Privacy Policy

This Privacy Policy explains how we use your data. We are The Unspoken ("we", "us", "our"). This policy covers theunspoken.io and related services (the "Service"). We help you think about your relationships. You can use it on your own, as a couple, or as a facilitator. AI helps us write reports. These include results for whole groups.

1. Who we are

The Unspoken is the data controller for account holders' personal data. This covers all account types. It includes individuals, couples, facilitators and administrators. For anonymous session answers, the facilitator is the data controller. The Unspoken is the data processor for those answers. The Unspoken is a data controller registered with the UK Information Commissioner's Office (ICO). Our registration number is ZC188145. Contact: privacy@theunspoken.io

2. Information we collect

• Account data: your name, email, role and plan. We also collect your organisation, if relevant. Our payment provider processes billing metadata. This means details about your payments.
• Relationship profile data: your relationship status, gender and answers. This applies if you have an individual or couple account.
• Survey session metadata: codes, group type, dates and times. It also includes the settings your facilitator chooses.
• Respondent submissions: answers, relationship status and gender. In facilitator-led sessions, these are anonymous. We do not collect names or emails from these respondents. We do not collect identifiers from them either.
• Action plan interactions: tasks you finish and thoughts you record. We also collect feedback on your plan.
• Technical data: your device, browser, IP address and usage logs. We need these to run the Service and keep it safe.

3. How we use information

• To run the Service. We create reports, KPIs, action plans and training tips. KPIs are measures of progress.
• To manage your plan, payments and account messages.
• To keep the site safe, stop abuse and meet legal obligations.
• To improve the Service. For this, we only use aggregated or anonymised data. This means group totals or data that cannot identify you.

4. Legal bases (UK/EU GDPR)

We use these legal bases to process personal data. Contract: to provide the Service. Legitimate interests: to keep it safe and improve it. Consent: for optional messages and partners sharing joint reflections. Legal obligation: for data we must process by law.

5. Sharing

We only share personal data with trusted providers. We need them to run the Service. They host the site, store data and send email. They also handle payments and AI reports. These processors must protect your data under their contracts. We never sell personal data.

6. Anonymity of facilitator survey responses

Answers in a facilitator's anonymous survey have no details that identify you. Facilitators only see aggregated results. This means results for the whole group. They cannot link an answer to a person.

7. Couple accounts

In a couple account, we may combine your answers with your partner's. You agree to this. We use them for shared reports, KPIs and action plans. Both partners can see these. Your individual-only insights stay private to you.

8. Retention

We keep accounts and reports while the subscription is active. If it lapses or is cancelled, we delete the linked records and reports. This happens seven (7) days after the effective expiry date. We email you before we delete them. You can ask us to delete them sooner at any time.

9. Your rights

Your data rights depend on where you live. You may have rights to access, rectify or erase your personal data. You may also have rights to restrict, port, or object to processing. In plain English, you can ask to see, correct or delete your data. You can also ask to limit its use or move it. Email privacy@theunspoken.io to use these rights. You can also complain to your local supervisory authority. In the UK, this is the ICO.

10. Security

We use industry-standard safeguards. Encryption in transit locks data as it travels. Role-based access controls limit who can use it. Row-level security protects stored data. No system is perfectly secure. Report concerns to security@theunspoken.io.

11. International transfers

We may process data in other countries. Where required, we use Standard Contractual Clauses or equivalent safeguards.

12. Changes

We may change this policy. We will tell you about material changes. We do this by email or through the Service.

13. Contact

Questions? Email privacy@theunspoken.io.

Survey Response Privacy

Your answers are encrypted in your browser before you send them. This locks them so others cannot read them. We also use AES-256 encryption to store them. Answers are stored with a random participant ID, not your account. Normal database access cannot link an answer to you. Our team cannot read your own answers or individual and couple report text. This includes system administrators. Policy and database controls limit admin screens to counts, status and settings. Each access to private data goes in an immutable audit log. This is a log that cannot be changed. Facilitators only see results for the whole group. They cannot see who gave an answer. To use your data rights, go to Account, then Privacy and data. You can see when your data will be deleted. You can also download a copy or delete it now. Deletion is immediate and irreversible. It happens at once and cannot be undone. Email privacy@theunspoken.io to close your account or request rectification. You can also object to or restrict processing. We will reply within one month.

Third Party AI Processing

The Unspoken uses Lovable AI. It sends requests to Google Gemini models. AI uses your answers to write your report, growth priorities, action plan and course. We send answers in anonymised form. We leave out names, emails and account IDs. We also leave out other details that could identify you. The AI provider's policies say it does not use this data to train AI models. They say it does not keep the data once a request is complete. Read its privacy promises at lovable.dev/privacy. We review our data processing arrangements each year. To avoid AI use of your answers, do not take a survey. Email privacy@theunspoken.io to ask us to close your account and delete your data.

Platform Hosting Disclosure

The Unspoken is built and hosted on Lovable. Hosting means keeping the site online. Read Lovable's terms at lovable.dev/terms. Read its privacy policy at lovable.dev/privacy. These explain what data Lovable may use to run this site. We have checked these terms against our privacy promises. Email privacy@theunspoken.io to ask about hosting and your data.