Legal
Privacy Policy
Last updated: 25 September 2026
We care about your privacy, and we want to treat your information with the same honesty and care we try to bring to everything at Invest and Learn. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and your rights.
1. Who we are
Invest and Learn is a trading name of Invest & Learn Ltd, a company registered in England and Wales (company number 17445670). Our registered office is 2 Cargy Close, Cubert, Newquay, England, TR8 5EJ.
Invest & Learn Ltd is the controller of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018).
For any privacy question or request, email hello@investandlearn.co.uk. We are a small organisation and haven't appointed a Data Protection Officer. Matthew Bain is responsible for data protection.
2. The information we collect
Information you give us
- Account details: your name, email address and password or sign-in method when you create a free member account. If you sign in with a third-party account such as Google, we receive your basic profile details (e.g. your name, email and profile picture). You can also set a display name.
- Membership and payment details: your plan (Free, Basic or Premium), billing interval, any discount code used, subscription status and history. Payments are processed by Stripe. We never see or store your full card details. We hold only Stripe's customer and subscription reference numbers and basic billing information.
- Newsletter details: your email address, first name, where you signed up (e.g. website pop-up or checkout), and the date and status of your subscription, including confirmation (double opt-in) records.
- 1:1 session bookings: your name, email, time zone, the date and time you choose, payment details (taken by Stripe through our booking system, Cal.com), and anything you choose to tell us in the booking form or during the session. Matt may keep short notes of what we discussed to help with future sessions.
- WhatsApp community (free and paid members): your phone number, WhatsApp name and profile picture, and the messages, images and reactions you post in the community and its sub-groups (some sub-groups are for paid members only).
- Messages to us: emails you send us and our replies.
- Community and live-session contributions: questions, comments and anything you share in live sessions or Q&As.
- Recordings of live community sessions and Q&As: live sessions may be recorded and shared with members afterwards. A recording may include your name or display name, your image and voice if your camera or microphone is on, and anything you type in the chat. We'll tell you at the start when a session is being recorded. If you don't want to appear, you can keep your camera off, stay muted and not speak, or use the chat instead. 1:1 sessions are not recorded unless we've agreed it with you in advance.
Information collected automatically
- Technical and security data: your IP address, browser and device type, pages requested, and timestamps. These are recorded in server and security logs by our hosting and sign-in providers, to keep the site working and secure and to prevent fraud and abuse.
- Cookies and similar technologies: see section 10. We do not use advertising, tracking or analytics cookies.
Information from others
- Stripe tells us when a payment succeeds or fails, and when a subscription starts, renews, changes or is cancelled.
- Our email provider (Resend) tells us whether an email was delivered and whether you've unsubscribed.
- Cal.com sends us your booking details when you book, reschedule or cancel a 1:1 session.
3. Information about your faith, health or finances
Invest and Learn teaches from a Christian perspective. Being a member of our community may suggest your religious beliefs. You may also choose to share prayer requests, health matters or details of your finances in the community or in 1:1 sessions.
Information about religious beliefs and health is "special category data" under UK law and gets extra protection. We don't ask you for it and you never have to share it. Where you choose to share it with us, or in our community, we rely on your explicit consent (UK GDPR Article 9(2)(a)). You can withdraw that consent at any time by asking us to remove the information. We only use it to support you and run the community, and we never use it for marketing or share it outside the service providers listed below.
Please remember that anything you post in the WhatsApp community can be seen by the other members of that group, and that anything you say on camera in a recorded live session can be seen by members who watch the recording.
