Unwritten Social Rules
Privacy Policy — Mane Mentis Ltd
Last updated: 26 July 2026
Contact: Contact us here
Address: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Company Number: 16732668
ICO Registration: ZC026746
In brief: We collect your name and email to deliver your product and optional newsletter. If you take part in 1:1 coaching calls, we may also process limited health-related information you choose to share, only with your explicit consent. We don't use analytics or ads, and we never sell your data.
1. Who We Are
We are Mane Mentis Ltd, a UK-registered company that creates and sells self-authored educational content and 1:1 coaching, delivered as text documents and live video calls.
We provide educational content and coaching based on personal experience and research. It is not therapy, medical advice, or a substitute for professional care. Results, if any, are not guaranteed and will vary based on individual implementation and circumstances. We operate globally and process fewer than 250 customer records.
Data Protection Officer: We have not appointed a Data Protection Officer as we are not required to do so under Article 37 UK GDPR. We are not a public authority and do not conduct large-scale systematic monitoring. We may process special category data (see Section 2) disclosed voluntarily during coaching calls, but not on a large scale — this is assessed against our small beta client volume and will be reviewed as the programme grows. For data protection queries, contact us here.
We are the data controller for personal data we collect directly (such as names, emails, support messages, and coaching call content).
We are registered with the Information Commissioner's Office (ICO) as a data controller.
Accountability: We are responsible for demonstrating compliance with the UK GDPR principles under Article 5(2). We maintain records of our processing activities to evidence accountability.
2. What Data We Collect
We collect data directly from you when you sign up to our waitlist, apply for the programme, make a purchase, attend a coaching call, or contact us for support. We collect only the minimum information needed to deliver your purchase and communicate with you (if you opt in).
We collect:
- Your first name and email address when you sign up to our waitlist or newsletter via Kit or Substack
- Application answers you submit as part of the beta selection process
- Account and contract details (name, email, contract terms) once you become a client
- Purchase/payment confirmation (amount paid, date) via Stripe
- Coaching call recordings, where you have given consent (see T&Cs Section 9b), stored in Google Drive
- Session notes taken during or after coaching calls
- Where you have separately consented (see T&Cs Section 9b), de-identified patterns and themes drawn from call recordings via an AI note-taking tool, used to improve the programme and inform future products — names and personal details are not retained in this output
- IP address and device information collected automatically by Google Workspace and Kit for security and platform functionality
- Support messages you send us by email
Where you choose to share health-related information during coaching calls (for example, information about ADHD, autism, or related conditions) — this is special category data under Article 9 UK GDPR. We only process this with your separate, explicit consent, which you may give or withhold without affecting your place on the programme, and only for the purpose of delivering your coaching sessions. See Section 3 for the legal basis.
We do not collect:
- Billing or postal addresses (beyond what Stripe requires to process payment)
- Phone numbers (unless you voluntarily provide one in support messages)
- Data from minors under 18
Cookies and tracking: We use only essential functional cookies required for Kit (email) and Google Workspace (course delivery, scheduling) to work. We do not use analytics, advertising, or tracking cookies. For details on cookies used by these platforms, see Kit's Privacy Policy and Google's Privacy Policy. We do not set any cookies ourselves.
Why we need this data: Provision of your name, email address, and payment details is a contractual requirement under Article 6(1)(b) UK GDPR. If you do not provide this information, we cannot fulfil our contract, process your order, deliver your course access, or respond to support queries. You are not under any statutory obligation to provide this data, but without it we cannot complete your transaction or provide you access to the programme.
We apply the principle of data minimisation under Article 5(1)(c) UK GDPR by collecting only what is necessary for each purpose.
