How we use and protect personal information.

Effective 6 September 2026

Information we collect and why

Public website, enquiries and training applications

We receive the information a person enters into a general enquiry or training application, including contact details, the enquiry type and message, relevant experience, training interests and practical preferences. We use it to assess the request, reply, administer an application and keep a necessary record of the conversation. These forms should not contain medical information or identifying details about a client.

Membership and the private forum

We use account and membership information such as a member's name, email address, login and security records, practitioner status, approval state, roles, profile information, forum activity and membership history. This is needed to review applications, provide the requested service, control access, support members, moderate the community and protect the forum.

Payments

Stripe handles checkout, payment methods, invoices and subscription management. We receive billing identifiers and information needed to recognise the selected plan, payment status, billing period, cancellation state and entitlement. We do not receive a full card number through the KPA website or forum.

Birth details and monthly PDFs

A member who uses the monthly birth-chart PDF benefit may provide a date, time and place of birth. We use those details to calculate, prepare and deliver the personalised PDF, maintain the member's chosen birth profile and respond to related support requests. Birth details are not used to decide KPA practitioner eligibility, set a price or advertise to the member.

KPA knowledge assistant

When an authorised member chooses to use the KPA knowledge assistant, their question, conversation context and relevant KPA source extracts are sent to OpenAI to prepare a response. Members must not include a client's name, contact details or other information that could identify a client. OpenAI is used only for content submitted to the assistant; using another KPA service does not by itself send that service's information to OpenAI.

Technical and security information

Our hosting services may process an IP address, browser and device information, request time, page or endpoint requested, and security events. We use this information to deliver the services, diagnose faults, prevent abuse and protect accounts. The public site does not currently use advertising trackers.

Our lawful bases

• Contract and steps before a contract: to consider an application, provide membership, manage a subscription, deliver Academy content and prepare a requested monthly PDF.
• Consent: to publish an optional practitioner profile or client review, and where another optional use clearly asks for consent. Consent can be withdrawn for future use.
• Legitimate interests: to respond to general enquiries, operate and improve the services, moderate content, prevent fraud and misuse, maintain security, resolve complaints and keep proportionate audit records. We consider the effect on the people involved before relying on this basis.
• Legal obligation: where information is needed for accounting, tax, consumer protection, regulatory or other legal duties.

We do not use birth-chart content or the KPA knowledge assistant to make a solely automated decision with legal or similarly significant effects about membership eligibility or forum access.

Public profiles, events and reviews

Practitioners appear only after choosing to publish a profile and after KPA approval. The public profile may contain a name, photograph, practitioner level, biography, broad service area, languages and selected professional or social links. Precise home addresses, payment information, private forum activity and internal account details are not included in the public directory feed. Public event listings may show the organiser's public practitioner name, event details, broad location and booking link.

A practitioner may also choose to publish a link to their Google reviews page. KPA checks the destination as part of profile approval, but the reviews and the destination service are provided by Google under Google's own terms and privacy information.

A submitted client review is kept private while a KPA administrator checks it. If approved, the reviewer's chosen display name, one-to-five-star rating, review text, selected practitioner and approval date are published. An optional email address is kept private and used only if KPA needs to discuss the review. Reviewers can ask for their review to be removed through the contact page.

Who processes information for us

• Stripe provides checkout, subscription billing and the customer billing portal.
• Replit provides hosting used by the KPA member forum and its supporting services.
• Cloudflare and OpenAI Sites provide delivery, hosting and security services for the public website.
• OpenAI processes the content needed to provide the KPA knowledge assistant when an authorised member uses it.

These providers receive only the information needed for their role and may use approved sub-processors. We may also disclose information where the law requires it, to protect legal rights, or during a properly managed business reorganisation.

International transfers

Some service providers or their sub-processors may process information outside the UK. Where UK data protection law requires a transfer safeguard, we use an applicable adequacy regulation, contractual protection such as the UK International Data Transfer Agreement or UK Addendum, or another lawful safeguard. Contact us to ask about the safeguard relevant to a particular provider.

How long we keep information

We keep personal information only for as long as it is needed for the purpose described, then delete or de-identify it unless a legal, safeguarding, dispute or security reason requires a longer period. The criteria used for each main category are:

• Accounts, membership and forum records: while the account or membership is active and afterwards for the period reasonably needed to close the account, answer queries, enforce standards and resolve disputes. Essential moderation, security and audit records may be retained for longer where necessary.
• Payment and accounting records: for the period required by applicable accounting, tax and fraud-prevention rules, which may continue after membership ends.
• General enquiries and training applications: until the enquiry or intake has been handled and for a reasonable follow-up and complaint period. If the person becomes a trainee or member, relevant information may become part of that relationship's record.
• Public practitioner profiles and events: while the person remains eligible, has consented and the listing remains current. Internal approval and audit records may remain where needed to explain a publication decision.
• Client reviews: while pending moderation and, if approved, while published. Private contact details are kept only as long as needed to verify or handle the review, complaint or removal request.
• Birth details and generated PDFs: while needed to provide the chosen membership benefit and any related support, or until the member asks us to delete the birth profile, subject to a short period needed to complete an open request or dispute.
• Technical logs: for the shortest operational period reasonably needed for reliability and security, with a longer period only when investigating an incident or legal claim.

Your data protection rights

Depending on the circumstances, a person may ask for access to their information, correction, deletion, restriction, or a portable copy, and may object to certain uses. These rights are not absolute and we may need to verify identity before responding. Where processing is based on consent, consent can be withdrawn at any time without affecting earlier lawful use.

Questions and complaints

Please contact us first so we can try to resolve a concern. You also have the right to complain to the UK Information Commissioner's Office through its complaints service.

Changes to this notice

We may update this notice when the services, providers or legal requirements change. The effective date above shows the current version. We will bring a material change to members' attention through an appropriate service message or contact route.