Privacy information.

THIS IS ACT ONE is operated by the sole trader identified in Legal business information, who is the data controller. For privacy enquiries, email hello@thisisactone.com.

Last updated: 29-10-2026.

For gifts, we process the recipient’s name, email and optional message, delivery date, claim status and purchaser’s order reference to deliver and support the gift. Gift messages and claim secrets are stored encrypted; claim validation uses a token hash. Use only a recipient address you are entitled to supply. Gift recipients can contact us about their personal information.

What we collect and why

When you buy OFF BOOK or create an account, we process your name and email address, order and payment references, price and currency, payment/refund/dispute status and any contributor referral information. We use this information to administer your purchase, send essential messages, provide access and deal with enquiries. An account email is necessary to connect your purchase to your access.

We store a password hash rather than your readable password, together with time-limited account setup and recovery records. Signed-in features can store viewing progress and the notes you choose to save. These records let us provide your account, resume viewing and display saved notes.

Enquiries contain the information you send us. Please do not email passwords or full payment card details. Technical and security records may include IP addresses, request details and account activity needed to maintain the service, prevent misuse and investigate problems.

Payments and contributor referrals

Stripe handles payment information through its secure checkout. We receive the payment references and status information needed to fulfil purchases, process refunds and keep accounts. Our basket does not collect full card details. Stripe also processes information under its privacy policy.

If a purchase is attributed to a contributor, we use referral and sales information to calculate commission and provide the contributor’s sales records. Contributors do not receive your password or saved notes.

Lawful bases

We use information necessary to fulfil your purchase and operate the account under our contract with you. We keep records required by tax, accounting and other applicable laws to meet legal obligations. We rely on legitimate interests for proportionate security, fraud prevention, service maintenance and responding to general enquiries, considering your rights and reasonable expectations. Optional email marketing relies on your consent.

Email updates

If you subscribe to updates, we use your email address, chosen topics and subscription/consent records to send the updates you request. You can unsubscribe using the link in an update or by emailing us. Withdrawal of consent does not affect earlier lawful processing. Purchase confirmations, release information and essential account messages are separate from optional marketing.

Anonymous site statistics

From 09-10-2026, we count public page views, broad referral sources (such as Instagram or email), basket and checkout actions, broad checkout-error categories and preview-film engagement (including education pages) to understand and improve this website. These counts are combined into daily totals on our own hosting. We do not create visitor IDs, fingerprint devices, record individual browsing histories, store IP addresses or full referral URLs in these statistics, or share them with advertising platforms. We do not use tracking cookies for these counts. Page views include repeat views; they are not a count of unique people. Allowlisted campaign, creative and channel categories in tagged links can also be combined into these daily totals. We discard unrecognised campaign values and do not retain full query strings. Categories apply only to activity on the currently tagged page; we do not save campaign context in browser storage or attach it to your account or order. Confirmed sales remain in our separate, secure commerce records.

No acceptance or dismissal is needed to browse. To object to these statistics, use “Exclude this browser from statistics” in the footer. We save only that exclusion preference in your browser; repeat it on each browser or device you use. We also respect the Do Not Track and Global Privacy Control browser signals. Signed-in owner accounts and private account pages are excluded. We retain aggregate daily totals for up to 13 months. Existing web-host security and access logs are separate from this statistics system.

Cookies and storage on your device

Account session cookies support sign-in and account security. The public basket uses browser session storage for its contents and any contributor code. Some demonstrations save example notes or preferences on your device; these are separate from the account-based saved notes included with OFF BOOK. You can clear browser storage through your browser settings, although this may remove a basket or saved demonstration data.

The account cookie, actone_account, is an essential session cookie used for sign-in and account security. It expires when your browser session ends. Optional GoDaddy Real User Metrics tracking is disabled. We use anonymous, aggregate site statistics as described above. Optional Google Analytics is described below. Google Tag Manager containers and Meta advertising tags are not installed. Stripe’s separate checkout has its own cookie and privacy information.

Who receives information

Stripe processes payments. GoDaddy provides our website hosting and transactional email service. These providers process information needed to perform their services, under their applicable service and data-protection terms. Professional advisers and public authorities may receive information where necessary to meet legal obligations, handle claims or protect legal rights. Contributor access is limited to relevant sales and commission information as described above.

Our hosting account uses a European data centre. Provider support, email delivery and payment processing may involve information being processed outside the UK. GoDaddy’s Data Processing Addendum describes its processor obligations and applicable international-transfer safeguards, including the UK International Data Transfer Agreement where required. Stripe describes its international processing and safeguards in its privacy policy. Contact us for further information about these recipients and safeguards.

Optional Google Analytics

From 22-10-2026, you can choose to allow Google Analytics 4 (G-7T1DHBGH5E) to measure public page views, OFF BOOK views, checkout entry and verified purchases. It is off until you select “Accept analytics” in the analytics banner or “Allow analytics” in Cookie & privacy settings. Rejecting it does not affect purchasing or account access. Change or withdraw your choice using “Analytics preferences” in the footer. We remember the choice for up to six months and respect Do Not Track, Global Privacy Control and the existing statistics exclusion.

If you allow it, Google Analytics uses _ga cookies for up to six months to distinguish browser activity. Google receives browser/device and event information, including the network information needed to receive a request. We send only public page paths without query strings, fixed product details, and, for eligible confirmed purchases, the Stripe transaction identifier, GBP currency and actual amount paid after any discount. We do not send customer names, email addresses, addresses, contributor codes, checkout references, account identifiers or note content. Private account pages are excluded. Advertising storage, Google signals and advertising personalisation are disabled. A purchase can be measured only when you return to the confirmation page with analytics allowed; blocked or interrupted requests may leave gaps.

Google processes this information to provide analytics and may process it outside the UK under its applicable safeguards. Read Google’s Privacy Policy and how Google uses information from partner sites. Withdrawing permission stops further analytics events and clears the Google Analytics cookies this site can access. Our separate anonymous statistics remain subject to the controls described above.

How long we keep information

We keep purchase and entitlement records for as long as needed to honour your permanent-access purchase, meet record-keeping duties and resolve disputes. Account information, viewing progress and saved notes are retained while needed to provide those features, unless you request deletion and no legal reason requires continued retention. Account deletion may prevent us from providing account-based access; we will explain the consequences before acting on a request.

Support records are kept as long as needed to resolve the enquiry and any related claim. Security records are kept only while needed to investigate incidents and protect the service. Marketing records are retained while you subscribe; after unsubscribing, we may retain the minimum suppression and consent evidence needed to respect your choice and demonstrate compliance. Recovery links expire and cannot be used indefinitely. Records no longer needed are deleted or anonymised, subject to necessary backup retention and legal obligations.

Your rights

Depending on the circumstances, you can ask to access, correct or delete your personal information, restrict processing or receive a portable copy. You can object to processing based on legitimate interests and withdraw consent for marketing at any time. Some requests are subject to legal exceptions. We may ask for proportionate information to verify your identity, and normally respond within one month; if a lawful extension is needed, we will tell you.

Email hello@thisisactone.com to exercise your rights or raise a concern. You may also complain to the Information Commissioner’s Office. You do not have to contact us first.

Updates to this notice

We update this notice when the service or our handling of information changes. Material changes will be explained where required. The date above shows the latest revision.