Privacy Policy

WAIRLE ("we", "us") is the data controller for the personal data we collect when you visit our website, join our email list, or create an account and use the service. This policy explains what we collect, why, who processes it on our behalf and the rights you have.

What we collect

• Account and profile: your name, email address and credentials; the profile details you choose to give (age range, unit system, time zone, an optional reason for joining and personal goal); your display and email preferences.
• Diagnostic data: your responses to the assessment instruments and the scores derived from them for every run — Day 0 baseline, Day 15 re-test, spot checks and full audits — together with the protocol timeline (baseline lock, initiation, re-test) and any experiments you record.
• Consents: a record of each acceptance of the Terms, Privacy Policy, Health Disclaimer and Safety and Liability Waiver, with its version and date, and of the acknowledgements you give inside the Laboratory.
• Payments: if you pay for initiation or the Permanent Operator subscription, our payment processor (Stripe) handles your card details — we never receive or store card numbers. We hold the transaction reference, amount, currency, date and subscription status.
• Messages and emails: support messages you send us, and a record of the service emails we send you (verification, protocol reminders, billing and account notices).
• Email list: if you enter your email address in the access-link window on our homepage (shown on phones), your address; when and where you gave your consent and the version of the wording you were shown; and a record of the emails we send you and of any unsubscribe. You do not need an account to join the list, and joining it does not create one.
• Technical data: the strictly necessary data needed to keep you signed in and protect the service, and your answer to the cookie banner. Only if you select ACCEPT in that banner: for advertising measurement, the pages you view, the page you arrived from, your IP address and basic browser and screen details; and for behaviour analytics, how you use each page — clicks, scrolls and mouse or touch movements — with your device and browser type and an approximate location (see the Cookie Policy).

Why we use it

• To provide the Laboratory — your baseline, protocol, re-test, Results Dashboard, Field Journal and Library — and to authenticate you and keep your account secure.
• To take payment, manage the subscription and issue receipts through Stripe.
• To send service emails: email verification, protocol reminders and operational nudges (which you can switch off in System Configuration), and billing, account and legal notices.
• To send the access link you asked for from our homepage, and two follow-up reminders about starting the protocol in the days after. The reminders stop if you create an account with the same address, and we send the email list nothing else.
• To measure how well our advertising works, using the Meta Pixel, and to see how people use the site so that we can fix and improve it, using Contentsquare — both only if you select ACCEPT in the cookie banner (see the Cookie Policy).
• To answer support requests and to meet our legal obligations.

Our lawful bases are the performance of our contract with you and our legitimate interest in running the service securely. For the Meta Pixel and Contentsquare, for the email list and, where the law requires it, for optional emails, we rely on your consent. You can withdraw it at any time — for analytics cookies through the Cookie settings control in the footer, and for the email list through the unsubscribe link in every email — without affecting anything done before you withdrew. Assessment responses are used only to generate your own results; they are not sent to Meta or any advertising network, and Contentsquare does not run on the pages where you give them. WAIRLE is not a diagnostic tool and does not profile you for any other purpose.

Sharing

We do not sell your data. We share it only with the providers below, and only for the purposes set out in this policy:

• Hosting and database: our hosting and database provider, which runs the service and stores your data.
• Email delivery: Resend, which sends every email from WAIRLE — service emails and, if you join the email list, the access link and reminders.
• Payments: Stripe, which handles your card details and manages the subscription.
• Behaviour analytics: Contentsquare, only if you select ACCEPT in the cookie banner.
• Advertising measurement: Meta, through the Meta Pixel, only if you select ACCEPT in the cookie banner.
• Video: Vimeo, which plays the film on our homepage, or YouTube if we host the film there instead. When the video player loads, whatever you chose in the cookie banner, the provider receives your IP address and basic details of your browser, and handles them under its own privacy policy (see the Cookie Policy).

Our hosting provider, Resend, Stripe and Contentsquare are our processors: they act only on our instructions and are bound to protect your data. Meta is not, as explained below, and the video provider handles what it receives under its own policy. Some of these providers may process data outside the UK; where they do, it is protected by appropriate safeguards.

If you select ACCEPT, we use the Meta Pixel to measure our advertising. Each page view then tells Meta the address of the page, the address of the page you came from, your IP address, the _fbp cookie identifier and technical details of your browser and screen. Because the page address is included, it can show which parts of the Laboratory you visited. Meta decides for itself how it uses what it receives, and may transfer it outside the UK and EEA under its own safeguards. Until you choose, and if you select REJECT, the pixel does not load and Meta receives nothing from it. The pixel does not run on our staff administration pages.

We have deliberately turned off Meta's automatic collection features. With them on, the pixel would read the fields of any form you interacted with and the text of the buttons you clicked — which on this service would have meant your email address and your assessment answers. With them off, we do not send Meta your name, your email address, your assessment responses, your scores or your results, and we never will: it is enforced in our own code and covered by an automated test.

If you select ACCEPT, we also use Contentsquare (the company behind Hotjar) to see how people use the site, so that we can find what confuses them or breaks. It records the pages you view and your clicks, scrolls and mouse or touch movements, together with your device and browser type and an approximate location worked out from your IP address, and builds session recordings and heatmaps from them. Contentsquare uses the IP address only to work out that approximate location, to filter out unwanted traffic such as bots, and for short-term logging and troubleshooting, and deletes it within three days. Personal and health information shown in the Laboratory — such as your name, email address, answers, scores and results — is masked in your browser before a recording is sent, and nothing you type into a form field is recorded. Contentsquare does not run on our staff administration pages and, because even the position of a tap could show an answer, it does not run while you are taking an assessment or on the Fitness and Fuel Programmer pages. It acts only on our instructions.

If you choose to paste a generated prompt into a third-party AI service, that transfer is made by you and is governed by that service's own policy.

Retention

We keep your account data for as long as your account is active. When you delete your account, your personal data is removed from the service, including any email-list record under the same address; our payment processor retains its own transaction records for as long as tax and accounting law requires.

We keep an email-list record until you unsubscribe, separately from any account you create later. After that we keep only what we need to honour your choice and to show what you agreed to: your address, marked as unsubscribed, with the dates and a record of what we sent. We delete it entirely if you ask us to: your address, its consent details, the record of what we sent and any record that you unsubscribed. Contentsquare keeps analytics data and recordings for a limited period and then deletes them; Meta keeps what it receives under its own policy.

Your rights

You can export a copy of your data (JSON) and your Master Ledger (CSV), and delete your account, at any time from System Configuration. You may contact us through the Support Channel to access, correct or restrict the use of your data, or complain to your local data-protection authority.

You do not need an account to use these rights for the email list. Every email we send to the list has an unsubscribe link at the foot, which opens a page where you confirm, and most email apps also show an Unsubscribe button that works in one click; to see or delete your list record, contact us through the Support Channel. You can withdraw consent to analytics cookies at any time through the Cookie settings control in the footer, or the one at the end of the Cookie Policy.