Digital Derek Privacy Policy

Depending on how you use Digital Derek, we may collect and process:

• your name and email address
• account and authentication information
• membership and subscription information
• payment and transaction information
• information you enter during a Digital Derek check-in
• generated reflections and journal history
• relevant previous reflection history used to provide continuity
• voice transcripts where you use voice input
• member-email preferences
• communications with Digital Derek support
• technical, security and usage information required to operate and protect the service
• consent records

What you choose to tell Digital Derek may sometimes include personal information about your health, wellbeing, relationships, family, finances, religious or spiritual beliefs, sexuality or other sensitive areas of your life.

You should only share information that you are comfortable using within the service.

Some information that members choose to share may be classed as special-category personal data under UK data-protection law. This can include information about health, religious or philosophical beliefs, sexual orientation and certain other sensitive matters.

Digital Derek does not require you to disclose every type of sensitive information, but the nature of a personal reflection service means you may choose to provide it.

Before using Digital Derek reflections for the first time, you will be asked to give explicit consent for Digital Derek to process any special-category information you choose to provide for the purpose of creating and maintaining your reflections.

You can withdraw that consent by contacting: support@askdigitalderek.com

If you withdraw consent, we will stop processing special-category information on that basis. Because sensitive information may be contained within reflection and journal content, withdrawal may require us to stop using and, where appropriate, delete affected reflection content unless there is a lawful reason for retaining particular information.

Withdrawing consent does not affect processing that was lawful before consent was withdrawn.

We use personal information to:

• create and manage your Digital Derek account
• provide your membership
• generate personalised reflections
• maintain your private journal and reflection history
• provide relevant continuity between reflections
• process membership payments
• administer your monthly reflection allowance
• provide account and customer support
• send essential account and security communications
• send optional Digital Derek member emails where enabled
• protect the security and integrity of the service
• prevent and investigate misuse
• troubleshoot technical problems
• monitor and improve the quality and reliability of Digital Derek
• carry out appropriate quality and safety review
• maintain accounting and transaction records
• comply with applicable legal and regulatory obligations

Under UK data-protection law, we rely on different lawful bases depending on why information is being processed.

Contract

We process information where it is necessary to provide the Digital Derek service you have requested, including creating and operating your account, generating reflections, maintaining your journal, administering membership and providing support.

Legal obligation

We process information where necessary to comply with legal obligations, including accounting, taxation and other regulatory requirements.

Legitimate interests

We may process information where necessary for our legitimate interests in operating, securing, supporting and improving Digital Derek, provided those interests are not overridden by your rights and interests.

This may include security monitoring, fraud and misuse prevention, technical troubleshooting, service administration, quality assurance and optional non-promotional member communications relating to use of Digital Derek.

Consent

Where consent is required, including explicit consent for processing special-category information and consent for any optional marketing or non-essential tracking technologies, you may withdraw that consent at any time.

Where special-category personal information is processed, we rely on explicit consent as the relevant special-category condition.

Digital Derek uses artificial intelligence supplied through the OpenAI API to help create reflections and provide voice transcription.

When a reflection is generated, information sent for processing may include:

• your current check-in
• information you have typed or dictated
• relevant previous reflection context
• relevant material selected from Derek’s approved knowledge base

We send only the information needed to provide the relevant functionality.

West Pro Media Services Ltd has not enabled voluntary OpenAI API data sharing for model training.

OpenAI states that data submitted through its API is not used to train or improve OpenAI models by default unless the API customer expressly opts in.

If you use Digital Derek’s voice-input feature, your audio is processed to create an editable text transcript.

Digital Derek does not retain the audio recording after transcription.

The resulting text may then form part of your check-in, reflection and journal history in the same way as text you type yourself.

Completed Digital Derek reflections are stored so they can appear in your private journal and, where relevant, help provide continuity between future reflections.

Your journal is not publicly visible.

You can remove reflections from your member history.

When reflection content is deleted, the content itself should also be removed from administrative audit records rather than retained indefinitely simply because it previously formed part of an audit trail.

Minimal operational or security metadata recording that an action or deletion occurred may be retained where necessary.

Your reflections are intended for your personal use and are not public.

Access to member interactions is restricted to authorised Digital Derek administrators where access is reasonably necessary for:

• support
• technical troubleshooting
• security
• safety
• quality assurance
• ongoing development of Digital Derek

Derek McGillivray has authorised administrator access.

As part of ongoing quality assurance and development, Derek may review selected reflections on a random or ad-hoc basis to check that Digital Derek continues to reflect his knowledge, approach and intended style accurately.

Derek does not personally write or approve every reflection before it is delivered.

Administrative access is limited to authorised people involved in operating and improving Digital Derek.

