This Privacy Policy explains how The Spiritual Agency collects, uses, and protects personal data when you visit our websites, register for an account, use our products, or otherwise interact with us. It applies to processing carried out by us as a controller under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws. If you have any questions, the contact details are in section 15.

1. Who we are and how to contact us

The Spiritual Agency operates as two distinct legal entities. The controller of your personal data depends on which service you are using.

The Spiritual Agency (United Kingdom). International not-for-profit private company limited by guarantee, registered in England and Wales.

• Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
• Companies House registration: 13216970
• Trademark: TSA® (UKIPO UK00003600171)
• Privacy contact: privacy@spiritual.agency
• General legal: legal@spiritual.agency

The Spiritual Agency LLC (United States). Limited liability company registered in Delaware.

• Registered agent: Wolters Kluwer, 108 West 13th Street, Wilmington, Delaware 19801, USA
• Mailing address: 150 West 25th Street, RM 403, New York, NY 10001, USA

For services delivered at spiritual.agency and any product purchased through it, the controller is The Spiritual Agency (UK). For services delivered through separate websites operated by The Spiritual Agency LLC, the controller is The Spiritual Agency LLC, and a separate privacy notice applies on those websites. References in this policy to “we”, “us”, or “our” mean the controller for the service you are using; references to “The Spiritual Agency” without further qualification mean the group collectively.

Vikas Pandey is the privacy point of contact for both entities and acts as Data Protection Officer for UK-side processing. You can reach the DPO at privacy@spiritual.agency.

2. What this policy covers

This policy covers personal data we collect through:

• The spiritual.agency website and any subdomain operated by us
• Customer accounts and any product or service you purchase from The Spiritual Agency (UK)
• Email, support, and other direct correspondence with us
• Events, webinars, and community spaces we operate

It does not cover personal data processed by third-party websites we link to, third-party services you choose to integrate with our products, or services delivered through separate websites operated by The Spiritual Agency LLC (which has its own privacy notice). Where we act as a processor for our enterprise customers, the relevant Data Processing Agreement governs that processing, not this policy.

3. Personal data we collect

We collect personal data in three ways: information you give us, information we collect automatically, and information we receive from third parties.

3.1 Information you give us

• Account information: name, email address, password (stored hashed), organisation name and role where applicable, account preferences.
• Billing information: billing name and address, VAT number where applicable, payment card details (handled by our payment processor, not stored by us beyond the last four digits and expiry for receipt purposes).
• Customer content: text, images, audio, and other content you upload, create, or share through our services.
• Communications: support tickets, replies to our emails, comments and form submissions, content you post in community spaces we operate.
• Identification documents in limited cases: where required for fraud prevention, anti-money-laundering checks, or verifying enterprise customer status.

3.2 Information we collect automatically

• Technical information: IP address, browser type and version, operating system, referring URL, time-stamp of your visit, pages viewed, time spent.
• Server logs: records of requests made to our servers, used for security, debugging, and abuse prevention. Logs are retained on the schedule described in section 7.
• Cookies and similar technologies: see our Cookie Policy for the full inventory and consent management.
• Analytics events: aggregated and pseudonymised behavioural data through our analytics providers (see section 5).

3.3 Information from third parties

• Payment processors: confirmation of payment, fraud-check results, dispute and chargeback notifications.
• Authentication providers: where you sign in through a third-party identity provider, the identity claims they release to us (typically email, name, identifier).
• Anti-abuse services: aggregated reputation signals about your IP address or email domain.
• Public sources: in B2B contexts, publicly available business information (company website, public directories) for context on enterprise enquiries.

We do not intentionally collect special category personal data (UK GDPR Art 9). We do not request information about your health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life, or sexual orientation. Where the nature of our services means such information might appear in content you create or share, you decide what to upload and we treat it as ordinary customer content, processed under your account control.

4. How and why we use your data

We process personal data only where we have a lawful basis under UK GDPR Art 6.

Purpose	Data used	Lawful basis (UK GDPR Art 6)
Creating and managing your account	Account information, billing information	6(1)(b) Performance of contract
Processing payments and issuing receipts	Billing information, transaction records	6(1)(b) Performance of contract; 6(1)(c) Legal obligation (tax and accounting records)
Delivering the services you have purchased	Account information, customer content	6(1)(b) Performance of contract
Providing customer support	Account information, communications, customer content where relevant	6(1)(b) Performance of contract
Security, fraud prevention, abuse detection	Technical information, server logs, anti-abuse signals	6(1)(f) Legitimate interests (protecting our services and other users)
Service improvement and analytics	Technical information, analytics events (pseudonymised)	6(1)(f) Legitimate interests, or 6(1)(a) Consent where cookies require it
Marketing to existing customers about similar services	Account information, contact information	6(1)(f) Legitimate interests, plus the soft opt-in under PECR Reg 22(3)
Marketing to prospects who have not purchased	Contact information	6(1)(a) Consent
Complying with legal, regulatory, and tax obligations	Whatever data is required by the obligation	6(1)(c) Legal obligation
Defending or pursuing legal claims	Whatever data is relevant to the claim	6(1)(f) Legitimate interests

Where we rely on legitimate interests, we have weighed our interests against your rights and freedoms and concluded that the processing is proportionate. You can ask for the relevant Legitimate Interests Assessment by emailing privacy@spiritual.agency.

