LEGAL · PRIVACY POLICY
Privacy policy
Last updated 22 October 2026
The short version: we use your details to sell you a course, send your access and answer your questions, and we keep a short journal of visits to keep the site safe. We use no analytics or advertising tools and we do not sell personal data.
1 Who is responsible for your data
The controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 is THE MOONSHOT MASTERY ACADEMY LTD, company number 15861511, registered office 3 Fistral Mews, 48 Tower Road, Newquay, Cornwall, TR7 1LU. For anything in this policy, email hello@moonshotmasteryacademy.co.uk.
2 What we collect, why, and on what basis
We collect what you type into the checkout or the chat, and the technical details your browser sends with every request. The table sets out each use, the lawful basis under Article 6 of the UK GDPR, and how long we keep the data.
| What and why | Lawful basis | Kept for |
|---|---|---|
| Checkout details: first and last name, email address, billing address and country. Collected on our site and passed to our payment service provider so it can take payment, and used to send your access details. | Contract | As part of the order record (below) |
| Order records: the courses ordered, prices, order reference, date and status, and the checkout details above. | Contract; keeping them afterwards is a legal obligation | Six years after the end of the financial year of the order, for tax and accounting records |
| “Remember me” cookie: your checkout details stored on your own device, only if you tick the box at checkout. | Consent | 180 days, or until you untick the box at your next checkout or clear your cookies |
| Chat: your messages, any files you attach, your email address if you choose to give it, the page you were on when you wrote, and a random identifier for the conversation. Used to answer you. | Legitimate interests in answering the questions you send us | Deleted 12 months after the last message in the conversation |
| Visits journal: time of the request, IP address, any forwarded IP address, country, page requested, referring page and browser description. Used for security and fraud prevention. | Legitimate interests in keeping the site and its customers secure | 90 days, then deleted automatically |
Where we rely on legitimate interests, we have weighed them against your rights: the data is limited, used only for the stated purpose, and deleted on schedule. You can object at any time (section 6). You do not have to give us your details, but we cannot sell you a course without the checkout details. The chat works without an email address.
3 Who receives your data
We share personal data only with these kinds of recipient, and only what each needs:
- Our payment service provider, the merchant of record for each sale, which receives your checkout details and the order, and collects your card or wallet details itself on its secure page. Its own privacy notice applies to the payment.
- Our hosting provider, which stores the website, order records, chat and visits journal on our instructions.
- An IP location service, which receives IP addresses from the visits journal, and nothing else, so it can tell us the country of a visit.
- The stock-photo library’s content delivery network, which serves the photographs on our pages. Your browser fetches them directly, so it sees your IP address.
- jsDelivr, the icon content delivery network that serves the payment-method icons, and the web-font service that serves our typefaces. Both see your IP address for the same reason.
- Professional advisers and public authorities, where we need help with our records or the law requires us to disclose information.
We do not sell personal data, share it for advertising, or make decisions about you by automated means alone.
4 International transfers
Some of these recipients may process data outside the United Kingdom. Where they do, the transfer relies on UK adequacy regulations for that country or, where there are none, on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Ask us if you would like details of the safeguard for a particular transfer.
5 Keeping data safe
The site is served over an encrypted connection; order records, chat files and the visits journal sit in storage that cannot be reached from the web; and our support desk is open only to signed-in staff. Your order page has a long, unguessable address: anyone with that address can see the order, so keep it to yourself.
6 Your rights
Under the UK GDPR you can ask us for a copy of the personal data we hold about you, and ask us to correct it, erase it, or restrict how we use it. You can object to uses based on legitimate interests, ask for data you gave us in a portable format where we use it under contract or consent, and withdraw consent at any time without affecting what happened before.
Email hello@moonshotmasteryacademy.co.uk to use any of these rights. There is no charge; we may need to confirm who you are, and we reply within one month. Some rights are limited: for example, we must keep order records for the period in section 2.
7 Complaints
If you are unhappy with how we have used your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk.
8 Changes to this policy
We update this policy when the way we use personal data changes; the date at the top shows the latest version. Cookies are described in more detail on the cookies page.