Privacy Policy

1. The short version

• We are responsible for your data. Higher Capacity Ltd is the data controller for all of your interactions with The Business Writing Club and the Coach app. The third-party platforms our systems use (listed at section 4) act on our instructions. If you have a question or complaint, it will be dealt with by Higher Capacity Ltd.
• We do not keep the writing you submit for feedback. Your text is sent to an artificial intelligence (AI) provider to generate feedback to help you, and then it is discarded. We do retain some information about the progress of your writing, and your account details. But we do not retain the words you write or the documents you upload. The one exception is the word cloud in a live workshop, where the themes — drawn and paraphrased from the room's answers — are kept. See section 2d.
• We store data about your progress, but never your text or your documents.
• You can try the Coach app without an account. Anything you paste into our public taster is used to generate feedback and then discarded — we never store it. See section 2i.
• We use your personal data to run your account, give you feedback, improve the service, and — if you ask us to — keep you on our waiting list or send you updates.
• You have rights over your data, including access and deletion. See section 8.

Where your data lives

• Your account and everything in it: Frankfurt, Germany — inside the European Economic Area.
• Email you send us, and our own working files: the United Kingdom. Microsoft holds these under a UK data-residency commitment.
• The writing you submit for feedback: sent to our AI providers in the United States at the moment of analysis, then discarded. We never store it, and it is never used to train anyone's AI models. See sections 2b and 4.
• Your course: LearnWorlds holds your course account and your progress through the online course. LearnWorlds is based in the EU and holds this data under the UK's adequacy regulations for the European Economic Area.
• WhatsApp messages, if you choose to send us one: carried and stored by Meta in the United States, with a copy in our own database in Frankfurt. See section 2j.
• Analytics and tracking: we don't use analytics services, tracking scripts or advertising cookies on any of our sites or tools. We do keep one simple count: when someone opens our /join page, we record the time and the tags on the link they came by (for example, which advert). Nothing that identifies you.
• Passwords: we use one-time access codes rather than passwords, so there are no passwords stored.
• Server logs: no writing, no names, no email addresses. They record the address of each request, which for a one-time join link includes that link’s single-use code.

2. What we collect and why

a. Your account (TBWC Coach)

We collect your email address, your name, and any optional profile details you choose to enter (e.g. job title). We also hold a small amount of housekeeping data about the account itself: the type of account you have, your subscription status, the time you last signed in, and the invitation code you joined with. Why: to create and secure your account and to give you relevant feedback. Lawful basis: performance of our contract with you.

How we sign you in. Our systems do not use passwords, so we don't store any. When you sign in, we email you a six-digit code. The code lasts 10 minutes, works once, and the record of it is deleted the moment it is used, expires, or is replaced by a newer one.

Entering a valid code starts a session that lasts 30 days, after which you sign in again with a fresh code. The 30 days run from when you sign in.

b. The writing you submit for feedback

When you submit a piece of writing, the text is transmitted to our AI provider(s) to produce your feedback and is not stored by us afterwards. We keep only derived, non-text information about the submission: word counts, the type of feedback, quality scores, the categories of "friction" identified, timestamps, and links between drafts and revisions. We do not store the submitted text or the feedback text. Where a piece of feedback is reviewed for quality, we keep a short note of what went wrong with it — that note describes our feedback, not your writing. Why: to generate your feedback and to show you your progress over time. Lawful basis: performance of our contract.

c. Things you tell us about the service

Some free-text you might choose to enter is stored (for example, if you report an issue with a piece of feedback). Why: to handle your report and improve accuracy. Lawful basis: legitimate interests / contract. This is information you send us so that we can act on it.

d. TBWC Live (workshops)

Your account. For a live session we store the display name you choose, a participant token that identifies your device during the session, and a record of the consents you give. We also hold your email address: either because your facilitator invited you by email, or because you typed it in to join with the session’s passcode. Joining a session creates a Coach account for that address if it does not have one already, so that your session pack and the tools you are sent to can be kept behind a sign-in that is yours. You can close it at any time (section 8).

What you write during a session. How your writing is handled depends on the activity:

• Writing tasks and diagnostics. Your text is used to generate your feedback and is never stored. Nobody else in the room — including the facilitator — sees what you write. It's private to you.
• Word clouds. Your words are used to work out the themes running through the room's answers. The themes go up on the shared screen; your own words do not. Your words are then deleted when the session closes, but the themes are kept as part of the record of the workshop. In a small group, a theme may sit close to something one person wrote.