4. How we use your information, and our lawful bases
| What we do | Lawful basis |
|---|---|
| Create and run your account; give you access to member content | Contract: to provide the service you signed up for |
| Take payments, manage subscriptions, renewals, cancellations and refunds | Contract; legal obligation (tax and accounting records) |
| Invite free and paid members to the WhatsApp community; add paid members to paid-only sub-groups and remove them when their paid membership ends (including keeping a record of who needs removing) | Contract; legitimate interests (keeping paid-only sub-groups for current paid members) |
| Book, take payment for, run and follow up 1:1 sessions (Cal.com, Stripe via Cal.com, Google Calendar and Google Meet) | Contract |
| Record live community sessions and Q&As and share the recordings with members | Legitimate interests (letting members who couldn't attend, or want to revisit the teaching, catch up). To balance this with your privacy, we tell you when a session is recorded, you can keep your camera off, stay muted or use the chat instead, and you can ask us to remove parts of a recording that include you |
| Send service emails: sign-up confirmations, receipts, welcome and access details, renewal reminders, changes to our terms | Contract; legal obligation |
| Send our newsletter | Consent (you confirm by double opt-in). Where you become a paying member and don't opt out at checkout, we may instead rely on the "soft opt-in" for similar services under PECR. You can unsubscribe at any time using the link in every email |
| Respond to your messages and complaints | Legitimate interests (helping you); contract where it relates to your membership |
| Keep the site secure; prevent fraud, spam and abuse; fix faults | Legitimate interests |
| Enforce our Terms and community rules; establish or defend legal claims | Legitimate interests |
| Keep records we must keep by law (e.g. for HMRC) | Legal obligation |
| Special category data you choose to share (see section 3) | Explicit consent |
Where we rely on legitimate interests, we've balanced our interests against yours. You can object at any time (see section 8).
We don't sell your data, and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Who we share your information with
We use trusted service providers ("processors") who handle data only on our instructions and under contracts that protect it:
| Provider | What they do for us | Where data may be processed |
|---|---|---|
| Clerk (Clerk, Inc.) | Member accounts, sign-in and security | USA |
| Stripe (Stripe Payments UK Ltd / Stripe, Inc.) | Payments, subscriptions, billing portal, receipts, and payments for 1:1 sessions (through Cal.com) | UK, EU and USA |
| Resend (Resend, Inc.) | Sending emails; storing newsletter contacts and unsubscribe status | EU (our sending region is Ireland) and USA (Resend is a US company) |
| Neon (Neon, Inc.) | Our database (member, subscription and newsletter records) | UK (AWS London region); support access may be from the USA |
| Vercel (Vercel Inc.) | Website hosting and server logs | USA (our server functions run in Vercel's US region) and a global edge network |
| Cal.com (Cal.com, Inc.) | 1:1 session booking, scheduling, confirmations and reminders. The booking calendar on our Book page is a Cal.com embed, so Cal.com receives the details you enter there. Payments for sessions are taken by Stripe through Cal.com | USA |
| Google (Google LLC / Google Ireland) | Google Calendar invites and Google Meet video calls for sessions, storing recordings of live sessions, and our email inbox | UK, EU and USA |
| Porkbun (Porkbun LLC) | Our domain name and forwarding of emails sent to hello@investandlearn.co.uk | USA |
Some organisations act as independent controllers, with their own privacy policies:
- WhatsApp (WhatsApp Ireland Ltd / Meta): WhatsApp processes your data under its own terms when you use the app and join our community.
- Stripe also acts as a controller for some purposes, such as fraud prevention and meeting its own legal obligations.
We may also share information with professional advisers (e.g. accountants and lawyers), with HMRC, regulators, the police or courts where the law requires it, and with a buyer or successor if our business is ever sold or reorganised (they would have to protect your data in the same way).
6. International transfers
Some of our providers are based in, or access data from, the USA and other countries outside the UK. Where personal data leaves the UK, we make sure it's protected by a lawful transfer mechanism. That will be either the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge") where the provider is certified, or the UK International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, or a UK adequacy regulation. Contact us if you'd like more details.
7. How long we keep your information
| Data | How long |
|---|---|
| Account data | While your account is open. If you ask us to delete your account, or it has been inactive for 3 years, we delete it within 30 days, except for records we must keep (below) |
| Payment, subscription and invoice records | 6 years from the end of the financial year they relate to (tax and accounting law) |
| Newsletter subscriber data | Until you unsubscribe. We then keep a minimal record of your email address on a suppression list so we don't email you again. Unconfirmed sign-ups are deleted after 30 days |
| 1:1 booking records and session notes | 2 years after your last session, and payment records as above |
| Recordings of live sessions and Q&As | Up to 2 years from the date of the session, then deleted. If you ask us to remove a part that includes you, we'll edit or remove it where we reasonably can |
| WhatsApp community membership | You stay in the general community until you leave or we remove you under our Terms. When your paid membership ends, you're removed from paid-only sub-groups. Our internal removal record is kept for 12 months. Messages you posted stay in other members' chat history, which we can't control |
| Emails and complaints | 2 years after the matter is closed |
| Security and server logs | Generally no more than 90 days, depending on the provider |
8. Your rights
Under UK data protection law you have the right to:
- access a copy of your personal data;
- ask us to correct inaccurate or incomplete data;
- ask us to delete your data;
- ask us to restrict how we use it;
- object to our use of your data where we rely on legitimate interests. You can always object to direct marketing;
- data portability: receive data you gave us in a reusable format, or have it sent to another organisation;
- withdraw consent at any time where we rely on consent (e.g. the newsletter or special category data), without affecting what we did before.
