Privacy Policy

The data controller is Esperance Brooks, trading as Build & Ship Academy ("we", "us", "our"). For any privacy question, contact esperancebrooks@buildandship.academy.

We collect only what we need to deliver the mentoring service and exam packs:

• Account data: name, email address, hashed password (or social sign-in identifier), and profile preferences (e.g. target role).
• Intake & booking data: the kickoff date you choose, your initial message, the bundle you select, your CV file, and any answers you provide to follow-up questions.
• Workflow content: messages exchanged in your private workflow, plan drafts, and any notes attached to your booking.
• Waitlist data: email, optional name and message if you submit the waitlist form.
• Payment metadata: amount, currency, status, and a transaction reference returned by our payment processor. We do not store full card numbers, CVCs, or bank details.
• Technical data: minimal logs (IP address, user agent, request timestamps) used to keep the service secure and reliable.

Under UK GDPR, every use of your data has a lawful basis:

• To deliver the service (review your CV, write your plan, run sessions, give exam-pack access) — performance of a contract.
• To process payments through our payment provider — performance of a contract.
• To send transactional emails (account confirmation, plan delivery, booking reminders, password resets) — performance of a contract.
• To respond to waitlist enquiries — legitimate interest in following up on your request, with the option to ignore or remove your entry.
• To keep the service secure (rate-limiting, abuse detection) — legitimate interest.
• To meet tax and accounting obligations — legal obligation.

We do not run advertising profiling, we do not sell your data, and we do not feed your personal materials into third-party AI training datasets.

AI tools may be used internally to help draft questions, summarise notes, and prepare plan drafts. These tools operate on a no-training basis: prompts and completions are not used to train third-party models. Final plans are written and approved by Esperance personally before they reach you. We do not share your CV, messages, or workflow content with anyone outside this engagement.

We use a small number of trusted providers to run the service. They process data on our instructions only:

• Hosting and database: our cloud backend provider, which stores your account, workflow, and uploaded files in encrypted form.
• Payments: our payment processor, which handles card details directly so we never see them.
• Email delivery: a transactional email provider used for account, booking, and plan-delivery emails.
• AI tooling: AI gateways operating under no-training agreements for drafting assistance, as described above.

We disclose data to authorities only when legally required (e.g. valid court order, tax investigation).

Some sub-processors may store or process data outside the UK or EEA. Where that happens, transfers are protected by UK adequacy regulations, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum.

• Account & profile: for as long as your account is active. If you ask us to close it, we delete it within 30 days, except where retention is required by law.
• CV uploads: kept for the duration of the engagement; deleted on request, or automatically 12 months after the last activity on your account.
• Workflow messages and plans: kept while your account is active; deleted when you close your account.
• Waitlist entries: kept until we contact you, you ask to be removed, or 24 months pass without a response, whichever comes first.
• Payment, tax and accounting records: retained for at least 6 years to meet UK statutory obligations.
• Security logs: retained for up to 90 days.

You have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete your data, subject to legal retention obligations (e.g. invoices).
• Object to or restrict processing where we rely on legitimate interest, and withdraw any consent you have given.
• Receive a portable copy of the data you have provided.
• Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) if you believe we have mishandled your data.

To exercise any of these rights, email esperancebrooks@buildandship.academy. We respond within one calendar month.

Data is encrypted in transit (TLS) and at rest. Database access is gated by row-level security so each mentee can only see their own records, and admin access is limited to a single account protected by strong authentication. CV files live in a private storage bucket that is not publicly readable.

We use only the cookies and local storage strictly necessary to keep you signed in and to remember session preferences. We do not use third-party advertising cookies, and we do not load cross-site tracking scripts.

The service is intended for working professionals and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has submitted data, contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-product notice at least 14 days before they take effect. The date at the top of this page always reflects the current version.

Questions, requests, or complaints about your data? Reach us at esperancebrooks@buildandship.academy.