Who we are
This notice covers The Curious Few’s website at thecuriousfew.io, invitation requests and private community at community.thecuriousfew.io.
Snippet Digital Limited is the operator and controller of the personal information described here. Contact suganthan@snippet.digital, or write to 15–17 Church Street, Stourbridge, DY8 1LU, United Kingdom.
KWI software and payment services have their own privacy information. This notice explains when information from those services is used for community access; it does not replace their wider policies.
Invitation requests
When you request an invitation, we ask for your name and email address and an optional note about your interests. We use them to review the request, check eligibility, resolve an account match and respond about membership. You do not have to provide the optional note.
Requests do not create an account, automatically send an invitation or subscribe you to marketing. Use your KWI account email and avoid confidential client information or sensitive personal details in the optional note. If you do not provide the name and email needed to assess a request, we cannot process it.
The request form also uses limited technical information for validation and abuse prevention. Submitted details are stored in a private Cloudflare D1 database configured for the European Union. Only authorised administrators with access to our Cloudflare account can review the queue. The database’s EU restriction does not mean all network processing or authorised administrative access takes place in the EU.
We process an IP address to limit repeated requests, using a keyed, regularly changing identifier in the application database rather than storing the raw address with your request. These short-lived rate-limit records are removed within 24 hours of expiry. Cloudflare also processes network information to deliver and protect the website. The form stores no payment details and sends no automatic email, notification or invitation.
Community information
Depending on how you use the community, we handle:
- Account records: email, username, display name, account identifiers, invitations, verification and recovery records.
- Optional profile information: biography, avatar, website, location and professional details you choose to add.
- Contributions: posts, replies, uploads, reactions, bookmarks, private messages, chat, reports and support conversations.
- Activity and security records: IP addresses, session and login information, device/browser details, pages and posts read, visit/read counters and moderation records.
- Preferences and access: notification choices, watched or muted topics, groups, trust levels and permissions.
- Eligibility: existing/free-member entitlement, relevant historical membership or payment records, qualifying KWI payment status, paid-through dates and identifiers needed to match the account.
The community does not need your payment-card details. Payment-card processing happens through the relevant payment service. Do not put card details, passwords or access tokens in profiles, posts or messages.
Where information comes from
We receive information from you when you submit a request, accept an invitation, claim an account, contribute, change your profile or contact us. The software also records information needed for sessions, security and ordinary community activity.
Existing accounts and retained contributions were migrated from the former Heartbeat community. Records may include profile information, avatars, membership details, posts and retained communications. Migration does not create consent to unrelated marketing.
For paid-customer eligibility, we use relevant information from KWI’s subscription system and its payment processor. Historical community records may help confirm returning members’ independent free-access entitlement. New membership is limited to qualifying KWI customers; existing members do not need a current paid subscription to keep their free entitlement.
How and why we use it
We use the following lawful bases where they apply to the processing and your relationship with us:
- Provide requested membership and community functions: performance of the membership agreement where necessary for that agreement. Where an employer holds the relevant contract, legitimate interests in providing the authorised benefit may apply instead.
- Review requests, claim migrated accounts and administer access: steps requested before an agreement or performance of that agreement where applicable; otherwise legitimate interests in correctly administering membership.
- Check paid eligibility and expiry: contract where necessary for the individual’s subscription benefit; otherwise legitimate interests in managing an employer/customer benefit accurately.
- Security, moderation and reliability: legitimate interests in protecting members and operating the service; legal obligation where a specific law requires processing.
- Support and privacy enquiries: contract where relevant to service delivery, legal obligation for required responses, or legitimate interests in resolving enquiries.
- Optional marketing or optional technologies: consent where required, with a separate choice and a way to withdraw it. Membership is not blanket marketing consent.
Essential account and eligibility information is needed to provide, recover or correctly match access. Profile details and the invitation-form note are optional. We do not require you to disclose sensitive personal information to participate.
Who can see your information
Signed-in members can see profiles and contributions in areas they can access. Activity such as replies, reactions and badges may also be visible where enabled. Account email addresses and login IP addresses are not part of the ordinary member profile.
Private messages and restricted areas are not available to unrelated ordinary members. However, messages and chat are not end-to-end encrypted. Authorised administrators may access relevant records when reasonably necessary for support, security, investigation or legal obligations. Moderator access depends on assigned permissions.
Login restrictions do not prevent members copying content. Some attachments and media, including course videos hosted on Cloudflare R2, can be accessed directly by anyone with the link. Do not use the community as a confidential document vault.
