Privacy Notice

Whole and Driven (trading as Whole & Driven), a sole proprietorship based in the State of Texas, United States, is the data controller for the personal data described in this notice, and decides how and why it is processed.

You can reach us with any privacy request at contact@wholeanddriven.com, or through the Contact page on this site.

Account data (name or display name, email address, city, timezone, preferences): to create and operate your account. Authentication credentials are handled securely by our authentication provider — we never receive or store your raw password. Legal basis: performance of our contract with you.

Platform activity (assessment responses, course and lesson progress, habit logs, challenge participation, community posts, work logs): to deliver purchased content, track progress, and personalize recommendations. Legal basis: performance of our contract with you.

Journal entries and reflections, which are private to your account: to provide the journaling feature. Legal basis: performance of our contract with you.

Support messages and contact-form submissions: to answer your questions. Legal basis: our legitimate interest in supporting customers.

Usage and technical data (device identifiers, IP address, log and telemetry data): to keep the platform secure, prevent fraud and abuse, and improve the product. Legal basis: our legitimate interests in security and product improvement.

Marketing email address and consent records: to send The Weekly Build and other marketing email. Legal basis: your consent, which you can withdraw at any time via the unsubscribe link in every message.

Order records (plan, tier, subscription status, billing period, and the identifiers our payment provider returns): to grant and maintain your membership entitlements. Legal basis: performance of our contract with you and compliance with our legal obligations. We never receive or store full payment-card details.

So the team can run the platform, our systems send internal notifications to the site owner when someone creates an account, submits the contact form, subscribes to the newsletter, applies to Elite, or when a subscription starts, fails, or is cancelled. These notifications contain only operational details such as your name, email address, plan, and the fact an event happened.

We never include private journal entries, assessment reflections, lesson work logs, or passwords in those notifications, and we keep a delivery log of the notifications we send so we can confirm the system is working. Legal basis: our legitimate interest in operating and supporting the service.

Whole and Driven is the seller of its memberships. Stripe securely processes payments and provides our billing infrastructure, including subscription management, invoicing, and the customer billing portal. Stripe is not the merchant of record for our orders.

When you purchase a membership, Stripe collects and processes the personal and payment data needed to take payment, manage your subscription, and issue invoices. We never receive or store your full card number. Stripe's handling of that data is described in Stripe's privacy policy at stripe.com/privacy.

We share your email address and an internal account identifier with Stripe so a purchase can be matched to your account.

Service providers and subprocessors acting on our instructions: Supabase (database, authentication, and file storage), Cloudflare (hosting and content delivery), Stripe (payment processing and billing), Resend (transactional and newsletter email delivery), and Google (optional Google sign-in).

Stripe, our payment processor, for taking payment, subscription management, invoicing, and tax calculation where configured.

Professional advisers such as legal and accounting professionals, where necessary.

Authorities or regulators where we are legally required to disclose information.

We do not sell your personal data.

Journal entries, assessment answers, habit logs, and progress data are restricted to your account by database-level security policies.

There is no routine administrative interface for browsing private journal content.

Account, progress, journal, and assessment data is retained for as long as your account is active, and for up to 12 months after you close it, so you can reactivate. After that it is deleted or anonymised.

Marketing subscription and consent records are retained until you unsubscribe, and for up to 24 months afterwards as proof of consent.

Support and contact messages are retained for up to 24 months.

Security, log, and telemetry data is retained for up to 12 months.

Order and tax records are retained for as long as required by law, typically 7 years.

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time.

You can update your profile, change email preferences, unsubscribe from marketing, and request account deletion from Account Settings, or contact us and we will respond within one month.

If you are in the UK or EEA, you also have the right to complain to your local supervisory authority. Where data is transferred outside the UK or EEA, we rely on adequacy decisions or Standard Contractual Clauses as safeguards.

We apply appropriate technical and organisational measures, including encryption in transit, row-level database access controls, restricted administrative access, and least-privilege service credentials.

We use essential cookies and local storage to keep you signed in and to keep the platform secure. These are required for the service to work.

Where analytics or marketing cookies are used, they are optional and you can manage them through your browser settings or the cookie controls presented on the site.