Privacy & Data Policy

1. Who this policy is for

This policy applies to HESSY members, visitors and people who connect another service to HESSY. HESSY is intended for people aged 16 and over. People aged 16 or 17 are still children for UK data-protection purposes, so HESSY is designed to treat their privacy with particular care.

2. Who controls HESSY data

HESSY is operated through hessy.co.uk and is the controller for personal data processed directly by HESSY. Privacy enquiries and data-rights requests can be sent to royscarrott@rsbse.co.uk.

3. What HESSY may collect

• Account data: username, display name, email address, account status and securely hashed password credentials handled by WordPress.
• Profile data: bio, interests, creative disciplines, profile image, portfolio links and any optional information you add.
• Social activity: friendships, groups, messages, comments, reactions, reposts, notifications, finds, reports and moderation records.
• Content: posts, photos, videos, links, captions and metadata you choose to share.
• Connected-account data: the provider you connect, account identifiers, public/profile information made available by that provider, authorised content and OAuth access/refresh tokens needed to keep the connection working.
• Technical and security data: IP address, browser/device information, login/security logs and essential cookie/session data where available to the site or its hosting platform.

4. Why HESSY uses it

HESSY uses personal data to provide accounts, profiles, feeds, groups, messaging, connected-network features, security, moderation, support and service improvement. Depending on the activity, processing may be necessary to provide the service you requested, for legitimate interests such as keeping HESSY secure and usable, to meet legal obligations, or on the basis of consent where consent is required.

5. Privacy for members aged 16–17

HESSY applies privacy-protective defaults. New profiles default to a restricted visibility setting rather than public exposure. Email addresses are not displayed publicly by HESSY. Members should not publish a home address, school or college timetable, live location, private phone number or other information that makes it easy to locate them offline.

HESSY should not use a child member’s personal data to encourage them to weaken privacy settings or for behavioural advertising based on sensitive profiling. If age-specific protections cannot reliably be applied, HESSY should apply the safer standard more broadly.

6. Connected services

When you connect services such as YouTube, TikTok, Instagram, Facebook, LinkedIn, Pinterest, Spotify, X or Threads, authentication takes place with that provider. HESSY does not ask for or store your password for those services. The provider gives HESSY a permission token describing what HESSY is allowed to access or publish.

Connected providers remain separate services with their own privacy policies, terms and data practices. HESSY only attempts to import or publish the data permitted by the provider and the permissions you grant.

7. HESSY AI

If you use HESSY AI, your prompt and a limited amount of recent conversation context are sent to the AI provider selected by HESSY so it can generate a response. HESSY stores your AI conversation history in its own database so you can reopen chats. The first HESSY AI release does not enable live web search.

HESSY AI sends a privacy-preserving hashed safety identifier rather than your username or email address. You should not put passwords, home addresses, school timetables, precise live location, private health records or other unnecessary sensitive personal information into an AI prompt. AI output can be wrong and should not be treated as verified professional advice.

8. Who can see your information

Visibility depends on the feature and your settings. Public posts can be seen by people allowed to access that part of HESSY. Friends-only and private profiles are more restricted. Private-group posts and group conversations are intended only for active members of that group. Direct messages are intended for the people in that conversation.

No online sharing feature can guarantee that another user will not save, screenshot or copy something they can see, so share carefully.

9. Service providers and international processing

HESSY may rely on hosting, email, security, analytics or connected-platform providers. Those providers may process data in other countries. Where required, the HESSY operator should use appropriate contractual or legal safeguards for international transfers.

10. Retention

HESSY should keep personal data only for as long as it is needed for the service, security, moderation, legal obligations or dispute handling. Some records may need to be retained after content or an account is removed, for example where a report, safety issue or legal obligation requires it.

11. Your data rights

Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict or receive copies of your data, object to certain processing, and withdraw consent where processing is based on consent. You can request help at royscarrott@rsbse.co.uk. You may also complain to the UK Information Commissioner’s Office.

12. Account deletion and disconnecting services

Disconnecting an external service stops HESSY using that connection going forward, but it does not automatically delete content that you previously chose to bring into HESSY or publish elsewhere. Account-deletion tooling and retention handling should be clearly available before public launch.

13. Changes

If HESSY materially changes how personal data is used, this policy should be updated and important changes should be brought to members’ attention.