To use any of these rights, email hello@investandlearn.co.uk. We may need to confirm your identity. We'll respond within one month (this can be extended by two further months for complex requests, and we'll tell you if so). There's normally no charge. You can update most account details yourself on your Account page, manage your subscription through the billing portal, and unsubscribe from the newsletter using the link in any email.
9. Complaints
If you're unhappy with how we've handled your data, please contact us first at hello@investandlearn.co.uk and we'll do our best to put things right. We'll acknowledge your complaint within 30 days.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113.
10. Cookies and similar technologies
We keep this minimal. We don't use advertising cookies, social media tracking pixels or analytics tools. Because we only use storage that is strictly necessary, or that simply remembers your display preferences, we don't need to ask for cookie consent. If this changes, we'll update this policy and ask for your consent where the law requires it.
Our Book page embeds Cal.com's booking calendar. When that page loads, Cal.com sets the cookies and browser storage listed below on its own domain (cal.com). We checked these on 25 September 2026: they're used for security and to make the booking work, not for advertising or analytics. Cal.com also sends technical error reports to its error-monitoring provider. See Cal.com's privacy policy for details.
| Name / type | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
Clerk authentication cookies (e.g. __session, __client_uat, __client) and Clerk local storage (__clerk_environment) |
Clerk, on investandlearn.co.uk and our Clerk sign-in subdomain (clerk.investandlearn.co.uk) | Keep you signed in securely, protect against fraud and abuse | Strictly necessary | From the end of your browser session up to long-lived (Clerk sets some for up to 10 years; most browsers limit this to about 13 months) |
Cloudflare security cookies (__cf_bm, _cfuvid) |
Cloudflare, on behalf of Clerk (our sign-in subdomain) and Cal.com (cal.com) | Tell real visitors apart from bots and protect against abuse | Strictly necessary | __cf_bm: 30 minutes. _cfuvid: end of browser session |
ial-theme (browser local storage) |
Us | Remembers whether you chose light or dark mode | Preference (appearance). You can change it any time with the theme toggle, or clear it in your browser settings | Until cleared |
ial_newsletter_dismissed (browser local storage) |
Us | Remembers that you've closed or completed the newsletter pop-up, so we don't show it again | Strictly necessary / records your choice | Until cleared |
| Stripe cookies | Stripe, on Stripe's own checkout and billing pages (checkout.stripe.com / billing.stripe.com) | Secure payments and fraud prevention | Strictly necessary (see Stripe's cookie policy) | Set by Stripe |
Cal.com booking cookies (__Secure-next-auth.csrf-token, __Secure-next-auth.callback-url, uid) |
Cal.com, on cal.com, when the booking calendar on our Book page loads or you pick a time | Security (protection against cross-site request forgery) and keeping track of the time slot you're booking | Strictly necessary | End of browser session |
Cal.com local storage (reserverUid, timeOption.is24hClock, nextauth.message) |
Cal.com, in the embedded booking calendar (app.cal.com) | Holds the time slot you've selected while you book, remembers the 12/24-hour time format, and manages the calendar's sign-in state | Strictly necessary / preference | Until cleared |
Our website fonts are self-hosted, so loading a page doesn't send your data to a font provider. You can block or delete cookies and local storage in your browser settings, but if you block the strictly necessary ones, signing in won't work.
11. Security
We use reputable providers with strong security, encrypted connections (HTTPS), access controls and two-factor authentication on our admin accounts. Only Matt (and anyone helping him run Invest and Learn under a duty of confidentiality) can access member data, and only when needed. No online service is 100% secure, but if a data breach happened that put your rights at risk, we would tell you and the ICO as the law requires.
12. Children
Our services are for adults aged 18 and over. We don't knowingly collect data from children. If you think a child has given us their data, please contact us and we'll delete it.
13. Links to other websites
Our site links to other websites and platforms (for example YouTube, Instagram, X and Patreon). They have their own privacy policies, and we aren't responsible for how they use your data.
14. Changes to this policy
We may update this policy from time to time. We'll change the "last updated" date and, if the changes are significant, we'll let members know by email.