Feedback you give us during the session. If you send a comment or suggestion while the session is running, we keep it. It isn't linked to your name — the tool cannot tell us who wrote it — but it is retained after the session ends so we can act on it.

The feedback form afterwards. We email you a link to a short feedback form, which is run for us by Tally. The form doesn't ask who you are — but it has optional name and email boxes, and if you fill those in, your feedback is no longer anonymous. That choice is yours. Tally also records some technical information when you submit, such as the internet address you send from, and holds your answers in the European Union. Why: to learn how the session went and to run better ones. Lawful basis: consent — you agreed to session follow-up when you joined, and filling the form in is your choice.

Your notepad. Private notes you take in the participant notepad are stored only on your own device and are never sent to us.

Audio recording. Your facilitator may record the room’s audio during the session. When they do, your screen shows a “recording” indicator and tells you so the first time. The recording is retained by TBWC for quality assurance and review purposes for up to six months, after which it is deleted. We may process the recording through our AI tools to produce a summary. The recording and any summary are not shared with anyone outside TBWC, and are never sold or used for marketing.

Your session pack. After the session, if the facilitator publishes a pack, you can open it in your Coach account for 12 months. It holds the room’s aggregate results, the themes, and the slides — never anyone’s writing, and no list of who was there. If you said yes to “email me the pack” when you joined (you can change that on the closing screen), we send you one email to say it is ready.

Why: to run the live session and improve how we run future ones. Lawful basis: contract / legitimate interests. Retention: word-cloud themes, display names and invitation emails are kept for 12 months after the session; session feedback for 24 months. See section 6.

e. Interactive tools

Our interactive tools (e.g. the Nounifier) may send a single word or short input to our AI provider to return a result. These tools store nothing about you or your input.

f. Waiting list and marketing

If you join our waiting list or ask for updates, we store your name, email, your consent and its timestamp, and two more things. Why you’re interested: an optional choice between two fixed answers (“I want to write better” or “I want my team to improve”). We keep the answer you pick. How you found us: the tags on the link you arrived by (for example, which advert) and the website that sent you, plus a note of which form you used — the waiting list or the writing tips sign-up. If you unsubscribe, we keep a record of when. Why: to keep you informed about the course, or to make sure we don't contact you again if you've unsubscribed. Lawful basis: consent — you can withdraw it at any time via the unsubscribe link or by contacting us.

g. Usage and technical data

We record technical data — such as which AI model was used, token counts, latency, and cost — to run and cost-manage the service. This doesn't contain any of your writing.

Analytics and cookies. Our website, the Coach app and our interactive tools run no analytics services, no tracking scripts and no advertising or tracking cookies. We do count visits to one page ourselves. When you open our /join page, your browser tells our server the page was opened, with the tags on the link you arrived by (for example, which advert sent you). We store only that and the time: no cookie, no internet address, nothing that could identify you or link one visit to another.

What we do store on your device. When you sign in to Coach we keep a sign-in token in your browser, so that you stay signed in. This is necessary for the service to work at all, it isn't used to track you, and clearing your browser data removes it. Other things live on your device and never reach us: the notes you take in the participant notepad during a live session (section 2d), and anything you enter into the tools we provide to support your learning — that stays in your browser and is sent neither to us nor to any AI provider. (The Nounifier is the one exception; section 2e says what it sends.)

Content delivery networks. A few files that make our pages work — fonts and icons — are served from content delivery networks. Like any web server, those see the internet address your browser connects from. They don't set any cookies, and they don't receive other details about you.

h. Course enrolment and progress

Our course runs on LearnWorlds. When you enrol, LearnWorlds holds the account and enrolment data needed to give you the course itself (your name, email, enrolment and completion records).

How your Coach account is created. Coach accounts are set up by invitation, or by joining a live workshop (section 2d). For an invitation we store the invitation code, the email address of the person who issued it, and the email address it was used by — so that we know who has access and how they got it.

Why: to provide the course and app you've signed up for. Lawful basis: performance of our contract with you.

i. Trying Coach without an account (the public taster)

You can paste a short piece of writing into our public taster and get a response without signing up for anything.