3. How We Use Your Data
We use your data to:
- Process your application and manage beta selection under the lawful basis of taking steps prior to entering a contract (Article 6(1)(b) UK GDPR)
- Process purchases and deliver programme access under the lawful basis of performance of contract (Article 6(1)(b) UK GDPR)
- Send order confirmations, receipts, and access instructions under performance of contract
- Deliver coaching calls under the lawful basis of performance of contract (Article 6(1)(b) UK GDPR)
- Record coaching calls, where you have consented, under the lawful basis of consent (Article 6(1)(a) UK GDPR)
- Process any special category data (health-related information) you share during coaching calls, under the lawful basis of explicit consent (Article 9(2)(a) UK GDPR), obtained separately from and in addition to our Article 6 basis for general processing
- Identify de-identified patterns and pain points across clients from call recordings, to improve the programme and inform future products, under the lawful basis of explicit consent (Article 6(1)(a) UK GDPR), obtained as a separate, declinable consent from call recording — see T&Cs Section 9b
- Respond to support queries under performance of contract
- Send newsletters and product updates under the lawful basis of consent (Article 6(1)(a) UK GDPR) — if you opt in only
- Maintain tax and accounting records for 7 years under legal obligation (Article 6(1)(c) UK GDPR) to comply with HMRC requirements
Where we rely on consent (including explicit consent for special category data), you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Withdrawing consent to call recording does not end your coaching programme — see T&Cs Section 9b.
4. Who We Share Your Data With
We share your data only with essential service providers needed to deliver our services. We do not sell, rent, or share your data with third parties for their own marketing purposes.
We have Data Processing Agreements or rely on standard terms with each processor below, setting out their obligations under UK GDPR Article 28.
Categories of recipients: we share data with our email/CRM platform (waitlist and marketing communications), our video/document platform (applications received by email, coaching calls and course content), our payment processor (completing transactions), and our newsletter platform (for those who separately subscribe to the free essay list).
Mane Mentis Ltd is the data controller. The processors listed below act on our instructions to provide services.
Kit handles our waitlist and marketing email communications. Kit collects and processes: your email address, name, and email engagement data (opens/clicks, for deliverability purposes only — not used for profiling). Kit's privacy policy: kit.com/privacy
Google Workspace (Gmail) receives your application by email when you apply for the programme. Your application answers are processed as part of our Google Workspace account.
Google Workspace (Drive and Meet) hosts course content and delivers/records coaching calls. Google processes: your account access to shared course materials, call video/audio during sessions, recordings where consented to, and associated metadata (timestamps, device/IP information for security). Google's privacy policy: policies.google.com/privacy
Stripe processes payment for the programme directly (£700, one payment or two instalments). Stripe collects payment card details, billing information, and transaction records. Payment card data never touches our systems directly. Stripe's privacy policy: stripe.com/privacy
Substack hosts our free public essays and manages email subscriptions for readers who choose to subscribe there. This is separate from the Kit-managed beta waitlist — a Substack subscriber's data is only added to the beta waitlist if they separately choose to sign up via Kit. Substack's privacy policy: substack.com/privacy
5. International Data Transfers
When we transfer personal data outside the UK, we use approved safeguards such as UK Standard Contractual Clauses or the UK Extension to the EU–US Data Privacy Framework.
Some of our processors operate in the United States. The UK has not issued an adequacy decision for the United States, so we rely on appropriate safeguards for these transfers:
- Kit (US): UK Extension to the EU–US Data Privacy Framework
- Google Workspace (US): UK Extension to the EU–US Data Privacy Framework
- Stripe (US): UK Extension to the EU–US Data Privacy Framework
- Substack (US): UK Extension to the EU–US Data Privacy Framework
Standard Contractual Clauses (SCCs) are pre-approved contract terms that ensure data transferred outside the UK receives adequate protection. For US providers that participate in the UK Extension to the EU–US Data Privacy Framework, data transfers rely on that adequacy decision.
Your data may be stored and processed in the United Kingdom and the United States, depending on which service provider is handling it.
6. How Long We Keep Your Data
We keep purchase records for 7 years from the date of purchase to comply with UK tax law (HMRC requirement is 6 years).
