1. Who is responsible

The data controller and operator of the Service is Madam Malevolent (trading name), associated with madammalevolent.co.uk.

Privacy contact: privacy@sssexposed.co.uk. Any other Boot Camp request: queries@sssexposed.co.uk.

2. Our commitments to you

• We do not sell your personal data to third parties.
• We will not use your student data maliciously, for blackmail, doxxing, or public exposure against you.
• We use your data only to deliver and administer the course, to provide customer support, and to meet legal obligations (for example tax, accounting, or responding to lawful requests).

3. What data we collect

Depending on how you use the Service, we may process:

• Account data — email address, optional display name, and a hashed password (we do not store your password in plain text).
• Orders and licence data — order records (tier, amount, currency, status, provider identifiers), email used at checkout, and licence tokens used to unlock access.
• Course progress — which lessons you mark complete and assignment completion status.
• Journal content — journal titles and text, plus any private file uploads (documents, images, or videos) you attach as evidence.
• Conduct acceptance — when you accept the Code of Conduct & Submissive Contract.
• Technical / session data — a session cookie that keeps you signed in (see Cookies below). Hosting providers may also process standard server logs (for example IP address and request metadata) as part of running the site securely.

4. Journals and privacy by tier

• Self-led — journals and attachments remain private to you (the student). They are not reviewed as part of Goddess feedback.
• Goddess-led — journals and attachments may be reviewed by Madam / the course administrator so feedback can be given. That is part of the Goddess-led service you purchase.

Do not upload content involving minors or non-consenting parties. The Service is adults only.

5. Why we process your data (lawful bases)

• Contract — to create your account, take payment (via payment providers), issue a licence, deliver course content, track progress, and (for Goddess-led) review journals and provide feedback.
• Legitimate interests — to keep the Service secure, prevent abuse, improve reliability, and administer the platform in a way that does not override your rights.
• Legal obligation — where we must keep records for tax, accounting, or other legal requirements.

6. Payments

Card payments are processed by Stripe. We do not store your full card details on our servers. We keep order identifiers, status, amounts, and related checkout/payment references needed to fulfil your purchase and support you if something goes wrong.

Stripe processes payment data under its own privacy terms. Please also read Stripe's privacy notice for how they handle card data.

7. Who we share data with (processors)

We use trusted service providers to run the Service. They process data on our instructions, not to buy or sell your student data:

• Vercel — website hosting and related infrastructure (including private Blob storage for journal uploads where enabled).
• Neon — Postgres database hosting for accounts, orders, licences, progress, journals, and related records.
• Stripe — payment processing.

We may also disclose information if required by law, a court, or a regulator, or to protect rights, safety, and the integrity of the Service.

8. Cookies

The Service uses a necessary session cookie named fbc_session to keep you signed in after login. It is an HTTP-only cookie (not accessible to JavaScript in the browser), set with SameSite=Lax, marked Secure in production, and lasts about 14 days (or until you log out).

We do not currently use marketing or advertising cookies on the Boot Camp site. Stripe Checkout may set its own cookies when you pay on Stripe's pages — those are governed by Stripe.

9. How long we keep data

We keep account, progress, journal, and licence data while your account is active and as needed to provide the Service. Order and payment-related records may be kept longer where required for accounting or legal purposes. If you ask us to delete your account, we will erase or anonymise personal data we no longer need, unless we must retain it by law.

10. International transfers

Some providers (for example hosting or payment infrastructure) may process data outside the UK. Where that happens, we rely on appropriate safeguards offered by those providers (such as standard contractual clauses or equivalent transfer tools) together with their security measures.

11. Your rights (UK GDPR / DPA 2018)

Subject to the law, you may have the right to:

• access your personal data;
• correct inaccurate data;
• request erasure;
• restrict or object to certain processing;
• data portability (where applicable);
• withdraw consent where processing is based on consent.

To exercise these rights, email privacy@sssexposed.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk.

12. Security

We use reasonable technical and organisational measures appropriate to an adult education platform, including hashed passwords, authenticated access controls, and (where enabled) private storage for journal uploads with authorised download only. No online service can guarantee perfect security; please choose a strong unique password and keep your login private.

13. Children

The Service is strictly 18+. We do not knowingly collect personal data from anyone under 18. If you believe a minor has registered, email privacy@sssexposed.co.uk and we will take steps to remove the account.

14. Changes

We may update this Privacy Policy from time to time. The “Last updated” date above will change when we do. Continued use of the Service after an update means you should review the revised policy.

15. Related documents

See also our Terms of Use.