Start here
Legal

Privacy Policy

How we collect, use, and protect your personal information, written plainly, so you actually know what you’re agreeing to.

Last updated 5 October 2026 (mini course emails; the community group is now on Facebook) · Version 2026-09-03 · The version of 10 July 2026

1. Who we are

Inner Evolution Ltd (trading as Expansion Works), a company registered in England and Wales (company number 14851930) with its registered office at 30 Russell Street, Woburn Sands, Milton Keynes, England, MK17 8NX (“we”, “us”, or “our”), is the ‘Data Controller’ for the personal information collected on this website.

Contact: support@expansion-works.com

2. The types of personal data we collect

We currently collect and process the following information:

  • Identity & Contact Data: Name, email address, and phone number (if provided via forms).
  • Special Category Data: Information regarding your mental health, stress levels, or interest in our services, which you may provide to us voluntarily.
  • Technical Data: IP address, browser type, and usage data collected via cookies and similar technologies.
  • Sign-in Data: the type of device (for example, iPhone and Safari) and the country of each sign-in to your account, used to keep your account secure and to make sure it is not shared. We do not store the IP address for this.

3. Lawful basis for processing

Under the UK GDPR, we rely on the following legal bases:

  • Consent: You have given clear consent for us to process your data for a specific purpose (e.g., signing up for a newsletter).
  • Legitimate Interests: Processing is necessary for our legitimate interests in providing and improving our services, provided these do not override your rights.
  • Special Category Data: We process health-related data only with your Explicit Consent or for the provision of health or social care.

4. Where your data is held and how long we keep it

We do not store your personal information on our own computers. It is held securely by specialist providers who process it on our behalf under written data-processing agreements (“processors”). Our core membership database is hosted in the United Kingdom / EU, and we never hold your card details — these are handled entirely by Stripe.

The specialist providers we use, and what each handles:

  • Supabase — accounts, profiles, community and the membership database (name, email, profile, posts, membership status). UK / EU.
  • Stripe — payments, subscriptions and VAT (billing details and card data, held by Stripe, not us). UK/EU and US, with safeguards.
  • Bunny / Cloudflare — video hosting and delivery (video content and viewing requests). EU / global CDN.
  • Resend — service and account emails (name, email), including up to two emails about your progress in the free mini course, each with a link to stop them. US, with safeguards.
  • Flodesk — our marketing and newsletter emails (name, email, and the interest group you joined). US, with safeguards (Standard Contractual Clauses).
  • Cal.com — call and session booking (name, email, booking details).
  • Zoom — live group sessions (name, and your presence during sessions). US / global, with safeguards.
  • Facebook (Meta Platforms Ireland) — our community group, The Changemakers, if you choose to join it (your Facebook profile as group admins see it, your answers to the joining questions, and anything you post in the group). Facebook holds this under its own privacy policy. EU / US, with safeguards.
  • Telegram — messages between sessions for one-to-one clients who choose to use it (your Telegram account and the messages you send). Telegram holds these under its own privacy policy. International, with safeguards.
  • Google / Apple — optional secure sign-in (sign-in identity). US, with safeguards.
  • Meta Platforms Ireland — advertising measurement and targeting via the Meta (Facebook) Pixel, only where you have accepted marketing cookies (pages viewed and actions taken on our site). EU / US, with safeguards.

Where a provider is outside the UK/EU, appropriate safeguards (such as Standard Contractual Clauses or the UK International Data Transfer Addendum) are in place. Exact locations follow each provider’s current data-processing agreement.

How long we keep it: only as long as needed to provide your membership. The community feed and sign-in data are deleted on a rolling 30-day cycle; inactive accounts are closed after around 12 months with notice; if you start signing up but do not finish, we keep your email address for 30 days, then delete it; and you can delete your account and its data at any time (how to delete your account). Limited transaction records are kept where the law requires (for example, tax records held by Stripe).

5. Your data protection rights

Under UK law, you have the right to:

  • Access: Request copies of your personal data.
  • Rectification: Ask us to correct inaccurate information.
  • Erasure: Request that we erase your personal data (the ‘right to be forgotten’).
  • Restriction: Ask us to restrict the processing of your data.
  • Object: Object to the processing of your data in certain circumstances.

6. How to complain

If you have concerns about our use of your personal data, you can contact us at support@expansion-works.com. You can also complain to the ICO if you are unhappy with how we have used your data:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Helpline: 0303 123 1113  |  Website: www.ico.org.uk