Your privacy
Privacy Policy
Heart to Art
A service provided by Your AI Assistant
Compliant with UK GDPR and the Data Protection Act 2018
Last Updated: 28 August 2026
1. About This Policy
Your AI Assistant, trading as Heart to Art (“we”, “us”, “our”), is committed to protecting the privacy and personal data of everyone who uses our services — whether you’re taking one of our creative challenges, browsing our website, or working with us as a partner.
This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For the purposes of data protection law, we are the Data Controller for the personal data of living individuals that we process.
Our registered address is 10 Greville Avenue, Croydon CR2 8NL.
2. Data Controller Contact Details
Data Controller: Your AI Assistant trading as Heart to Art
Address: 10 Greville Avenue, Croydon CR2 8NL
Email: grace@madeforyoumusic.co.uk
Telephone: 07850 378179
ICO Registration Number: C1880852
3. What Personal Data We Collect
3.1 Customers (all challenges)
When you join a challenge, we collect:
(a) Contact information: name, email address, and telephone number.
(b) Payment information: processed securely by Stripe via GoHighLevel. We do not store full card details.
(c) Communication records: emails, live call attendance, and messages.
(d) Preferences: which challenge you’ve chosen, and any answers you give us about what you’re hoping to create.
3.2 Information About the Person Your Challenge Is About
Every Heart to Art challenge asks you to write about someone — a partner, a grandchild, a parent, yourself. To help you do that, we collect the personal stories, memories, personality details, anecdotes, relationships, hobbies and other information you choose to share about that person (the “Subject”) inside your Creative Journal and in any live sessions.
Where the Subject is a living person other than you, this is their personal data under UK GDPR, even though you are the one providing it to us. See Section 4.
Where a challenge (for example, the Life Story challenge) involves memories of someone who has died, see Section 10.
3.3 Partners
Where we work with referral partners: business contact information, referral records, and financial information for any commission due.
3.4 Website Visitors
Technical data (IP address, browser, device) and cookies (see Section 13).
4. Personal Data About Other People Provided By You
This section matters most for challenges where you’re writing about someone else — a spouse, a friend, a parent, or a grandchild.
4.1 When You Tell Us About Someone Else
When you share stories about another person to complete your challenge, that information is their personal data under UK GDPR. This may include details that qualify as special category data (Article 9) — health conditions, religious beliefs, ethnic origin, or sexual orientation — where these form part of the story you tell.
By providing this information, you confirm that:
(a) You have the right to share it with us for the purpose of taking part in your challenge.
(b) Where practical, you have told the Subject, or will tell them as soon as reasonably practicable, that their personal information is being used as part of a creative project involving AI tools such as ChatGPT and Suno.
(c) If your finished piece is intended as a surprise, you accept responsibility for telling the Subject once it’s been given.
4.2 Our Article 14 Obligations
Where we receive personal data about a living individual from someone other than that individual — which is the normal case for a challenge written for a loved one — Article 14 of the UK GDPR requires us to inform that individual about how their data is being processed. We rely on you, the Customer, to do this on our behalf, since direct contact from us could spoil a surprise gift.
Where you tell us the Subject is aware and has agreed, we process their data on the basis of that consent. Where the piece is a surprise, we rely on legitimate interests (Article 6(1)(f)) for the initial processing, on the understanding that you will inform the Subject once it’s appropriate to do so.
If a Subject contacts us to object to their personal data being used, we will stop processing it and work with you to resolve the situation.
4.3 Children’s Data (Children’s Book challenge)
The Children’s Book challenge specifically asks you to share a child’s name, appearance, and personal details so we can help you create a personalised story for them. Because this involves a child’s data:
(a) You confirm you are the child’s parent or legal guardian, or have their parent or guardian’s clear permission to share this information.
(b) We use this information only to help you create your book, and only for as long as needed to do so (see Section 8).
(c) We take extra care with any images or likenesses of children generated as part of this challenge, and do not use them for any purpose beyond delivering your finished book.