We do not engage in any automated decision-making that has legal or similarly significant effects on you (UK GDPR Art 22). We do not perform credit scoring or behavioural profiling beyond aggregated analytics.

5. Who we share your data with

We share personal data only with parties listed below, only for the purposes set out, and only under written contracts that require equivalent protection.

Sub-processors. Companies we contract to process personal data on our behalf, under written agreements compliant with UK GDPR Art 28. The current inventory, by category, is summarised below. The full named list with country of processing and processing description is maintained at /legal-policies/sub-processors/.

• Hosting and infrastructure: Hetzner Online GmbH (primary infrastructure for authentication and internal services), Incsub LLC trading as WPMU DEV (managed WordPress hosting for client sites and active client-billing management through the WPMU DEV Hub, infrastructure provided by Vultr Holdings LLC), Hostbrr OÜ (the primary application server, MCP, automation, staging), Advin Servers (microservices infrastructure for stack.spiritual.agency), Cloudflare Inc (DNS, content delivery, security front-end)
• Email delivery: Amazon Web Services EMEA SARL (Amazon SES), Mailgun Technologies Inc, Sinch Email Sweden AB (Brevo), Namecrane Ltd, all for transactional email; Vbout Inc for marketing email automation (Vbout uses Amazon SES as its delivery infrastructure)
• Payments: Lemon Squeezy LLC and Polar Software Inc, named on the sub-processors page; we do not see or store full card numbers
• Analytics: Google Ireland Limited (Google Analytics 4); Rybbit Analytics (privacy-preserving analytics, currently being evaluated for production rollout)
• Customer support and operations: Anthropic PBC (AI assistance for support drafting and content workflows; customer personal data may be processed), FuseBase Inc (internal knowledge base and client portal hosting), Clientexec (hosting-business management platform at host.spiritwp.com)

Professional advisors. Lawyers, accountants, auditors, and consultants who help us run the business, bound by confidentiality.

Authorities. Law enforcement, courts, regulators, and tax authorities where we are legally required to disclose information, or where disclosure is necessary to protect our rights or the safety of users or the public. We push back on overbroad requests and require valid legal process.

Group entities. Where necessary to deliver a service or operate the group, we may share personal data between The Spiritual Agency (UK) and The Spiritual Agency LLC. Each entity acts as an independent controller for its own services and we do not consolidate data across the group beyond what is operationally necessary.

Business transfers. If we are involved in a merger, acquisition, reorganisation, or sale of assets, personal data may be transferred as part of the transaction, subject to the transferee accepting the obligations of this policy.

We do not sell personal data. We do not share personal data with third parties for their own marketing purposes.

6. International transfers

The Spiritual Agency (UK) is based in the United Kingdom. Some of our sub-processors are located outside the UK, predominantly in the European Economic Area, the United States, and other jurisdictions with established cloud infrastructure. When personal data is transferred outside the UK to a country that has not received a UK adequacy decision, we put in place appropriate safeguards under UK GDPR Chapter V.

For US-based sub-processors that are certified under the EU-US Data Privacy Framework with the UK Extension (the UK-US Data Bridge, adopted September 2023), transfers rely on that adequacy mechanism.

For US-based sub-processors not certified under the Data Bridge, and for transfers to other third countries without UK adequacy, we rely on the International Data Transfer Agreement issued by the ICO, or the EU Standard Contractual Clauses supplemented by the UK International Data Transfer Addendum, alongside any supplementary technical and organisational measures required by the transfer risk assessment.

You can request a copy of the relevant transfer mechanism for a specific sub-processor by emailing privacy@spiritual.agency.

7. How long we keep your data

We retain personal data only for as long as we need it for the purpose it was collected, and to meet our legal and accounting obligations.