We record coaching calls only with your consent (see T&Cs Section 9b). To limit how long sensitive material is held, the raw video/audio recording is deleted 30 days after each call — enough time to confirm the recording and any transcription are accurate, and a copy is sent to you before deletion. We then retain condensed session notes (a written summary of what was discussed and any agreed actions, generated from the recording) for the duration of the coaching programme plus 12 months, for continuity of your coaching and as a record in case of a dispute. You may request earlier deletion of either the recording or the notes at any time.
Where you have separately consented to pattern-analysis use (T&Cs Section 9b), the themes and observations drawn from your calls are pseudonymised, not anonymised: at our current scale, they remain personal data because they could reasonably be re-identified. We retain them and will review that retention at 24 months. Because they are personal data, all of your rights in Section 8 apply to them, including access, correction and deletion. The underlying recording used to generate them follows the same 30-day deletion as above regardless.
We keep application data for unsuccessful applicants for 6 months from the date of application. We chose this period because it is the closest published benchmark available (ICO guidance on recruitment record-keeping) and reflects the realistic window in which we might revisit an application for a future round, or in which a question about the selection process might arise. After 6 months this data is deleted unless you have separately subscribed to our newsletter or waitlist.
We keep client account and course access data for as long as your programme access remains active, and for a reasonable period afterward for support purposes.
We keep newsletter/waitlist data (Kit and Substack) until you unsubscribe, based on your consent.
We keep support emails for 3 years from the last contact to provide ongoing support.
After these retention periods, data is securely deleted.
Retention periods are determined by legal requirements (such as HMRC rules), operational needs (such as ongoing coaching and support), and your consent preferences. We review retention annually to ensure data is not kept longer than necessary.
7. How We Keep Your Data Safe
We use TLS encryption on all email transmission and password-protected access to internal systems.
Google Workspace's security measures include encryption in transit and at rest, role-based access controls, and two-factor authentication on our account. Kit and Stripe maintain their own industry-standard security measures — see their respective privacy policies for details.
We do not store any payment data ourselves. Stripe handles all payment information securely.
Coaching call recordings are stored in Google Drive with access restricted to the founder, and to the processors listed in Section 4 solely as needed to provide their service, and are not shared with any third party without your consent.
If there is a data breach, we will notify the ICO within 72 hours and affected users if there is high risk, in accordance with UK GDPR requirements.
No system is 100% secure. Please use secure networks when accessing our services and protect your account passwords. You are responsible for protecting against unauthorised access to your own accounts and devices.
8. Your Privacy Rights
Under UK GDPR, you have the right to:
- Access your data
- Correct inaccuracies
- Delete your data (subject to tax retention requirements)
- Restrict or object to processing
- Port your data (we can provide it in PDF or CSV format)
- Withdraw consent (for example, to unsubscribe from newsletters, or to withdraw consent to future call recording)
- Not be subject to automated decisions (we don't use any automated decision-making)
We do not use your data for profiling or automated decision-making that produces legal or similarly significant effects, including for marketing purposes.
We will respond to requests within one month, extendable by up to two months if necessary due to the complexity or number of requests.
Right to complain to the ICO:
If you believe we have not handled your data properly, you have the right to lodge a complaint with the UK's data protection regulator:
- Online: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
9. Refunds & UK Consumer Rights
See our Refund Policy for details — including the 21-day refund promise and your 14-day statutory cancellation right.
All customers retain their statutory rights under the Consumer Rights Act 2015. Digital content must be of satisfactory quality, fit for purpose, and as described. Your statutory rights are not affected by our refund policies.
10. Age Restriction
Our services are for adults 18+ only.
We do not knowingly collect data from minors.
By using our site, you confirm you are 18 or older.
11. Updates to This Notice
We may update this notice from time to time. If there are material changes, we'll email you or post a banner. Please check back regularly.
12. Contact Us
For any questions about this privacy notice or to exercise your data protection rights, contact us:
- Contact us here
- Post: Mane Mentis Ltd, 71–75 Shelton Street, London WC2H 9JQ
We will respond to data subject requests within one month as required under Article 12(3) UK GDPR, and aim to respond to general queries within 48 hours.
You can contact us about any privacy-related matter using the details above.
ICO Registration number: ZC026746
Version 2.0