• We don't ask you who you are. No account, no email address, no name. We collect no personal data ourselves at this step.
• We check that you are a person, not a bot. When you click into the taster box, the page loads Cloudflare Turnstile, a security check run by Cloudflare. To run it, Cloudflare sees the internet address your browser connects from and technical details about your browser and device. It does not see the writing you paste. We use it only to keep automated traffic out of the taster, not to identify or track you.
• Your text is sent to our AI provider to generate the response you see, exactly as described at section 2b.
• We don't store any of it. Your text is not saved, and the response is not saved. Everything disappears when you leave the page.

Why: so you can see what Coach does before deciding whether you want it. Lawful basis: legitimate interests.

j. If you message us on WhatsApp

You can choose to message us on WhatsApp instead of, or as well as, email. It's entirely optional; everything we offer is available without it.

What we keep. When you message us, we keep your WhatsApp number (or the identifier WhatsApp gives us in its place), the name on your WhatsApp profile, and the text of your messages and our replies. We also note which of our pages or channels you messaged us from (for example, our Instagram profile or our waiting-list page). We may add short notes of our own about your enquiry; these are kept with the conversation and deleted with it. We don't copy photos, voice notes, documents or other attachments into our records: we note only that one was sent. They stay in the WhatsApp chat itself, like any WhatsApp conversation, which we delete on the same schedule. If you delete a message for everyone, we delete our copy of it too.

Why. To answer your enquiry, and to understand what people interested in our courses are looking for. Our lawful basis is 'legitimate interest': you've contacted us with a query and we want to answer you. We won't add you to broadcasts or send you marketing on WhatsApp. If we'd like to message you later about something you haven't asked about (for example, when founding places open), we'll ask first.

How it works. Messages reach us through Meta's WhatsApp Business Platform, which carries and stores them on Meta's servers in the United States. A copy is kept in our own database, in Frankfurt. A connection provider, Dualhook, links our WhatsApp account to that platform; it does not receive or store the content of your messages. The first time you message us, an automatic reply tells you this and links here.

AI tools. We may review conversations with AI tools to help us understand common questions. When we do, we use providers that don't use your data to train their models (section 4).

How long. We delete your messages and our notes 12 months after we last exchanged messages, or 3 months after you tell us you're not interested or the enquiry closes. If you join a course, we keep the conversation for as long as you're on our waiting list or course records, and delete it when those are deleted.

People we don't record. People sending spam or abusive messages are never recorded. For these we keep only a one-way code made from their number, plus its last four digits, so their messages can be discarded before they're stored. No messages or names are kept, and an entry stays until we remove it.

3. What we do not do

• We do not store the text you submit for analysis, or the feedback generated from it.
• We do not store any quotation from your writing: no extracts, no highlighted phrases, nothing verbatim.
• We do not pass the writing you submit for feedback to your course platform. It goes to the AI provider that generates your feedback, and nowhere else.
• We do not sell your personal data.
• We do not use your submitted writing to train AI models, and neither do our AI providers. Our primary AI platform is Claude/Anthropic and we use ChatGPT/OpenAI as a backup. Neither Anthropic nor OpenAI train their models using data submitted through their APIs (unless a customer opts in: we have not and will not).

4. Third-party services and integrations

We are the controller for your data. The services below are our processors — they handle data only as we instruct them, and only for the purposes described here.

5. International transfers

Your account and everything in it are held in Germany. The Coach application and its database both run in Frankfurt, inside the European Economic Area. Transfers from the UK to the EEA are covered by the UK's adequacy regulations, so nothing further is needed to protect this part of your data's journey.

Email you send us stays in the United Kingdom. Our mailboxes are hosted by Microsoft in the UK, so anything you send to our privacy address — including a request to see or delete your data — is stored here and doesn't leave the country.

Some processing happens outside the UK. Our AI providers (Anthropic and OpenAI), our email-sending provider (Resend) and Cloudflare are US-based, as is Meta, which carries and stores any WhatsApp messages you choose to send us. A small number of routine maintenance jobs also run on US servers; those handle operational figures like cost and usage only, never anything you have written.

Where personal data goes to the United States, we rely on the UK Extension to the EU-US Data Privacy Framework for providers certified under it, and the UK International Data Transfer Agreement or Addendum for those that are not. Meta relies on standard contractual clauses with the UK Addendum (WhatsApp's UK Data Transfer Addendum).

