Privacy Notice

BESPOKE IN BOND operates I AM, PROOF OF POSSIBLE and is the data controller for the personal data described here. You can reach us at jason@bespokeinbond.com.

• Account data — email address and authentication identifiers (including Google sign-in), used to create and secure your account. Legal basis: performance of our contract with you.
• Profile data — your name, optional profile photo, age, gender, relationship and employment status, whether you have children, your goal, and what has stopped you before. Used to personalise your daily affirmation and questions. Legal basis: contract performance, and your consent where the information is optional.
• Journal content — your daily answers, streaks, phase progress, and generated prompts. Used to provide the Service and show your history. Legal basis: contract performance.
• Referral data — your invite code and who invited you, used to credit invitations. Legal basis: legitimate interest in growing the Service fairly.
• Notification data — your reminder time, time zone, and device push token, used only to send the daily nudge you enabled. Legal basis: consent, withdrawable at any time in Settings.
• Technical data — IP address, device and browser information, and error/usage logs, used for security, fraud prevention, and improving reliability. Legal basis: legitimate interests.
• Support messages — anything you send us, used to answer you. Legal basis: legitimate interests.

We do not sell your personal data, and we do not use your journal entries for advertising.

To generate your daily affirmation and questions, we send limited context — your current phase, day number, stated goal, stated obstacle, and recent answer themes — to our AI provider. This is processed to return your prompt and is not used to identify you publicly.

• Service providers and subprocessors: our hosting, database, authentication, AI, and push-notification providers.
• Paddle.com, our Merchant of Record, for the sale of memberships, subscription management, payments, invoicing, and tax compliance.
• Professional advisers such as legal and accounting where necessary.
• Authorities where we are required to do so by law.

Our providers may process data outside your country, including outside the UK/EEA. Where that happens we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

We keep your account, profile, and journal data for as long as your account is active. If you delete your account or ask us to erase your data, we delete or anonymise it within 30 days, except where we must keep limited records (for example transaction records) to meet legal obligations.

Depending on where you live, you may have the right to access, correct, erase, restrict, or port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. If you are in the UK or EEA, you also have the right to complain to your supervisory authority. Email jason@bespokeinbond.com and we will respond within one month.

We use appropriate technical and organisational measures to protect your data, including encryption in transit, row-level database access rules that scope every record to its owner, and restricted administrative access. No system is perfectly secure, but we take this seriously.

We use essential cookies and browser storage only — to keep you signed in, remember an invite code you arrived with, and keep the app working. We do not use advertising cookies. You can clear this data in your browser at any time, though doing so will sign you out.