Privacy Policy
Last updated: 21 September 2026
This policy explains what Beyond Amazing Limited collects when you use thebavault.com, why, who sees it, and the rights you have over it. It covers the Vault only; beyondamazing.co.uk has its own policy.
Who is responsible
Beyond Amazing Limited, company number 12713196, registered office Office One, 1 Coldbath Square, Farringdon, London EC1R 5HL, is the data controller. We are registered with the Information Commissioner's Office, registration ZC176270. For anything about your data, use the form at beyondamazing.co.uk/contact.
What we collect
When you take a free diagnostic: your email address, the topic, your answers and the pattern the diagnostic gives you.
When you buy or join: your name and email address, what you bought, when, and the Stripe identifiers that connect your account to your payment. Card details go to Stripe and never reach us.
When you use the Vault: which courses you open, queue and bookmark; which modules you complete and when; your before-and-after baseline answers; your journal entries, reflections and exercise answers; what you say to the coach and to Joe, and what they say back; certificates you earn; and technical records of your sessions (login times, the device and browser you use).
When you email us or use the contact form: what you send.
We collect all of this from you. We do not buy data about you or build profiles from other sources.
Why, and on what basis
| What we do | Data | Lawful basis |
|---|---|---|
| Run your account and deliver what you bought | Account, purchase and usage data | Performance of a contract |
| Give you the coach and Joe | Your messages, your written work, your progress | Performance of a contract |
| Send you the diagnostic result and the emails that follow it | Email address, topic, pattern | Consent, given when you enter your email; unsubscribe at any time |
| Send members service emails (Keys issued, renewals, changes to terms) | Name, email, membership status | Performance of a contract |
| Send you our newsletter and occasional offers | Name, email | Consent, or legitimate interests for existing customers; unsubscribe at any time |
| Keep accounting and tax records | Purchase records | Legal obligation |
| Show a corporate buyer whether their seats are being used | Activity and progress, never content | Legitimate interests of the buyer and of us; set out in the corporate agreement |
| Keep the site secure and working | Technical session records | Legitimate interests |
The AI coach and Joe
To answer you, the coach and Joe send your message, the relevant course material and the relevant parts of your recent work to Anthropic, the company whose AI model we use, through its API. Anthropic processes it to generate the reply and does not use it to train its models. We keep the conversation so the coach can remember it and so you can read it back. Please keep other people's personal information out of it.
Who else sees your data
We do not sell it. It is processed by the providers that run the Vault, each bound by contract to keep it secure: Supabase (database and login, hosted in London), Stripe (payments), Cloudflare (hosting and video), Kit (email), Anthropic (AI responses), and Plausible (analytics, which uses no cookies and does not identify you). Our accountants see purchase records. A regulator or court sees what the law requires.
Outside the UK
Stripe, Cloudflare, Kit, Anthropic and Plausible process some data outside the UK. Where they do, the transfer is covered by UK adequacy regulations or the International Data Transfer Agreement, so your data has the same protection it has here.
How long we keep it
Your account and everything in it: for as long as you hold an account, and for 12 months after a membership ends in case you rejoin, then deleted. Ask sooner and we delete sooner, except the records below. Diagnostic results with no account: 24 months, then deleted. Purchase and tax records: six years, as UK tax law requires. Email marketing data: until you unsubscribe.
Cookies
The Vault sets the cookies it needs to keep you logged in and to keep the site secure. Nothing else. Our analytics tool, Plausible, works without cookies and does not track you across sites.
Your rights
You can ask for a copy of your data, have it corrected, have it deleted, restrict or object to how we use it, take it elsewhere, and withdraw consent where consent is the basis. You have an absolute right to stop us using your data for marketing. To use any of these rights, contact us through the form above. We answer within a month. If you are unhappy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes
We change the date at the top when we update this policy, and email members about any change that affects them.