How I handle your data

Privacy Policy

OCD: Conditions for Allowing · Last updated: 21 October 2026

---

This page explains what personal information I collect when you buy the book, use the portal or the Allowing app, book a call, or work with me — and what I do with it. I've written it in plain English on purpose. If anything is unclear, email me and I'll give you a straight answer.

1. Who I am

I'm David Laing, and I run OCD: Conditions for Allowing as a sole trader, based in Eastbourne, East Sussex, United Kingdom. For data protection law, I'm the "controller" of your information — meaning I'm the one responsible for looking after it.

• Email: david@conditionsforallowing.com
• Postal address: Heathcote, Eastbourne BN21 1BZ, United Kingdom
• ICO registration: ZC157467

2. What I collect, and when

When you buy something (the book, a toolkit, an Allowing app subscription, a membership, or a programme): your name, email address, what you bought, and payment confirmation. Payments are processed by Stripe — your card details go directly to Stripe and never touch my systems.

When you start a checkout and don't finish it: what you gave on the first step (your name, your email address and, if you entered it, your phone number), and which checkout it was. My checkout provider also notes the internet address and browser you used, and which ad or page brought you there. I may email you about the book, my work and my offers.

When you book a call with me: your name, email, phone number, and your answers to the booking questions. Some of those questions ask about your experience of OCD and how you're doing — that's sensitive health information, and it gets special treatment (see section 3).

When you create a portal account (portal.conditionsforallowing.com): your email and login, your course progress, which recordings you play there and when, any notes you choose to leave on a recording, and — if you're in a programme — the things you choose to log there: daily practices, reflections, check-ins. Much of that is also sensitive health information (section 3 again).

When you use the AI tools (the ones in your portal, and the conversation in the app): whatever you type into them, and the responses that come back. That's sensitive health information too — section 3 covers it, and section 5 names every company that touches it.

If you speak to a tool instead of typing: your microphone audio is sent to be turned into text. The audio is not kept — it is transcribed and discarded, and it never reaches my database. The transcript is kept, in your portal account, the same as if you had typed it. The spoken reply you hear is generated the same way and is not stored either.

When you use the Allowing app: the app works through your portal account, and what it sends is kept there. It sends: your email address, to sign you in (each request to sign in is kept for 24 hours with the internet address it came from, so I can stop anyone guessing codes); the conversation, meaning a record that you opened it, everything you type into it and, if you report a reply, which one, all handled as above; what you write and choose in the allowing experiment and its journal; and a short note with the time and the app version each time you open the app, sign in, or a sign-in fails, so I can see whether the app is being used. If the address you type has no account with me, it goes into my customer records, and I email it about how to get the app. The practice opens the conversation when you're signed in and online. When it can't (you're offline, say), it runs on your phone alone and sends nothing. The app also checks for updates, which tells my update provider your app version, whether your phone is Android or iPhone, and a random number for this copy of the app — see section 5.

When I email you: which emails you open and which links you click (this is how email platforms work; I use it to decide who hears from me again, and to stop sending things you clearly don't want).

When you visit the website: see section 6 (cookies and analytics).

When we're working together (the membership or a programme): what you share on calls, in the community, in check-ins, and — if you're in a programme — in our WhatsApp thread.

If you post in the community: for the weekly draw, I keep a record of who posted each week and when (your community name and your posts' links), the draw's order and its result. To check whether the people drawn have the Allowing app, in the order they were drawn, I look for the app on the email their Skool account uses, or on another email they send me. If someone asks, I confirm the draw took place with the winner's first name and country, unless the winner tells me not to; and if the advertising regulator (the ASA) asks, I show them the draw's record. It's used for nothing else.

I don't collect anything I haven't listed here, and I never buy data about you from anyone.

3. Sensitive information — the important bit

Because of what this work is, some of what you share with me is information about your mental health. The law calls this "special category data" and requires explicit consent to use it. Here's how that works honestly:

