Privacy Policy

This Privacy Policy explains how A Journey Ltd t/a AllWondrous ("AllWondrous", "we", "us", "our") collects and processes personal data when you use our platform as a Studio owner, practitioner, or team member. It applies to allwondrous.com and all associated services.

AllWondrous is the data controller in respect of personal data we process about Studios and their authorised users. We are a data processor in respect of client data that Studios process through our platform; in that case the Studio is the data controller.

01What Data We Collect

02How We Use Your Data

We process your personal data for the following purposes:

• •Providing and operating the AllWondrous platform under our contract with you.
• •Processing payments and managing your subscription.
• •Providing customer support.
• •Sending service-related communications, including account notices, invoices, and platform updates.
• •Improving and developing our platform through aggregated analytics.
• •Complying with legal obligations, including financial record-keeping and fraud prevention.
• •Marketing our services to you where you have opted in or where we have a legitimate interest.

03Legal Basis for Processing

We rely on the following legal bases under UK GDPR:

04Data Sharing

We share personal data only where necessary:

• •Stripe: For payment processing and Stripe Connect functionality.
• •Google Analytics: For platform usage analytics. Data is pseudonymised.
• •Email and SMS providers: For transactional communications.
• •Hosting and infrastructure providers (Vercel, Supabase): For platform delivery and data storage.
• •Legal and regulatory authorities: Where required by law, court order, or regulatory obligation.

05International Transfers

Some of our service providers may process data outside the UK or EEA. Where this occurs, we ensure appropriate safeguards are in place, including reliance on UK adequacy regulations, standard contractual clauses, or equivalent measures.

06Data Retention

When you close your account, we will make your data available for export for 30 days, after which it will be deleted from active systems. Backup copies may persist for up to 90 days.

07Your Rights

Under UK GDPR you have the following rights:

• •Access: Request a copy of the personal data we hold about you.
• •Rectification: Ask us to correct inaccurate or incomplete data.
• •Erasure: Request deletion of your data where we no longer have a lawful basis to hold it.
• •Restriction: Ask us to restrict processing while a dispute is resolved.
• •Portability: Receive your data in a structured, machine-readable format.
• •Objection: Object to processing based on legitimate interests.
• •Withdraw Consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email us at legal@allwondrous.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

08Security

We implement appropriate technical and organisational measures to protect personal data, including:

• •Encryption of data in transit (TLS) and at rest.
• •Row-level security and access controls on our database.
• •Restricted access to production systems on a need-to-know basis.
• •Regular security reviews and penetration testing.

No system can be guaranteed 100% secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO as required by law.

09Studio Client Data: Data Processing

When Studios use AllWondrous to process data about their own clients, AllWondrous acts as a data processor on the Studio's behalf. In this capacity:

• •We process client data only on the documented instructions of the Studio.
• •We maintain appropriate technical and organisational security measures.
• •We assist Studios in meeting their obligations under UK GDPR.
• •We delete or return client data at the Studio's request, subject to legal retention obligations.

A formal Data Processing Agreement is available to Studios and is incorporated into our Terms of Service.

10Cookies

We use cookies and similar tracking technologies on allwondrous.com. Please see our Cookie Policy for full details.

11Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice in your dashboard. The effective date at the top of this document will be updated accordingly.

12Contact