Privacy Policy

1. Who We Are

Hypno Admin Pro is operated by Dante Harker (“we”, “us”, “our”). You can contact us at info@hypnoadminpro.com.

Our roles under UK GDPR. We act as the data controller for the personal data of practitioners who hold an account with us (for example your name, email, login, billing, and how you use the Service). For the client records, session notes, and other client information you enter into your workspace, you are the data controller and we act as your data processor, handling that data only on your instructions to provide the Service. These responsibilities are set out in our Data Processing Agreement.

The Hypno Admin Pro website and application software were created by Dante Harker.

We are registered with the UK Information Commissioner's Office (ICO) as a data controller under registration number ZC144184, in the name of Dante Harker (Hypno Admin Pro). You can check the ICO public register.

2. What Data We Collect

3. How We Use Your Data

• To provide and operate the Service.
• To process your subscription and payments.
• To send you service-related emails (e.g. trial expiry reminders, important updates).
• To enforce usage limits during your trial period.
• To improve and develop the Service.

We will never sell your personal data to third parties or use your content for marketing purposes without your explicit consent.

Legal bases (UK GDPR): We process personal data to perform our contract with you (providing the Service and taking payment), for our legitimate interests in keeping the Service secure, enforcing trial limits, and understanding aggregated use of the site—where those interests are not overridden by your rights—and, if we ever rely on consent for something optional (for example marketing emails), you may withdraw it at any time.

4. AI Processing

When you use AI features (script generation, affirmations, etc.), the prompts and parameters you provide are sent to OpenAI for processing. OpenAI's API data usage policy applies. We do not send your client names, personally identifiable information, or session notes to AI providers unless you explicitly include them in a prompt.

Reflection Room: Conversations in the Reflection Room are processed by OpenAI. By default a conversation is not saved — it exists only in your browser session and is discarded when you leave the page. If you choose to save and link a conversation to a client (or to “General”), the thread and its messages are stored securely in your account so you can return to them later. Saved threads are private to your account under our Row Level Security policies, and you can delete any thread at any time.

5. Data Storage & Security

Your data is stored securely on Supabase infrastructure hosted on AWS in the eu-west-1 (Ireland) region. Audio files are stored in Supabase Storage. All connections use HTTPS encryption. We apply Row Level Security (RLS) policies to ensure you can only access your own data. Sensitive clinical fields (session notes, intake, medical history, consent notes, and similar) are additionally encrypted at application level with AES-256 before storage. Client name, email, and phone remain searchable and are not field-encrypted.

For a plain-English overview of security, support, breach preparedness, AI processing, and compliance boundaries, see our Security, Privacy & Support page.

6. Third-Party Services

We use the following third-party services that may process your data:

• Supabase — authentication, database, and file storage.
• OpenAI — AI content generation (scripts, affirmations, audio voice synthesis).
• Stripe — payment processing and subscription management.
• Resend — transactional email delivery (for example booking confirmations and reminders, which may include a client's name, email, and appointment details).
• Trigger.dev — runs background jobs such as script and audio generation.
• Google Cloud Text-to-Speech — optional voice synthesis used only when you choose an AI-voice option to turn script text into audio.
• Vercel — hosting, deployment, Web Analytics (aggregated traffic), and Speed Insights (anonymous performance data). See Vercel's Web Analytics privacy information and Speed Insights privacy information.
• Google — where you connect Google features (for example Google Calendar), Google may process data according to your Google account settings. Our commitment under the Google API Services User Data Policy (including Limited Use) is stated on our Google API limited use disclosure.
• Microsoft — where you connect Outlook or Microsoft 365 calendar, Microsoft may process booking times and the details we write into that calendar, according to your Microsoft account settings.
• Zoom — where you connect Zoom for online sessions, Zoom may process meeting and account data according to your Zoom settings.
• ElevenLabs — only when you choose to use your own ElevenLabs API key in Audio Studio; voice synthesis is then processed by ElevenLabs under your key and their terms.
• Google Analytics and Google Ads — optional analytics and advertising measurement, only after you accept optional cookies (see our Cookie Policy).

7. Your Rights (UK GDPR)

Under UK data protection law, you have the right to:

• Access your personal data.
• Rectify inaccurate personal data.
• Erase your personal data (“right to be forgotten”).
• Export your data in a portable format.
• Object to processing of your personal data.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email us at info@hypnoadminpro.com. We will respond within 30 days.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO), the supervisory authority for data protection in the UK: ico.org.uk/make-a-complaint.

8. Data Retention

We retain your account and workspace data for as long as your account is active. Client clinical records you store are held to support your professional record-keeping duties (typically eight years after the last session for adult clients, or until a young person's 25th/26th birthday under CNHC-style guidance — you remain responsible for your own retention policy and insurer requirements).

We do not automatically delete clinical records when a subscription or trial ends. You can export your data from Settings while you have access, or email us for an export if your subscription has lapsed. If you request account deletion, we will provide an export on request and then remove your personal account data within 30 days, except where retention is required by law or you instruct us to keep records longer for your professional obligations.

9. Cookies and similar technologies

We use essential first-party cookies so the Service can work: for example, Supabase authentication and session cookies when you sign in, and short-lived cookies for OAuth connections (Google Calendar, Outlook, Zoom, Stripe). These are strictly necessary for the Service you have asked us to provide.

Vercel Web Analytics and Speed Insights are configured as described in section 2; according to Vercel, they do not use third-party or advertising cookies for analytics.

We also use optional Google Analytics 4 and Google Ads tags. These only store analytics or advertising cookies after you accept via our cookie banner. Until then (or if you reject), Google Consent Mode keeps analytics and ad storage denied. Full detail is in our Cookie Policy.

10. Children

The Service is not intended for anyone under 18 years of age. We do not knowingly collect data from minors.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email or through the Service. The “Last updated” date at the top will always reflect the most recent version.

12. Governing Law

This Privacy Policy is governed by the laws of England and Wales, regardless of your country of residence or where you access the Service. This is without prejudice to your UK data protection rights described in this policy, or any mandatory rights under the law of your country that cannot lawfully be excluded.

13. Contact

For any privacy-related queries, please contact us at info@hypnoadminpro.com.