Legal

Privacy Policy

Last updated: March 2026

This Privacy Policy explains how Who Told You That?, operated by House of V Heritage Holdings Ltd ("we", "us", "our"), collects, uses, and protects personal information when you use our website, tools, and services.

We are committed to handling your personal data with care, transparency, and respect. This policy applies to all visitors, readers, accountability partners, and programme participants.

1. Who we are

House of V Heritage Holdings Ltd is registered in England and Wales (Company No. 17030397), with a registered address at London EC2A 4NE. Who Told You That? is a House of V imprint.

For data protection purposes, House of V Heritage Holdings Ltd is the data controller for personal information collected through this website and its associated tools.

2. Information we collect

We may collect the following types of personal information:

• Account information: name and email address when you register or sign up
• Assessment data: your responses to the Freedom Assessment quiz and the belief patterns and domains it identifies
• Progress data: scores and reflections you enter into the Progress Tracker
• Partner application data: information you provide when applying to become an Accountability Partner (when this programme launches), which may include personal and background disclosures
• Payment information: processed securely via Stripe — we do not store card details
• Communications: emails you send us and messages submitted through forms
• Usage data: standard technical data such as browser type, pages visited, and time on site, collected via analytics tools

3. How we use your information

We use your personal information to:

• Provide and personalise our tools, programmes, and community spaces
• Process your Accountability Partner application and manage your accreditation (when this programme launches)
• Send you emails relevant to your programme, assessment results, or account
• Match you with an accountability partner where you have requested this
• Process payments and send receipts
• Improve our website and services
• Comply with legal obligations

We will only send you marketing emails if you have opted in to receive them. You can unsubscribe at any time using the link in any email.

4. Legal basis for processing

We process your personal data on the following legal bases under UK GDPR:

• Contract: to provide the services you have signed up for
• Legitimate interests: to improve our services and communicate with you about your account
• Consent: for marketing communications, where you have opted in
• Legal obligation: where required by law

5. Sharing your information

We do not sell your personal data. We may share it with:

• Supabase: our database and authentication provider, for account and data storage
• Stripe: for payment processing
• ConvertKit: for email communications
• Netlify: for website hosting
• Accountability Partners: when this programme launches, we will share only the information necessary for your matched partner to support you — specifically your first name and belief pattern. No contact details will be shared without your explicit consent.

All third-party providers are required to handle your data in accordance with applicable data protection laws.

6. Data retention

We retain your personal data for as long as your account is active or as needed to provide our services. Assessment results and progress data are retained for the duration of your programme participation plus 12 months. Partner application data is retained for 3 years. You may request deletion at any time (see Your Rights below).

7. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict certain processing
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, please contact us at the address below. We will respond within 30 days.

8. Age requirement

This website, its tools, games, and reflection programmes are intended for people aged 16 and over. By creating an account or using the platform, you confirm that you meet this age requirement.

If you are under 16, please do not create an account or submit personal information. If we become aware that a user is under 16, we will remove their account and any associated data promptly.

9. Nature of the tools — important notice

The games, reflection exercises, assessments, and other tools on this platform are designed as general self-exploration aids. They are powered in part by AI-assisted content and are intended to support personal reflection, not to direct it.

They are not a substitute for professional advice. Nothing on this platform should be taken as medical, psychological, therapeutic, legal, or financial guidance. If something surfaces during your use of these tools that feels significant, distressing, or beyond what self-guided reflection can hold, we encourage you to reach out to a qualified professional.

You know yourself best. Use these tools with your own judgement, at your own pace, and within your own limits. If something does not feel right for you, you are always free to stop.

The Acka'a-Hitchman Foundation and House of V Heritage Holdings Ltd accept no liability for decisions made based on the output of these tools, or for any distress arising from their use.

10. Cookies

Our website uses essential cookies to ensure the site functions correctly, including session management and security. We do not currently use advertising or tracking cookies. If this changes, we will update this policy and ask for your consent where required.

11. Security and data breaches

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. All data transmission is encrypted via HTTPS. Passwords are hashed and never stored in plain text.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, as required by UK GDPR. Where the breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes by email. The date at the top of this page will always reflect the most recent update.