What we collect, why we collect it, and what we do not collect. This describes the service as it works today.
About this policy
This policy explains what personal information The Circl collects and how it is used. It describes the service as it works today. When new services launch, this policy will be updated and republished with a new version and date before those services collect anything new.
Information you give us
When you create a member account we collect your name, email address, date of birth and, if you provide it, your phone number. Your password is stored only as a secure irreversible hash — we never store or see it in readable form.
We record which published version of our Terms of Use and this Privacy Policy you accepted, and the date you accepted them.
If you are under 18
A member under 18 may optionally name a trusted adult contact: their name, relationship to you, phone number and, if given, email address. You can add, change or remove it at any time, and you can decline to provide one.
This is not parental or guardian consent, it is not verification of legal guardianship, and it does not let that person access your account or see what is shared in your circle. We would use it only if there were a serious concern about your wellbeing.
If you apply to be a facilitator
Facilitator applications collect professional information: your name, email, phone, country and city, your specialisation and current role, years of experience, workplace, a short biography, why you want to join, and optional LinkedIn and website links. You upload a CV and may upload a qualification document.
Uploaded documents are stored on private storage and are visible only to The Circl review team — never publicly addressable. The documents of a rejected application are automatically deleted after a retention period; the application record, the reviewer and the decision are kept.
Approved facilitators additionally hold a professional profile: display name, professional title, biography, years of experience, licence number, qualifications, areas of expertise and languages.
Information we generate
- The IP address a facilitator application was submitted from, used to
investigate abuse of the public form.
- Short-lived, hashed tokens for password reset and first-time account
activation, together with the number of attempts made.
- Standard session information, including a session cookie and your chosen
language.
Information from using the service
As services have launched, the following are now stored against your account:
- Bookings and enrolments — the programmes and support group sessions you
reserve or confirm a place on, and the run they belong to.
- Membership records — your membership periods and their start and end
dates, where you hold a membership.
- Payment records — for each manual transfer you make: a payment reference,
the method you chose, the amount and currency, the status of our review, and the receipt image you upload. We do not store card numbers, and we do not hold a payment method on file.
- Guidance written for you — private notes a facilitator or an administrator
writes for you, and post-session guidance shared with everyone who attended a session you were confirmed on.
- Mood check-ins — the mood you select and any reflection you choose to
write with it.
- Journal entries — the title, text, chosen mood and any photographs you
add to a journal entry, together with whether you marked it a favourite.
- Messages you send us — contact form submissions and corporate enquiries,
where you submit them.
Your journal entries are private to your account: they are not shown to other members, to facilitators or to administrators through the service.
What we still do not collect
The Circl does not collect or store card or bank account numbers, marketing or newsletter subscriptions, attendance records, advertising identifiers, or location data. Some pages in your account still show examples for services that are not yet live; where that is the case the page says so.
How we use your information
We use your information to create and secure your account, to provide the service, to review facilitator applications, to communicate with you about your account, and to meet our legal obligations.
Requires legal review: the lawful basis for each purpose, and the applicable data-protection regime across the countries we serve.
Service providers
We rely on service providers to host the platform and deliver email. They process information only as needed to provide those services.
Requires legal review: the named providers and any transfer of information between countries.
Security
Passwords are hashed. Reset and activation tokens are hashed, short-lived and attempt-limited. Facilitator documents are held on private storage behind authentication. Administrative access is limited and role-based. No service can promise perfect security, and we do not claim to.
How long we keep information
Account information is kept while the account exists. The documents of a rejected facilitator application are deleted automatically after a retention period.
Requires legal review: retention periods for the remaining categories.
Your rights and contacting us
You can ask us about the information we hold, ask for a correction, or ask us to close your account. Use Contact Us to reach us.
Requires legal review: the specific statutory rights that apply, and the identity of the data controller.
Changes to this policy
Each publication of this policy creates a new dated version. The version shown on this page is the current one.