Privacy policy
Last updated 17 July 2026
The short version: we collect your email address, and only your email address. We don't track you around the internet, we don't sell anything to anyone, and we don't use advertising cookies. Everything below is the detail behind that.
Who we are
Your First Prompt is operated by Precious Memories LTD, a company registered in England and Wales. We are the data controller for the personal data described here. You can reach us at amara.sesay@gmail.com.
What we collect, and why
Your email address, to sign you in. We use passwordless sign-in, so your email is your account. Lawful basis: performance of a contract (giving you the course you signed up for).
Your email address, for the newsletter. Only if you explicitly subscribe. We also record when you subscribed, which page you subscribed from, and the exact wording you agreed to, because we have to be able to show that your consent was genuine. Lawful basis: consent, which you can withdraw at any time.
Your purchase. If you buy the course, we store a record that you have access, along with the reference ids Stripe gives us. We never see or store your card details. Lawful basis: performance of a contract, and legal obligation for keeping financial records.
Your course progress.Which modules you've ticked off, your streak and badges are stored in your own browser, on your own device. They are never sent to us. Clearing your browser data clears them.
Cookies
We only use essential cookies, and only to keep you signed in. We do not use advertising, analytics, or tracking cookies, and we don't share data with ad networks. That is why you aren't seeing a cookie banner: there is nothing to consent to beyond the cookies required to make signing in work.
Who else processes your data
We use a small number of providers to run the site. They act on our instructions as processors: Supabase (database and sign-in, hosted in the EU), Stripe (payments, who act as their own controller for payment data), Resend (sending emails), and Vercel(hosting). Where data is transferred outside the UK or EEA, those transfers rely on the providers' standard contractual clauses and equivalent safeguards.
How long we keep it
Newsletter subscribers: until you unsubscribe, plus a minimal record of the unsubscribe so we don't email you again by mistake. Account and purchase records: for as long as you have access, and afterwards for as long as tax law requires us to keep financial records (currently six years). If you ask us to delete your account, we will, except for anything we are legally required to retain.
Your rights
Under UK GDPR you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to our using it, and ask for it in a portable format. Where we rely on consent, you can withdraw it at any time, and withdrawing it doesn't affect anything we did before you withdrew it. To exercise any of these, email amara.sesay@gmail.com. We'll respond within one month.
Unsubscribing
Every marketing email has a one-click unsubscribe link, and it works immediately without needing to sign in. Unsubscribing from the newsletter never affects your access to the course.
Complaints
If you think we've handled your data badly, please tell us first and we'll try to fix it. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.
Changes
If we change this policy we'll update the date at the top. If the change is significant and you're on our list, we'll tell you by email.