc., USA) hosts our free essays and manages the subscriptions of readers who subscribe there. A Substack subscriber's data is only held in Kit if they separately buy a document or sign up through Kit. Substack's privacy policy: substack.com/privacy
Tally (Tally BV, Belgium) provides our contact form. What you type in the form is delivered to our Google Workspace email. Tally's privacy policy: tally.so/help/privacy-policy
We may also disclose personal data where the law requires it, or to the emergency services in the circumstance described in Section 3.
Some of our processors store data in the United States. The UK has not issued a general adequacy decision for the United States, so we rely on the safeguards below:
Your data may therefore be stored in the United Kingdom, the European Union and the United States, depending on which provider is handling it.
After these periods, data is securely deleted. We review retention annually.
All email travels over TLS. Our Google Workspace account has two-factor authentication and is used by one person. Kit, Stripe, Google, Substack and Tally maintain their own industry-standard security; see their policies.
We do not store payment data ourselves. Stripe handles all payment information.
Report-back emails are held only in our Google Workspace mailbox, are read by one person, and are not copied into any other tool, document or service.
If there is a personal data breach, we will notify the ICO within 72 hours where required, and tell you if there is a high risk to you, in line with UK GDPR.
No system is perfectly secure. Please protect your own email account and devices.
Under UK GDPR you have the right to:
We will respond within one month, extendable by up to two months if a request is complex.
Right to complain to the ICO. If you believe we have not handled your data properly, you can complain to the UK's data protection regulator:
See our Refund Policy for the 21-day refund promise and your 14-day statutory cancellation right. Nothing in this notice affects your statutory rights under the Consumer Rights Act 2015.
Our documents are for adults aged 18 or over. We do not knowingly collect data from anyone under 18. By buying, you confirm you are 18 or older.
We may update this notice from time to time. If a change is material, we will email buyers and subscribers or post a notice on the site. The date at the top is the date of the current version.
For any question about this notice, or to exercise your rights:
We respond to data subject requests within one month (Article 12(3) UK GDPR), and aim to answer general questions within 48 hours.
ICO Registration number: ZC026746
Version 3.0 — 4 September 2026