1. Who is responsible
The Chef Choice Limited, trading as AFTER BEFORE, is the data controller. Company number 14268835. Registered office: 650 Anlaby Road, Hull, England, HU3 6UU. Privacy contact: info@afterbefore.co.uk.
2. The current public website
The public website does not use advertising, behavioural profiling, marketing pixels or audience analytics. The free 7-Day Reset does not ask for your name or email. The protected REBUILT members' area is provided through Systeme.io, which processes account and course-access information. The free Reset saves written answers, completed days and your last day locally in your browser when storage is available. The optional public reflection sample also saves its answer locally in your browser. It is not sent to AFTER BEFORE or used for marketing. Clear answers with the relevant clear button or remove all local data through your browser settings. The Reset’s download button creates a text file on your device; keep it somewhere private. These answers and downloads are not automatically synchronised across devices. Written answers in the programme also require the same browser for local saving; browser data is not a cross-device backup.
The hosting service may process limited technical information such as IP address, browser details, request time and security events to deliver and protect the site. This is used only where necessary for service delivery, security and fraud prevention.
3. Information used for orders and support
The minimum information used is:
| Order details | Name, email, product, price, payment status and transaction reference. Used to perform the contract, provide access, issue confirmations and keep legally required accounting records. |
|---|---|
| Programme delivery | Purchase email and access status. Used to send the programme link and provide customer support. |
| Support messages | Your contact details and the content of your enquiry. Used to respond, resolve access problems and protect legal rights. |
| Marketing choice | Email address, consent wording, date, source and unsubscribe status. Used only with valid consent or the limited existing-customer exception where it lawfully applies. |
| Technical security data | Device, browser, IP and system logs. Used for security, fraud prevention and reliable operation. |
REBUILT app account progress
The optional app at /app uses ChatGPT sign-in. OpenAI Sites supplies your site-specific account ID and email. We use your email to check existing REBUILT access against payment records or Systeme.io enrollment. We store lesson identifiers, completion flags and last-opened times against your account ID to resume your programme across devices. This is used to provide the app service. Written reflections are saved only in your browser, separated by account email; they are not uploaded to the app server. Download and clear controls are available under Your notes. An unlocked shared browser can expose locally saved reflections. The app requires internet access and does not send reminders or marketing messages.
Optional iOS and Android app connections
The mobile app uses your existing ChatGPT sign-in through the phone’s browser to verify course access. When you choose Connect my app, we store your site-specific account ID, purchase email, a hashed one-time connection code and a hashed app access credential. Connection codes expire after five minutes and can be used once with the app’s proof key. App access expires after 30 days and can be revoked. Expired records are removed during later connection requests. The phone keeps its access credential in protected device storage. Lesson completion and your recent lesson use the same account progress records as the web app. Guided written reflections stay in protected storage on the phone and are not uploaded. Exporting shares a plain-text copy with the destination you choose. Signing out clears that phone’s credential; written answers remain available on the same phone when you reconnect the same account. Delete my app data removes account-saved lesson progress, app access connections and written REBUILT answers on the current phone. It does not delete your course purchase, ChatGPT account or copies on other phones. The free reset has separate local notes and a separate clear control. No marketing or reminder emails are sent by this connection flow.
Sensitive information
AFTER BEFORE will not ask you to provide medical records, diagnosis, substance-use history or recovery details to join a list or buy the programme. Contacts will not be labelled or profiled by addiction, alcohol use or health status. Please do not include sensitive health details in routine support messages.
4. Our email-marketing promise
- Marketing consent will be a separate, optional and unticked choice. It will not be required to obtain the free reset or buy REBUILT.
- The wording will name AFTER BEFORE, describe the type of email and record when and how consent was given.
- Purchase receipts, access emails and essential service notices will be kept separate from promotional content.
- Every marketing email will identify the sender and include a working unsubscribe link or simple reply-to-opt-out method.
- Unsubscribe requests will be acted on promptly. A minimal suppression record may be retained so the address is not accidentally re-added.
- No bought, scraped or shared marketing lists will be used. People will not be asked to supply friends’ contact details.
- Email tracking pixels will not be used at launch. If that changes, the notice and any required consent will be updated first.
The limited “soft opt-in” may only be considered for an existing customer who bought or negotiated to buy a similar product and was offered a clear opt-out when their details were collected and in every later message.
6. How long information will be kept
- Marketing consent: until consent is withdrawn or the list is closed, with periodic review of inactive contacts.
- Suppression record: only the minimum needed to honour an opt-out.
- Order and accounting records: for the period required by tax and consumer law.
- Course account and progress: while access is provided, then deleted or anonymised when no longer needed.
- Support enquiries: only as long as needed to resolve the enquiry and handle any legal claim.
- Security logs: for a short, proportionate period unless needed to investigate abuse or fraud.
7. Your data-protection rights
Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or an objection to use of your information. You may withdraw marketing consent at any time without affecting earlier lawful use.
Send a rights request to info@afterbefore.co.uk. You also have the right to complain to the Information Commissioner’s Office.