Privacy Policy

The data controller responsible for your personal information is Cross Family Innovations Ltd (company number 17505998), Upstairs At The Shippon Top Farm Barns, High Street, Farndon, Cheshire, United Kingdom, CH3 6PT. Email: hello@crossfamilyinnovations.co.uk.

We collect only the information needed to provide the Reset and run our service:

• Account details: your email address and login identifiers.
• Order details: transaction date, amount (£24.99), payment provider reference and a record of your consent and cancellation acknowledgement. We do not store or process card numbers.
• Your Reset responses: your first name, Discover Me answers (such as past interests, things you’d love to do and favourite music), daily choices, notes, reflections and any photos you choose to save in Moments.
• Enquiries: your name, email address and message when you contact us.
• Technical data: standard server logs (such as IP address and browser type) recorded automatically during secure connections.

• Delivering your Reset: we use your Discover Me answers, daily choices and reflections to tailor your upcoming days. For example, if you tell us you used to love painting, our system selects relevant, pre-written suggestions that match what you told us.
• No external AI processing: personalisation runs entirely within our own application using fixed matching rules. We do not send your responses, reflections or photos to any artificial intelligence service, and we do not use your data to train machine-learning models.
• Customer support: to help you when you contact us.
• Legal and financial obligations: to keep transaction records required for accounting and tax purposes.

We do not ask for health, medical, biometric, racial, ethnic, religious, philosophical, political, sexual orientation or other special-category information, and you never need to share it to use the Reset. However, because the Reset includes open-ended spaces for your own words, you may choose to include sensitive details in your private reflections or notes.

If you do, that information is processed by us when it is stored in your account and shown back to you. We process it only to keep it in your private Reset and display it to you. We do not use it for profiling, marketing or automated decision-making, and we do not share it with anyone else except our hosting provider, which stores it on our behalf. Please only include sensitive details if you are comfortable doing so; you can ask us to delete them at any time.

• Contract: processing your account, responses and order to deliver the Reset you purchased.
• Legal obligation: keeping transaction records for HMRC accounting compliance.
• Legitimate interests: keeping our service secure, fixing technical faults and handling enquiries.
• Consent: for optional marketing emails, only if you choose to opt in. You can withdraw consent at any time.

We do not use advertising cookies, analytics or tracking tools. When you sign in, your browser stores a session token so you stay logged in; this is strictly necessary for the service to work.

• Your reflections, responses and Moments are kept separate for each account and protected by database-level security rules, so only you can access them when signed in.
• Moment photos are stored in a private, encrypted storage area accessible only through your signed-in account.
• Authorised personnel may access your data only where strictly necessary to diagnose a technical fault, resolve a support enquiry or meet a legal obligation.

We do not sell, rent or trade your personal information. We use trusted providers who process data only on our instructions:

• Hosting, database and storage: Lovable Cloud, built on Supabase, with data stored in the European Union (Ireland), encrypted in transit and at rest.
• Payments: Stripe Payments Europe Ltd. Where data is transferred within Stripe’s group outside the UK or EEA, it is protected by recognised safeguards such as standard contractual clauses and the UK International Data Transfer Addendum.
• Email delivery: Resend, used to send service emails and, if you have opted in, marketing emails. Resend may process data in the United States under appropriate transfer safeguards.
• Fonts: Google Fonts. When a page loads, your browser requests font files from Google, which receives your IP address to deliver them. Google may process this outside the UK.

Where personal data is transferred outside the UK, we rely on UK adequacy regulations or appropriate safeguards required by UK data protection law.

• Ongoing access: we keep your account, reflections, Moments and completed Blueprint accessible for as long as Naturally Vibrant operates, so you can return to them whenever you wish. We do not delete or archive your paid content because of inactivity.
• Financial records: basic transaction records are kept for up to 7 years to meet UK accounting and HMRC requirements, even if you ask us to delete your account.
• Enquiries: support messages are kept for up to 12 months after your enquiry is resolved, then securely deleted.
• Service closure: if Naturally Vibrant ever closes permanently, we aim to provide at least 60 days’ advance notice wherever reasonably possible. Your data protection rights continue to apply, and we will securely delete personal content we no longer need, other than records we are legally required to keep.

Under UK data protection law, you have the right to:

• access the personal information we hold about you;
• ask us to correct inaccurate information;
• ask us to erase your personal data (subject to records we must legally keep);
• object to or restrict certain processing;
• receive your data in a portable format;
• withdraw any consent you have given.

To exercise any of these rights, email hello@crossfamilyinnovations.co.uk. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.