Privacy Policy

1. Who is responsible

ZOEE HABLOT LTD, a private limited company registered in England and Wales (company number 16567947), with its registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ, runs The Woman Warrior Blueprint™ and this website and is responsible for your personal data (the "controller"). The coaching is delivered by Zoée Hablot on its behalf. Contact: email contact@zoeehablot.com or call +44 20 3873 1053.

2. What we collect

When you sign up for the course

• your full name, email address and WhatsApp number (with its country code);
• your Instagram handle, if you give it;
• when you accepted our terms (and which version), and whether you opted in to marketing messages;
• the campaign link that brought you to us (UTM parameters), if any.

We keep this even if you don't finish paying, so we can answer questions about your order.

When you pay

Stripe handles the payment. We receive your name, email, the amount, payment status and Stripe's reference numbers — never your full card details.

When you use your student account

• your email address and sign-in activity;
• your progress through lessons, including where you stopped in a video;
• the answers you write in assignments and the coach's feedback;
• your course certificate (private unless you choose to make it public);
• which course offers were shown to you and whether you clicked them.

When you request a training plan call

Your first name, email, WhatsApp number, where you're based, your Instagram username if you give it, and your answers about your training. We save your contact details as soon as you complete the first step, so we can follow up even if you don't finish.

When you sign up for our emails (the free weekly lesson)

• your email address, and your first name and time zone if you give them (the time zone is only used to send the weekly email at a good hour for you);
• the exact wording you agreed to and when (also when you tick the marketing box while signing up for the course);
• which of our emails were sent to you, and whether one bounced or was reported as spam.

We don't store your IP address or device details with your consent. There is no confirmation step.

When you visit our link page (/links)

We count visits and button taps without cookies or anything else stored on your device, and without keeping your IP address. For each visit we record the country and city Cloudflare derives from the connection, the site or app you came from, any campaign or keyword tag on the link, the kind of device, how long the page was on screen and which buttons you tapped. To count unique visitors we keep a one-way code made from your IP address and browser with a random key that changes every day and is then deleted, so it can't be turned back into your IP address or linked across days. We use this, in our legitimate interest, to see which links and channels work.

Technical data

Like every website, our hosting provider processes your IP address and browser details to deliver pages and protect the site from abuse.

3. Why we use it

• To provide what you bought — create your account, give you access, send sign-in codes and course emails, run your onboarding call and review your assignments (performing our contract with you).
• To contact you about your order or application by email or WhatsApp, for example if checkout didn't complete or to arrange your call (our legitimate interest in helping you, or steps you asked for before a contract).
• Training tips and offers by email and WhatsApp — only if you ticked the optional box. You can withdraw consent at any time in your account or by replying "stop".
• Welcome emails and the weekly lesson — only if you ticked the box (your consent): 3 welcome emails over your first week, then a weekly email. Each one has an unsubscribe link that works in one click. We stop the welcome emails early if you buy the course or book a call.
• To keep the service secure and prevent fraud (legitimate interest).
• To keep accounting records of purchases (legal obligation).

4. Who processes it for us

We don't sell or rent your personal data. We use these service providers, who only process it on our behalf:

• Supabase — database and sign-in. Your data is stored on servers in the EU.
• Stripe — payments and refunds.
• Resend — delivery of our emails (sign-in codes, receipts, course emails, welcome emails and the weekly lesson).
• Cloudflare — website hosting and security.
• Calendly — booking your onboarding or coaching call, when you use the booking link.
• YouTube (Google) — course videos are hosted on YouTube and shown in an embedded player, so YouTube processes data when the player loads. The intro video on our home page only loads (from YouTube's privacy-enhanced domain) once you press play. The video on the free course page plays muted as soon as the page opens, so it loads from YouTube's privacy-enhanced domain straight away.
• WhatsApp (Meta) — when we message you on WhatsApp.

Some of these providers may process data outside the EU/UK. When they do, they rely on recognised safeguards such as the European Commission's Standard Contractual Clauses.

5. Cookies

We only use cookies that are strictly necessary to keep you signed in to your student account. We don't use analytics or advertising cookies (our link page statistics use none), so there is no cookie banner. Stripe's checkout page, Calendly and embedded YouTube players are run by those companies and may set their own cookies under their own policies.

6. How long we keep it

• Your account and course data: for as long as you have an account. Ask us and we'll delete it.
• Purchase records: as long as tax and accounting law requires.
• Signups that never became a purchase and coaching applications: only as long as they are useful to follow up on your request, then deleted.
• Marketing consent: until you withdraw it.
• Our email list: while you're subscribed. After you unsubscribe (or your address bounces or reports us as spam), we keep your name, consent record and email history for 2 years so we can show you agreed, then delete them. We keep only your email address on a "do not email" list, for good, so you're never added again by mistake. Ask us and we'll delete the rest straight away.
• Link page visit statistics: 13 months, then deleted.

7. Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. You can change your name, Instagram handle and marketing preferences yourself in your account. To use any of these rights, email contact@zoeehablot.com from the address you signed up with; we reply within one month.

If you're unhappy with how we handle your data, please tell us first. You also have the right to complain to your local data protection authority (for example the ICO in the UK, or the supervisory authority in your EU country).

8. Security

Access to your data is restricted to what each part of the service needs, connections are encrypted, and sign-in uses one-time codes rather than passwords. No system is perfectly secure, but if a breach ever affected your data we would tell you as the law requires.

9. Age

The course is meant for adults. We don't knowingly collect data from children under 16.

10. Changes and contact

We'll update this policy when our practices change and show the date at the top. Questions? Email contact@zoeehablot.com or call +44 20 3873 1053. See also our Terms of Service.