• Booking and request forms: your answers about your wellbeing are used for one thing — preparing for our call. Submitting the form is how you consent to that. If you don't become a client, those answers are deleted within 12 months.
• Portal logs, reflections and programme notes: by choosing to write them, you're consenting to me (and only me) reading them to coach you. When you use an AI conversation, in the portal or the app, it can also read the parts of these that match what you've just written, so it can bring them up; those parts go to Anthropic with your message (section 5).
• What you write in the app's allowing experiment and journal: by choosing to write it, you're consenting to it being kept in your portal account, where the app and the portal show it back to you, and to me being able to see it, as I can see the rest of your account. I read your journal to coach you only if you're in a programme.
• What you type into the AI tools: the same applies — by using them you're consenting to that text being stored in your portal account and read by me (and only me) to coach you. To produce a response it is sent to Anthropic, who run the models behind the tools (section 5). Under their commercial terms it is not used to train those models.
• While a tool is in beta: I also read these conversations to see whether the tool is actually working — not only to coach you. That is the whole reason a beta exists. And if something you write suggests you might be at real risk, it is flagged and I see it, so it doesn't get missed. Nobody is watching live (see the Terms, section 3), and nothing is anonymised before I read it — it's me reading it, the same as everything above.
• What you say out loud to a tool: choosing to speak rather than type is how you consent to your voice being sent for transcription — to ElevenLabs, or to OpenAI if ElevenLabs doesn't answer (section 5). I don't keep the recording — it is transcribed and discarded. What the transcription company does with it in the moment is governed by its own contract with me, not by mine with you. If you would rather not send your voice at all, type instead; the tool works either way.
• Never used for marketing. Never sold. Never shared, except with the service providers that physically store it (section 5) — who are contractually barred from doing anything else with it.

You can withdraw consent at any time by emailing me — I'll delete the information (unless a legal duty, like tax records, requires keeping the purchase itself).

4. Calls, recordings, and messages

• The weekly group session (Zoom, Wednesdays): these sessions are recorded for my own reference only and are never shared; recordings are deleted within 90 days.
• The programme calls (Zoom): on the Thursday call, only the short opening teaching segment is recorded. Hot-seat coaching is never recorded — what comes up there stays in the call. The Monday programme call is never recorded, by anyone.
• One-to-one calls (coaching and assessment calls): these are recorded, with your knowledge, and used only to improve how I support you. They're stored privately, deleted on request, and in any case within 12 months of our work together ending.
• AI notetaker: On coaching and assessment calls, and on the recorded part of a group call (it leaves before any hot-seat), I use Fathom, an AI notetaker, so I can be fully present instead of scribbling. You'll see it join the call. On a one-to-one call it produces a transcript and summary that only I can see, used solely to prepare and follow up on our work, and if you'd rather it wasn't there, say so at the start of the call — or tell me beforehand — and I'll turn it off, no explanation needed. On a group call it runs for the whole group, so there your choice is whether you come on camera and whether you speak, unless your agreement says otherwise (see the next point).
• Recording choice (programme clients): if your programme agreement has a tick-box for recording, what you chose there applies to you. Where that box says you consent to appearing in recordings of the group calls, leave it unticked and you still get the entire programme, unchanged, at the same price: on the recorded calls you keep your camera off and type rather than speak. You can change your mind at any point, including for a single call.
• WhatsApp (programme clients): our coaching thread lives on WhatsApp, which is end-to-end encrypted in transit. Be aware WhatsApp is a Meta product with its own privacy policy.
• SMS: if you book a call, I may send you booking-related texts (confirmations, reminders, rescheduling). I'll only ever send marketing texts if you've ticked a box saying yes — and you can reply STOP to anything.

5. Who else touches your data (my service providers)

I'm a small business; these companies store or move data on my behalf. Each is bound by a contract limiting them to exactly that:

I never sell your data. Nobody gets it for their own marketing.

6. Cookies and analytics

The website (conditionsforallowing.com) currently uses:

• Meta Pixel — tells me which ads brought people to the book page, so I'm not wasting money showing ads to the wrong people. Meta also receives this data under its own policy.
• Microsoft Clarity — anonymised session recordings (where people scroll and click) so I can see what's confusing on the page.
• A "variant" cookie (30 days) — remembers which version of the page you saw so it doesn't change under you.
• A session-only attribution note — remembers which ad you arrived from until you close the tab, so the right campaign gets credit if you buy.

You'll be asked before any of the advertising/analytics ones load, and "no" is a one-click answer. You can also block cookies in your browser settings at any time; the site works fine without them.

The checkout pages (checkout.conditionsforallowing.com, run through my checkout provider) also use the Meta Pixel. The consent prompt above covers this website; on the checkout pages the Pixel currently loads without a prompt — I'm extending the same consent control there.

