Privacy Policy

1. Who we are

Horrible Brands Ltd, Company No. NI712158, VAT No. 463 6633 75 ("we", "us", "our").
Contact: hello@horriblebrands.com

We are the data controller for personal data you provide when using this service.

2. What data we collect and why

Account data

Your email address, used to identify your account, send plan-related emails, and weekly action reminders. Lawful basis: contract performance and legitimate interests.

Question answers

Your responses to the 15 onboarding questions are stored and used to generate your 90-day plan. They remain accessible to you in your dashboard. Lawful basis: contract performance.

Plan and progress data

Your generated plan, weekly task completions, and monthly feedback responses are stored to deliver the service and show your progress over time. Lawful basis: contract performance.

Voice transcription

When you use the optional voice recording feature on question pages:

• Your audio is recorded in your browser and sent over an encrypted connection to our servers.
• We forward the audio to OpenAI's Whisper API for transcription into text only. We do not use OpenAI for any other purpose in this context.
• We do not store your audio recording. Once transcribed, the audio is discarded.
• The resulting text transcript is stored as part of your question answer, exactly as if you had typed it.
• OpenAI does not retain audio data beyond the duration of the API request and does not use API inputs to train its models by default. See OpenAI's API data usage policy.

Lawful basis: consent (you must explicitly agree before your first recording). You can withdraw consent at any time by not using the voice feature — transcripts already produced remain stored as part of your answers and can be deleted on account closure.

OpenAI, L.L.C. acts as a data processor on our behalf. Data is processed in the United States. Standard contractual clauses apply via OpenAI's Data Processing Addendum.

Payment data

Payments are processed by Stripe. We do not receive or store your card details. Stripe's privacy policy governs payment data handling.

3. Sub-processors

We use the following third-party services to deliver the product:

Processor	Purpose	Location
Anthropic, PBC	Plan generation (Claude AI)	USA
OpenAI, L.L.C.	Voice transcription (Whisper API)	USA
Neon, Inc.	Database hosting	EU (London)
Stripe, Inc.	Payment processing	USA
Resend, Inc.	Transactional email	USA

All US-based processors operate under standard contractual clauses or equivalent transfer mechanisms.

4. Data retention

• Account and plan data — retained for the lifetime of your account, then deleted within 30 days of account closure.
• Voice transcripts — retained as part of your question answers for the lifetime of your account. Audio recordings are never stored.
• Payment records — retained for 7 years as required by UK tax law.
• Email logs — retained for 90 days for deliverability troubleshooting.

5. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of your personal data.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data (subject to legal retention obligations).
• Portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to restrict processing in certain circumstances.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent (e.g. voice transcription), withdraw it at any time.

To exercise any right, email hello@horriblebrands.com. We will respond within 30 days.

If you are unsatisfied with our response, you may lodge a complaint with the Information Commissioner's Office (ICO).

6. Cookies and local storage

We use a session cookie for authentication (strictly necessary — no consent required). We use localStorage to remember your voice recording consent preference in your browser. No analytics or advertising cookies are set.

7. Changes to this policy

We will notify active users by email of material changes. The "last updated" date above will always reflect the current version.