5. How and Why We Use Your Personal Data
| Purpose | Data Used | Lawful Basis (UK GDPR) |
|---|---|---|
| Delivering your challenge | Contact details, stories/memories about the Subject, preferences | Contract (Art. 6(1)(b)). For special category data about a Subject other than you: explicit consent (Art. 9(2)(a)) |
| Processing your words through AI tools (ChatGPT, Suno) | Stories, memories, descriptive details you provide | Contract (Art. 6(1)(b)) and consent for international transfer (Art. 6(1)(a)) |
| Processing data about a Subject other than you (surprise gifts) | Personal stories provided by you about someone else | Legitimate interests (Art. 6(1)(f)), balanced against the Subject’s rights. You undertake to inform the Subject |
| Payment processing | Contact details (payment via Stripe/GoHighLevel) | Contract (Art. 6(1)(b)) |
| Order and challenge communications (daily lessons, kickoff calls) | Contact details, challenge progress | Contract (Art. 6(1)(b)) |
| Partner management | Business contact details, referrals, financials | Legitimate interests (Art. 6(1)(f)) |
| Marketing (consent only) | Contact details | Consent (Art. 6(1)(a)) |
| Website analytics | Technical data, cookies | Legitimate interests (Art. 6(1)(f)) |
6. Use of AI Technology and Third-Party Data Processors
6.1 Our Technology Partners
| Platform | Location | Purpose | Data Shared | AI Training |
|---|---|---|---|---|
| Anthropic (Claude) | United States | Guided prompts, lesson content | Stories, memories, personality details you enter. NOT contact/payment data | API terms: inputs not used for training |
| OpenAI (ChatGPT) | United States | Crafting words/lyrics with you | Stories, memories, personality details you enter. NOT contact/payment data | API terms: inputs not used for training by default |
| Suno AI | United States | Music composition/production | Lyrics and style directions | Not used |
| GoHighLevel | United States | Website, CRM, courses, orders, comms, payments | Contact details, order details, comms. NOT the personal stories you write inside your challenge | N/A |
| Stripe | United States | Payment processing | Payment card details, billing info | N/A |
6.2 AI Training and Your Data
We use business and API tiers of AI platforms where available. Under Anthropic’s and OpenAI’s API terms, customer inputs are not used for model training.
6.3 International Data Transfers
Several platforms are US-based. We ensure appropriate safeguards via UK IDTA, EU SCCs with UK Addendum, or recognised data protection frameworks. Contact us for details on specific transfer mechanisms.
7. Other Third Parties
We may also share data with: (a) Partners (limited order status only); (b) professional advisers; (c) law enforcement where legally required.
We do not sell personal data. We do not share it for third-party marketing without your consent.
8. How Long We Keep Your Data
| Data Category | Retention Period | Reason |
|---|---|---|
| Contact details and order records | 6 years from purchase | Contractual limitation; HMRC |
| Creative Journal entries and personal stories | Deleted within 12 months of your challenge ending (unless you ask us to keep them longer) | No longer needed; personal nature warrants prompt deletion |
| Your finished piece (song, book, speech, etc.) | Indefinitely, or until you ask us to delete it | Ongoing access for you |
| Payment records | 6 years | HMRC |
| Partner business contacts | Partnership + 2 years | Business relationship |
| Website analytics | 26 months | Standard retention |
| Marketing consent records | Consent duration + 2 years | PECR compliance |
9. How We Protect Your Data
We implement appropriate technical and organisational measures including: encryption in transit and at rest; access controls; regular review; secure systems; due diligence on processors; use of API/business tiers for AI platforms.
10. Information About People Who Have Died
Some challenges (in particular, the Life Story challenge) may involve memories of someone who has died. UK data protection law does not apply to the personal data of deceased individuals — their name, life story and memories are not “personal data” for the purposes of UK GDPR.
However, we voluntarily apply the same standards of care to information about someone who has died as we do to protected personal data, because this information is often deeply meaningful to the person writing about them, and because stories about someone who has died may contain data about living individuals too (see Section 4).
11. Your Rights Under Data Protection Law
Under UK GDPR, you have the right to: access your data; rectification; erasure (in certain circumstances); restrict processing; data portability; object to processing based on legitimate interests; withdraw consent at any time.
Where a challenge is written about you (i.e. you are the Subject of someone else’s piece), you have the same rights over the personal information used.
Contact us using the details in Section 2 to exercise any right. We will respond within one month.
12. Marketing Communications
Marketing only with express opt-in consent (PECR). Unsubscribe at any time.
13. Cookies
Our website uses cookies for: (a) essential functionality; (b) analytics; (c) marketing (consent only). Manage via cookie banner or browser settings.
14. Children Using Our Services
Our challenges are for adults. Where a challenge involves stories or details about a child — most directly the Children’s Book challenge, or a parent’s memories shared in another challenge — this is treated with the additional care set out in Section 4.3.
15. Data Protection Impact Assessment
We have conducted a DPIA covering: the risk of incidental special category data about people other than the Customer; AI platform processing; international transfers; processing data about a Subject provided by a third party; and the enhanced protections we apply to children’s data in the Children’s Book challenge. A summary is available on request.
16. Data Breach Procedures
We will: notify the ICO within 72 hours where required (Art. 33); notify affected individuals where high risk (Art. 34); contain and remediate; document fully.
17. Complaints
Contact us first. You may also complain to the ICO: Wycliffe House, Water Lane, Wilmslow SK9 5AF. Tel: 0303 123 1113. www.ico.org.uk
18. Changes to This Policy
We may update this Policy. The current version is always available on our website. Material changes will be notified by email or website notice.
19. Contact Us
Your AI Assistant trading as Heart to Art
10 Greville Avenue, Croydon CR2 8NL
Email: grace@madeforyoumusic.co.uk
Telephone: 07850 378179
Website: heart-to-art.co.uk