The Strategy Room
Privacy notice
Last updated 14 September 2026
We collect what we need to run your membership: your email, your billing status, and how you use the members area. Payments go through Stripe. We do not sell your data and we only send marketing if you opt in.
The details below explain what we collect, why, who helps us process it, and your rights.
1. Who is responsible for your data
Gefferie Limited (company number 11978425, registered office 62-66 Deansgate, Manchester, M3 2EN, United Kingdom) is the controller of the personal data described here. Contact us about privacy at dwayne@gefferie.com.
2. What we collect
Account
Your email address (your login), and sign-in records such as when you requested or used a login link.
Membership and billing
Your plan, subscription status, renewal and cancellation dates, and your Stripe customer ID. Stripe collects your payment details and billing name, address, and country. We never see or store your full card number.
Usage
Pages you visit on the site, sessions and recordings you view, resources you download, which session reminders we sent you, and your reminder preferences.
Live sessions
If you join a live session, the session platform processes your name, and anything you say, type, or show. Sessions are recorded and the recording is shared with members.
Team inquiries
Your name, work email, company, role, team size, when you would start, what the team wants from the room, and your marketing choice.
Communications
Emails you send us and our replies, and refund requests you make in the members area (including the reason you give).
Technical
IP address, browser and device type, and error details, collected in server logs, analytics, and error reports.
3. Why we use it and our lawful basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Run your membership: create your account, send login links, give access, deliver sessions, recordings, reminders, and service emails | Account, membership, usage, live session | Contract |
| Take payments, handle renewals, refund requests, and failed payments | Membership and billing, communications | Contract |
| Keep business, accounting, and tax records | Membership and billing | Legal obligation |
| Reply to team inquiries and support emails, and manage customer records | Team inquiry, communications | Legitimate interests (responding to people who contact us), or steps before a contract |
| Keep the site secure, prevent abuse and account sharing, and fix errors | Technical, usage, account | Legitimate interests (a secure, working service) |
| Understand how the site and members area are used, to improve them | Usage, technical | Legitimate interests (improving the product) |
| Send occasional news about The Strategy Room and related offers | Name, email | Consent (only if you opt in) |
We do not make decisions about you based solely on automated processing.
4. Who processes it for us
We use these service providers to run The Strategy Room. They process personal data on our instructions under data processing terms. We do not sell your personal data.
| Provider | What for | Where |
|---|---|---|
| Stripe | Payments, subscriptions, billing portal, fraud checks | EU and US |
| Supabase | Database and login (authentication) | EU (Ireland) |
| Vercel | Website hosting and privacy-friendly page statistics | US, with a global edge network |
| Resend | Sending login links and service emails | US |
| PostHog | Product analytics | EU |
| Sentry | Error monitoring | EU (Germany) |
| Linear | Tracking error reports and fixes | US |
| Anthropic | AI assistance investigating error reports | US |
| Vimeo | Hosting and playing session recordings | US |
| Riverside | Live session platform | US |
| HubSpot | Customer records for members and team inquiries | EU |
We may also share data with professional advisers (such as accountants and lawyers), or where the law requires it.
5. International transfers
Some providers process data outside the UK and EU, mainly in the US. Where they do, we rely on an adequacy decision (such as the UK-US data bridge for certified companies) or appropriate safeguards: the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum.
6. How long we keep it
- Account and membership data: while your membership is active, then deleted or anonymized within 12 months after it ends, except billing records.
- Billing and payment records: 6 years after the end of the financial year they relate to, as UK tax law requires.
- Team inquiries that do not go ahead: up to 24 months after your last contact.
- Analytics and error reports: no longer than needed to improve and secure the service, and at most 24 months.
- Session recordings: for as long as the archive is offered to members.
7. Cookies and similar technologies
- Login cookies (strictly necessary): set by our login provider, Supabase, to keep you signed in to the members area. The members area cannot work without them.
- Analytics (no cookies): PostHog runs in cookieless mode. It sets no cookies and stores nothing in your browser; visits are counted with a server-side hash that changes daily, so you cannot be followed across days. Vercel page statistics do not use cookies either. In the members area, activity such as sessions viewed and files downloaded is recorded on our servers against your account, to run and improve the membership.
- Recordings: the Vimeo player is loaded with "do not track" enabled.
- Checkout: Stripe Checkout runs on Stripe's own site and uses cookies for payments and fraud prevention, as described in Stripe's privacy policy.
8. Marketing
Members get service emails (login links, session reminders, billing and refund emails) because they are part of the membership. You can turn session reminders off in the members area. We only send marketing emails if you opt in, and every marketing email has an unsubscribe link.
9. Your rights
Under UK GDPR (and the EU GDPR where it applies) you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to how we use it, including objecting to processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, email dwayne@gefferie.com. We will reply within one month. Some rights have limits, for example we must keep billing records for tax purposes.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live in the EU.
10. Age
The Strategy Room is for professionals and is not intended for anyone under 18.
11. Changes to this notice
We will update this notice when our practices change, and email members about material changes. The date at the top shows when it last changed. The Terms explain how memberships work.