• Account data: for the lifetime of your account, then six years after closure to meet UK statutory record-keeping and limitation periods (Limitation Act 1980; HMRC retention requirements). You can request deletion before this period expires, subject to legal and accounting carve-outs.
• Billing and transaction records: six years from the end of the relevant accounting period (HMRC requirement).
• Customer support correspondence: two years after the ticket is resolved, then archived for one further year before deletion.
• Marketing consents and preferences: until you withdraw consent or unsubscribe, plus a suppression record retained indefinitely so that we honour your withdrawal even if you appear again in a future contact list.
• Server logs: 90 days for security investigation purposes, longer where required for an active investigation.
• Analytics data: aggregated and pseudonymised data retained for the period configured at the analytics provider (typically 14 to 26 months for individual session data; aggregated reports indefinitely).
• Backups: rolling backup schedule with deletion on a defined cadence; data in backups is restored only for disaster recovery, not for routine access.

Where we are required to retain data for longer (for example, to respond to a regulatory investigation or to defend a legal claim), we retain it for the duration of that requirement and delete it once the requirement ends.

8. Your rights under UK GDPR

You have the following rights in relation to personal data we hold about you:

• Right of access (Art 15): you can ask for a copy of your personal data and information about how we process it.
• Right to rectification (Art 16): you can ask us to correct inaccurate personal data, or to complete incomplete personal data.
• Right to erasure (Art 17): you can ask us to delete personal data where the legal grounds apply (for example, where the data is no longer needed, where consent is the basis and you withdraw it, or where the processing is unlawful). Erasure does not apply where we have a continuing legal obligation to retain the data.
• Right to restriction (Art 18): you can ask us to stop processing your data while we investigate a complaint or a rectification request.
• Right to portability (Art 20): for data we hold based on your consent or to perform a contract, processed by automated means, you can ask for it in a machine-readable format and to have it transferred to another controller.
• Right to object (Art 21): you can object to processing based on legitimate interests, including profiling. You have an absolute right to object to direct marketing at any time.
• Right to withdraw consent (Art 7(3)): where we rely on consent, you can withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
• Right not to be subject to automated decision-making with legal or similarly significant effects (Art 22): we do not engage in such processing.

To exercise any of these rights, email privacy@spiritual.agency. We respond within one month of receiving a valid request and we do not charge a fee unless your request is manifestly unfounded or excessive (UK GDPR Art 12(5)). We may need to verify your identity before acting on a request.

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority: ico.org.uk/concerns, 0303 123 1113. We would prefer the opportunity to address your concern directly first.

9. California residents

If you are a California resident, separate rights under the California Consumer Privacy Act (as amended by the CPRA) apply to processing carried out by The Spiritual Agency LLC. The substantive California notice is published on the separate websites operated by The Spiritual Agency LLC. In summary, you have the right to know, delete, correct, and opt out of any “sale” or “sharing” of personal information; you also have the right not to be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioural advertising. To exercise California rights against either entity, email privacy@spiritual.agency; requests will be routed to the appropriate controller.

10. Security

We protect personal data with technical and organisational measures appropriate to the risk of the processing. These include encryption in transit (TLS) and at rest for sensitive data, access controls based on least privilege, audit logging of administrative actions, segregation of production data from development environments, and regular security review of our sub-processors.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware and, where the risk is high, we will notify you directly (UK GDPR Art 33 and 34).

11. Children’s privacy

Our services are not directed at children under 16 and we do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data, please contact privacy@spiritual.agency and we will delete it.

12. Marketing communications

We send marketing emails about our services in two scenarios. First, to existing customers about products and services similar to those they have purchased, under the PECR Reg 22(3) soft opt-in: we identify ourselves, we gave you a chance to opt out when we collected your details, and every marketing email includes an unsubscribe link. Second, to prospects who have given specific, informed consent to receive marketing, which you can withdraw at any time.

You can manage your preferences from our Communication Preferences page or by emailing privacy@spiritual.agency.

13. Cookies and tracking

We use cookies and similar technologies on our websites. Strictly necessary cookies are set without consent because the service cannot function without them. All other cookies (analytics, preferences, marketing) are set only with your consent, which you can manage through the cookie banner on first visit and from the cookie settings link in the website footer. Full inventory and detail in our Cookie Policy.

14. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top reflects the most recent change. For material changes that affect how we process your personal data, we will notify registered customers by email and prominently flag the change on the website before it takes effect. Past versions are available on request.

15. Contact and complaints

For any question, request, or complaint about this policy or our processing of your personal data:

• Email (preferred): privacy@spiritual.agency
• Data Protection Officer: Vikas Pandey, reachable at the email above
• UK postal address: The Spiritual Agency, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
• US postal address (for The Spiritual Agency LLC): 150 West 25th Street, RM 403, New York, NY 10001, USA

If you remain dissatisfied after contacting us, you can lodge a complaint with the Information Commissioner’s Office (the UK supervisory authority) at ico.org.uk/concerns or by calling 0303 123 1113. Residents of other countries can complain to their local supervisory authority.