GDPR & UK GDPR Privacy Notice

1. Scope and Who This Applies To

This GDPR & UK GDPR Privacy Notice supplements our Privacy Policy and applies when you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, or when the EU General Data Protection Regulation (GDPR), the UK GDPR, or the Swiss Federal Act on Data Protection otherwise governs our processing of your personal data.

Grace Unworthy Ministries, LLC ("we," "our," or "us") processes personal data in connection with our properties and services. This document applies to the properties listed in our Covered Properties notice, which is incorporated by reference.

Where this notice and the Privacy Policy conflict on a point of EU, UK, or Swiss data protection law, this notice controls for that point. For a full description of what we collect and how we use it, see the Privacy Policy.

2. Controller Identity and Data Protection Contact

Grace Unworthy Ministries, LLC is the data controller responsible for the personal data described in this notice and in our Privacy Policy.

We are not required to appoint, and have not appointed, a statutory Data Protection Officer under Article 37 of the GDPR. Our privacy lead is Jeremy DeYoung, who is also an officer of the company; we describe this role as our Data Protection Contact rather than a DPO precisely because it is not independent of our decision-making. If our processing changes such that a DPO is required, we will appoint one and update this notice.

The Data Protection Contact and the privacy mailbox are the same routing address. Privacy and data-subject requests should go to [email protected] rather than a personal mailbox, so that requests are tracked and answered within the timeframes in Section 6.

3. Legal Bases for Processing

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with equivalent requirements, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): creating and maintaining your account, delivering courses and community features, processing purchases and subscriptions, and providing support.
• Consent (Art. 6(1)(a)): marketing emails and text messages, non-essential cookies and similar technologies, optional profile fields, and push notifications. You may withdraw consent at any time without affecting prior processing.
• Explicit consent (Art. 9(2)(a)): optional religious affiliation and other special category data you choose to provide, as described in Section 4. Where you publish such information yourself, we also rely on Art. 9(2)(e).
• Legitimate interests (Art. 6(1)(f)): platform safety and moderation, fraud and abuse prevention, security monitoring, service analytics and debugging, product improvement, and defending legal claims. We balance these interests against your rights and freedoms.
• Legal obligation (Art. 6(1)(c)): tax, accounting, and financial recordkeeping, and responding to valid legal process.
• Vital interests (Art. 6(1)(d)): in rare cases involving a credible risk of serious harm to you or another person, such as an imminent safety emergency identified through moderation.

4. Special Category Data (Article 9)

Journaling, reflection, GuidedSteps, and similar features may also reveal religious beliefs or details about your mental and emotional health. We treat that content with the same sensitivity and use it only to deliver the feature to you. See our Privacy Policy for the full categories of data we collect.

5. Your Rights

If you are in the EEA, the UK, or Switzerland, you have the right to:

• Access the personal data we hold about you and receive information about how we process it
• Rectify inaccurate or incomplete data
• Erase your data, subject to the retention exceptions in our Data Deletion & Retention Policy
• Restrict processing in certain circumstances
• Port data you provided to us, in a structured, machine-readable format
• Object to processing based on legitimate interests, and to object at any time to direct marketing
• Withdraw consent at any time where processing is based on consent, without affecting prior processing
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects; where automated safety scoring informs an enforcement action, you may request human review
• Complain to your local supervisory authority or, in the UK, the Information Commissioner's Office, as described in Section 11

6. How to Exercise Your Rights and Response Times

Submit requests to [email protected], or follow the deletion instructions in our Data Deletion & Retention Policy. Please tell us which right you are exercising and include the email address associated with your account. We will take reasonable steps to verify your identity before acting, and we may decline requests we cannot verify.

• We aim to acknowledge requests promptly, usually within a few business days.
• Under the GDPR and UK GDPR, we aim to respond substantively within one (1) month, extendable by up to two (2) further months for complex or numerous requests, with notice to you of the extension and the reason.
• Exercising your rights is free. We may charge a reasonable fee or decline to act on requests that are manifestly unfounded, excessive, or repetitive, and we will explain our reasoning if we do.

There is currently no self-service data-export or account-deletion button in our products. Access, erasure, and related requests are handled by email to [email protected], as described in our Data Deletion & Retention Policy.

7. International Data Transfers

We are based in the United States, and our infrastructure and most of our service providers are located in or process data in the United States. If you access our services from outside the United States, your personal data will be transferred to, stored in, and processed in the United States and in other countries where our providers operate. Data protection laws in those countries may differ from those in your jurisdiction.

For transfers of personal data out of the EEA, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum with vendors that provide them, together with the technical and organizational safeguards described in our Security Policy and Privacy Policy.

8. Retention

We keep personal data only as long as needed for the purposes described in our Privacy Policy, or as required by law. Account data, content you create, and related records follow the retention and deletion schedule in our Data Deletion & Retention Policy, including extended retention of purchase and order records for as long as needed for tax, accounting, audit, fraud prevention, chargeback and dispute defense, and other legal compliance purposes.

When you request erasure, we delete or anonymize what we can, subject to the exceptions and timelines in the Data Deletion & Retention Policy.

9. Consent and Cookies in the EEA and UK

Essential cookies are used because they are strictly necessary to deliver the service you request. Analytics and marketing technologies are used based on your consent where consent is required by applicable law (including the EEA, United Kingdom, and Switzerland), and otherwise based on our legitimate interest in measuring and improving our services.

10. Automated Processing and AI Moderation

To keep a trauma-aware community safe, the text of posts and comments on The Story Haven may be transmitted to OpenAI for automated review that produces internal safety and trauma sensitivity scores. Those scores can affect content warnings, distribution, crisis resources, or routing to a human moderator. There is currently no per-user opt-out from this safety review; it is a condition of using our community platforms.

Automated scores inform, but do not solely determine, enforcement actions that significantly affect you. Under Article 22 GDPR / UK GDPR, you may request human review of a decision based on that scoring by contacting [email protected] or [email protected]. Full detail appears in Sections 2.4 and 3.1 of our Privacy Policy.

11. Complaints to a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority — in particular in the EEA Member State of your habitual residence, place of work, or place of the alleged infringement — if you believe that our processing of your personal data infringes the GDPR.

In the United Kingdom, you may complain to the Information Commissioner's Office (ICO). In Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC). We would appreciate the chance to address your concern first; please email [email protected] before or alongside a regulatory complaint.

12. Article 27 Representative

13. Changes and Contact

We may update this notice to reflect changes in our practices, technology, vendors, or legal obligations. When we do, we will revise the Last Updated date at the top of this page. For material changes, we will provide more prominent notice where appropriate, which may include an in-product notice or an email to the address on your account.

Questions about this notice or about how we process personal data under the GDPR or UK GDPR should go to [email protected].