Digital Derek membership payments are processed by West Pro Media Services Ltd using Stripe.

Digital Derek does not store your full payment-card details itself.

Stripe processes payment information required to complete and administer transactions.

Where required, transaction and accounting records are retained separately from reflection content.

We use trusted third-party providers to operate different parts of Digital Derek.

Depending on the features enabled, these may include:

• OpenAI for artificial-intelligence and voice-transcription services
• Stripe for payment processing
• Lovable / Lovable Cloud for application, hosting, database and platform infrastructure
• Lovable-managed email services for account and Digital Derek member emails
• Google Analytics for website analytics where the visitor has given any consent required for non-essential analytics
• n8n for approved workflow automation where enabled
• GetResponse for separately authorised email or marketing communications where enabled
• Leadchest where the Leadchest website/video functionality is enabled

We only use these services for purposes relevant to operating, administering, supporting or developing Digital Derek.

We do not sell member personal information to advertisers.

If a new provider begins processing personal information in a materially different way, we will update this Privacy Policy where appropriate.

Some technology providers used by Digital Derek may process personal information outside the United Kingdom.

Where UK data-protection law requires safeguards for an international transfer, we will use an appropriate lawful transfer mechanism and require suitable protections for the information concerned.

We do not keep personal information for longer than reasonably necessary for the purpose for which it is held.

Our current retention periods are:

Active member account and profile

Retained while the account remains active.

Reflections and journal content following cancellation

Normally retained for up to 90 days after membership access ends, allowing a reasonable period for account reactivation or support, and then deleted unless the member has already requested earlier deletion or there is a lawful reason to retain specific information.

Cancelled account and profile information

Normally retained for up to 12 months after membership access ends, unless deletion is requested earlier or retention is required for a lawful reason.

Security and administrative audit records

Normally retained for up to 12 months. Deleted reflection content itself will not be retained merely because it previously appeared within an audit record.

Support correspondence

Normally retained for up to 24 months after the support matter is closed.

Financial and accounting records

Retained for the period required under applicable accounting and tax law, normally six years from the end of the relevant company financial year where those requirements apply.

Where a valid deletion request is made, we will delete personal information that we no longer have a lawful reason to retain.

Cancelling a Digital Derek membership and asking us to delete personal information are separate actions.

Cancelling stops the ongoing membership in accordance with the Terms of Service, but does not automatically require all information to be deleted immediately.

You may request deletion of your account and personal information by contacting: support@askdigitalderek.com

Following a valid deletion request, we will delete your member profile, reflection and journal content and other personal information that we no longer need to retain.

We may retain limited information where required by law or where reasonably necessary for matters such as accounting, fraud prevention, security or establishing, exercising or defending legal claims.

Digital Derek may send occasional member emails relating to your use of the service, such as reminders, reflections or useful membership updates.

These can be switched off from your Digital Derek Account page or by using the unsubscribe link in a member email.

Turning off Digital Derek member emails does not stop essential account messages such as password, sign-in, security or other necessary service communications.

Any separate promotional or marketing communications requiring consent will be managed separately.

Digital Derek uses technologies necessary to provide functions such as authentication, security and operation of the website and member service.

Where non-essential technologies are used, such as optional website analytics or third-party tracking, they will only be activated where the required consent has been obtained.

This may include Google Analytics or third-party website functionality such as Leadchest where those services use non-essential storage or tracking technologies.

Visitors must be given the ability to accept or reject optional technologies without preventing access to the basic public website.

We use technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

No internet-based service can guarantee absolute security, but access to Digital Derek member and administrative information is restricted according to authorised roles and operational need.

If you believe your Digital Derek account or personal information may have been compromised, contact: support@askdigitalderek.com

Depending on the circumstances, UK data-protection law may give you rights to:

• request access to personal information we hold about you
• ask us to correct inaccurate information
• ask us to delete information
• ask us to restrict certain processing
• object to certain processing
• request transfer of information where the right to data portability applies
• withdraw consent where processing relies on consent

To exercise a data-protection right, contact: support@askdigitalderek.com

We may need to confirm your identity before completing a request.

Digital Derek uses automated technology to generate reflections, but it does not make solely automated decisions about members that produce legal or similarly significant effects.

Digital Derek reflections are intended to provide perspective and reflection. Decisions remain with the member.

Digital Derek is currently intended for people aged 18 or over.

We do not knowingly offer Digital Derek memberships to children.

If you have concerns about how your personal information is being handled, please contact us first at: support@askdigitalderek.com

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data-protection regulator.

Information Commissioner’s Office

We may update this Privacy Policy when Digital Derek, our technology, our service providers or legal requirements change.

Where a change materially affects how existing members’ personal information is used, we will provide appropriate notice.

The current version will always be available on this page.