Also from my own records, whatever you choose in the prompt: when your details first go into my customer records (for most people, the first step of a checkout), and when you buy something at my checkout, my reporting system tells Meta. That lets me see which ads lead to real orders, and lets Meta show my ads to people like the ones who buy. It sends your email address, phone number, name and country in a scrambled form (a one-way code that Meta compares with its own users', to find your Facebook or Instagram account if you have one); the internet address and browser you used, as they are; the code from the ad you clicked and the one Meta's Pixel left in your browser, if they exist; a reference number from my records; and the time. For a purchase it also sends the amount you paid, the name of the ad you came from, and the address of the page you arrived at (which can include the ad's tags). No card details, and nothing you've written to me, in the portal or in the app. My work is about OCD, though, so the fact that you're in my records at all says something about you. Meta receives all this under its own policy.

7. How long I keep things

• Purchase records: 6 years (UK tax law requires it).
• Booking answers from people who don't become clients: deleted within 12 months.
• Email list: until you unsubscribe.
• If you started a checkout and didn't finish: kept with no time limit; deleted on request.
• If you typed your address into the app without an account: kept with no time limit; deleted on request.
• Portal accounts: for as long as you have access; deleted on request.
• The weekly draw's record: kept for 12 months after each draw, so I can show it was run fairly if I'm asked; then deleted.
• The app's notes of when you open it, sign in, or a sign-in fails: kept for as long as your account exists, with no time limit. They go when your account is deleted.
• AI tool conversations: stored in your portal account for as long as you have access; deleted on request — the transcript, and the notes the tool made about where the session had got to. There’s also a hard limit that doesn’t wait for you to ask: a conversation you haven’t added to for three years is deleted automatically, even if your account is still open. I never store spoken audio, so there is nothing for me to delete.
• Call recordings and transcripts: One-to-one recordings deleted on request and, in any case, within 12 months of our work together ending; weekly group session recordings within 90 days (see section 4).

8. Where your data lives

Some of the providers above (HighLevel, Stripe, Meta, Microsoft, Zoom, Google, Supabase, Anthropic, ElevenLabs, OpenAI, Expo and Resend) store or process data in the United States. Those transfers are covered by the UK's approved safeguards — the UK–US Data Bridge where the provider is certified, or the UK's standard contractual terms (IDTA/Addendum) where not.

9. The legal bases (the formal bit)

• Delivering what you bought (the book, portal access, coaching): contract.
• Emailing customers about my work and similar offers: legitimate interests — you gave me your email when buying, and every email has an unsubscribe link that works instantly.
• Emailing people who started a checkout about my work and offers: legitimate interests — you gave me your email at the checkout, and every email has an unsubscribe link that works instantly.
• Emailing people who typed their address into the app's sign-in without an account, about how to get the app: legitimate interests — you gave me your email in the app, asking to sign in, and every email has an unsubscribe link that works instantly.
• Your booking answers and coaching content (health information): explicit consent (section 3).
• Marketing SMS: consent (the tick-box).
• Tax records: legal obligation.
• Analytics and advertising measurement on this website: consent (via the cookie banner).
• Telling Meta about purchases and new contacts from my own records: legitimate interests — knowing which ads lead to real orders, so I don't pay to show ads to the wrong people.
• The app's notes of when you open it, sign in, or a sign-in fails: legitimate interests — knowing whether the app is working and being used.
• Which recordings you play in your portal: if you're in a programme, part of the coaching (contract, as above); for everyone else, legitimate interests — seeing who uses which recordings. The record says which recordings you played and when, nothing you wrote.
• Running the weekly draw (the record of who posted, checking the app, and confirming a winner if asked): legitimate interests — running the draw the way its rules say, and being able to show it was run fairly.

10. Your rights

You can ask me, at any time, to: see what I hold about you; correct it; delete it; restrict what I do with it; hand it over in a portable format; or stop using it for marketing (that last one, I must and will do, no questions). Email david@conditionsforallowing.com — I'll respond within a month, usually much faster.

If you're unhappy with how I've handled your data, you can complain to the UK regulator: the Information Commissioner's Office — ico.org.uk / 0303 123 1113. (I'd appreciate the chance to fix it first, but that's your right regardless.)

11. Age

My products and programmes are for adults — 18 and over. That includes the portal, the AI tools and the Allowing app: you must be 18 or over to use them. If you're a parent, guardian or carer of a young person with OCD, you're welcome here — but the account, the purchase and the data are yours, as the adult. I don't knowingly collect information from anyone under 18; if that's happened, email me and I'll delete it.

12. Changes

If I change this policy in any way that matters, I'll update the date at the top and — for anything significant — tell the email list. The current version always lives at this address.