Privacy policy.

What we collect, and why

1. If you use the contact form

We collect your name, email address, phone number (if you provide one), and your message, along with the submission time, your IP address, and browser user-agent.

We use this to respond to your enquiry, that's the only purpose. Our legal basis is legitimate interest (following up on a request you initiated) and, where a booking follows, taking steps to enter into a contract with you. Submissions are stored in Cloudflare KV, a database service provided by our hosting provider, Cloudflare. We don't currently run an automatic deletion schedule for this data; we keep it for as long as it's relevant to the enquiry or booking and delete it on request (see "Your rights" below).

While you're filling in the form, your entries are also saved temporarily in your browser's session storage, not a cookie, so a reload or an accidental tab switch doesn't lose what you've typed. This never leaves your device, and is cleared automatically once you submit successfully or close the tab.

2. If you book a session or join membership

Booking, and joining membership, both happen directly on this site. For a session, you pick a date and time, then enter your name, email, phone number, and (for group sessions) the number of people attending; for membership, your name and email. That information is sent to our booking system to create your reservation or membership record, and you're then taken to Stripe to pay by card (a one-off charge for a session, a recurring subscription for membership). We don't see or store your card details ourselves, Stripe handles payment directly. We use specialist service providers to operate bookings and payments, but The Recovery Club remains your point of contact for questions about the personal information used for your booking or membership. Stripe's own policy explains how it handles payment information: Stripe's privacy policy.

While you're filling in either form, your entries are also saved temporarily in your browser's session storage, the same as the contact form above. Cleared automatically once you're taken to payment or you close the tab.

After booking, we temporarily keep your booking reference, session summary and payment confirmation reference in this tab's session storage so refreshing the confirmation page still works. Names and email addresses are not included. This context expires after one hour and disappears when the tab is closed. Booking-management links ask for your email separately; older links remain supported while their details are removed from the address bar when the page loads.

3. Spam protection

The contact form is protected by Cloudflare Turnstile, a challenge that verifies submissions come from a real person rather than automated spam. Turnstile processes technical signals about your device and browser to make that determination. It does not use tracking cookies and isn't used for advertising.

4. Site analytics

If you accept the cookie banner, we use PostHog to understand how visitors use this site — which pages get viewed, how people navigate between them, and general usage patterns — so we can improve it. This is identified analytics: PostHog assigns you an ID that persists across visits, rather than treating you as anonymous every time. We don't use it for advertising, and we don't sell or share the data it collects with anyone else. Session recording (a replay of your on-page actions) is switched off. If you reject or ignore the banner, none of this runs, and nothing is sent to PostHog. You can change your mind at any time using "Cookie Preferences" in the footer.

Cookies

This site doesn't set any cookies of its own — the analytics choice above is remembered in your browser's local storage instead, not a cookie — and Turnstile doesn't rely on cookies to function. The one exception is Stripe's own checkout page: once you're taken there to pay, Stripe may set cookies under stripe.com while you're using it, governed by their policy linked above, not ours.

Who we share data with

Cloudflare provides our hosting, the database that stores contact and booking information, and spam protection. Our booking provider stores your booking record (name, email, phone, session time). Stripe processes payment, we never see or store your card details ourselves. If you accept the analytics banner, PostHog receives the usage data described above. We don't sell data, share it with advertisers, or pass it to any other third party. All four may process data outside the UK; each provides its own contractual safeguards for these transfers.

Your rights

Under UK GDPR and the Data Protection Act 2018, you have the right to ask what personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to its processing, and to receive a copy in a portable format. To exercise any of these for data we hold (contact-form submissions), get in touch through the contact form. You can use the same contact form for questions or requests concerning a booking or membership. Stripe's policy, linked above, explains how to contact Stripe about payment information it controls. We don't yet have a dedicated privacy inbox separate from general enquiries; if that changes, this page will be updated with a direct contact.

If you're unhappy with how we've handled your data, you can complain to the UK's supervisory authority, the Information Commissioner's Office (ICO).

Children

Our minimum age for booking a session is 16. This site isn't directed at children below that age, and we don't knowingly collect data from them.

Changes to this policy

If what we collect or why changes, we'll update this page and the date at the top.