6. How long we keep it

We don't keep your personal data for longer than we need it for the reason we collected it. In practice that means:

• Account data: for as long as you have a relationship with us — meaning for as long as you're subscribed (paid, or through the LearnWorlds course), or for as long as you're using Coach, whichever runs longer.
• If you don't have an active subscription with us and you haven't signed in for 24 months, we delete your account and everything in it. The 24 months run from whichever came last: your most recent sign-in, or the end of your subscription. We never do this without telling you: you'll get two emails beforehand, so you can sign back in to keep your history or download it and take it with you. If you're paying for your Coach access we don't delete anything while your subscription is active, whether you're signing in or not.
• If you close your account yourself: everything is deleted 30 days later. The 30 days are a grace period, in case you change your mind or do it by accident — see section 8. The single exception is your email address on our do-not-contact list, kept so that we cannot add you back to a mailing list by mistake. It is never used to contact you.
• Submitted writing: not retained (discarded after analysis).
• Derived progress data (counts, scores, categories): deleted with your account, within the same 30 days.
• Any notes we keep from quality-checking our own feedback: deleted with your account, within the same 30 days.
• TBWC Live: what you write in a writing task or diagnostic is never stored. Word-cloud words are deleted when the session closes; the themes drawn from them are kept for 12 months, along with display names, invitation emails and the session pack. Session feedback — which the tool cannot link to your name, though it is held with the session — is kept for 24 months.
• Post-session feedback form: responses in Tally are kept for 24 months and then deleted, along with any name or email address you chose to give.
• Course enrolment and completion records: 6 years from the end of the tax year in which your enrolment ends. This is the commercial record of who enrolled and when, kept because UK law allows contract claims to be brought for six years and HMRC requires business records for the same period. It is not your course content or your answers. LearnWorlds holds its own copy of your course records under its own terms.
• WhatsApp messages: 12 months after we last exchanged messages, or 3 months after you tell us you're not interested or the enquiry closes. If you join a course, for as long as you're on our waiting list or course records. See section 2j.
• Waiting list and marketing: if you join the waiting list and don't go on to create an account, we delete your details 24 months after you joined. If you do create an account, your waiting-list entry is covered by the account retention above instead. If you unsubscribe at any point, we act on that straight away. In every case we then keep one minimal record — just enough to recognise your address so that we don't contact you again by mistake — and nothing else. That record is never used to market to you: it exists to make sure we don't contact you again.
• Quality and telemetry data: operational retention; snapshot data older than 90 days is deleted automatically.
• Server logs: our server logs record identifiers, counts and the address of each request so that we can diagnose faults — never your writing, and not your name or email address. The address of a one-time join link includes that link’s single-use code, which stops working as soon as it is used. Our hosting providers keep these logs for a short period under their own terms.

7. Who can see your data

Your data is encrypted in transit, and access to it is restricted to the people who need it to run the service.

Who can see your account. A small number of administrators can open your account and see what you can see about yourself: your account details, how much you have practised, when you were last active, the ratings you have given, and which friction categories show up in your writing. Those figures are produced by the same code that builds your own progress page — so an administrator cannot see more about your progress than you can.

What they cannot see. They cannot read the writing you submit for feedback: we do not store it, so no one — not even you — can see it again. If you download a PDF of your writing and feedback, that is stored on your own machine and not on our servers.

Why. This is for account support and to keep the service running properly. Administrators sign in the same way you do, with a one-time code.

8. Your rights

Under UK data protection law you have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time (this doesn't affect processing before withdrawal). These rights cover everything in this policy, including data held on our behalf by the services at section 4 — you exercise them with us, and we handle it from there.

Deleting your account. You can delete your Coach account yourself, from your account settings. We ask you to confirm deliberately, because of what happens next: your account closes immediately, and everything described at section 6 is permanently deleted 30 days later. During those 30 days you can sign back in and pick up where you left off. After them, it is gone and we cannot recover it.

For anything else — access, correction, portability, or a question about any of this — contact us at privacy@thebusinesswritingclub.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

9. Children

The service is intended for adults and is not directed at people under the age of 18.

10. Changes to this policy

We may update this policy; we'll post the new version here and update the effective date. If a change is significant, we will tell you by email.

If either of our AI providers states an intention to begin using API data — that is, your writing — to train their models, we will stop using that provider in advance of that change, rather than telling you about it afterwards.

11. Contact

Higher Capacity Ltd, Bartle House, Oxford Court, Manchester, England, M2 3WQ. Email: privacy@thebusinesswritingclub.co.uk.

Published at https://thebusinesswritingclub.co.uk/privacy · Effective 6 October 2026