Providers and disclosures
The community is self-hosted. Its current setup uses:
- Hetzner: hosting the Discourse service, database and local files.
- Cloudflare: domain infrastructure; Workers hosting for the landing page; the private D1 request database and its recovery history; R2 course media and off-server Discourse backups.
- Mailgun: configured for community email delivery when sending is enabled. An EU SMTP endpoint is configured; this alone does not establish where all provider processing takes place.
- Discourse software services: software-related services and aggregate site statistics where configured. Self-hosting does not mean member records are held in Discourse’s managed hosting service.
- KWI subscription/payment systems: information needed to check payment-based community eligibility.
The landing form is separate from KWI and Discourse. It records a request for review and cannot create an account, grant access or send an invitation. It stores the version of this privacy notice in effect when the request was submitted; submitting a request is not marketing consent.
We may disclose relevant information to professional advisers, authorities or others where required by law or reasonably needed to protect rights, safety or resolve a genuine dispute. Access should be limited to what the purpose requires.
Third-party links and embeds have their own privacy practices. Loading an external resource may share your IP address and browser information with its provider. Additional processors or tracking services will need appropriate disclosure and controls before activation.
International processing
Providers and authorised personnel may process or access information in more than one country. International transfers must have the protections required by applicable data-protection law, such as an applicable adequacy arrangement or appropriate contractual safeguards.
You can request information about providers, processing locations and relevant transfer safeguards from the contact above, subject to appropriate redaction of confidential details. Our administrators may access information from outside the UK and EU; the database location restriction does not prevent this.
Emails, cookies and preferences
When enabled, community communications can include verification, recovery, invitation, security and service messages, plus activity notifications or digests according to settings and your choices. Optional notification preferences and applicable unsubscribe controls will be available. Necessary account/security messages are separate from optional marketing.
During the current review period, community email, notifications and invitations remain paused. Publishing this website or submitting a request does not enable them.
The standalone landing page uses no analytics, advertising pixels, third-party scripts or application cookies. It does not add requests to a mailing list. The community separately uses cookies and browser storage for authentication, security, preferences, reading position and ordinary functions such as draft recovery.
Google Analytics and Google Tag Manager are not configured in the community. Discourse keeps local activity records; aggregate statistics sharing is enabled. External embeds may have their own behaviour.
If optional tracking or analytics is introduced, we will explain it and provide the choices required by the applicable rules before enabling it. A “cookie-free” label does not remove privacy obligations.
Retention and deletion
We keep information for as long as its purpose requires, review continued need and delete or anonymise it when retention is no longer justified. The following periods and criteria apply:
- Invitation requests: the landing queue automatically removes requests 90 days after submission. We can remove a request earlier following an applicable erasure request. If a specific dispute requires a separate limited record, we will explain the reason and retain only what is necessary. Protected provider recovery copies may retain removed information for a further period of up to 30 days. The queue is not a permanent membership or payment record.
- Accounts and profiles: while membership is maintained, then only for a justified continuing purpose or legal requirement, subject to closure and erasure requests.
- Discussions: while useful to the community, considering privacy requests, other contributors’ rights and whether identifying details can be removed.
- Eligibility: while needed to establish free or paid access, match accounts correctly or resolve an access dispute. Keep only the necessary record.
- Security and moderation: for proportionate periods needed to protect the service and investigate incidents or disputes. We assess the period according to the nature of an incident, necessary follow-up and applicable obligations.
- Backups: until the relevant recovery copy expires under the documented backup schedule. The automated Discourse setting currently retains seven backup archives, with daily backups configured; separate manual migration copies also exist. This is not a promise that every copy expires after seven days.
- Legal records: for an applicable legal requirement or properly justified claim/dispute period.
Removed information may temporarily remain in protected backups. Restoring a backup must take account of applicable deletion decisions. Cancelling KWI does not automatically delete community posts or profiles; existing members retain their free entitlement, and new subscription-based access ends at the paid-period end.
Security and automated checks
We use measures appropriate to the service, including encrypted web connections, access controls, restricted administration and backups. No online service can promise absolute security. Keep your login details safe and tell us about suspected misuse.
Participation, trust-level, permission and anti-abuse rules can limit functions or flag content for review. When the developer-owned subscription integration is enabled, paid status and paid-through dates may automatically determine subscription-based access. Contact us for human review of an incorrect match or restriction. Free-access entitlements must remain separate.
The Discourse AI plugin is currently disabled. This policy does not authorise sending member content to a future external AI service without appropriate information, assessment and a lawful basis.
Your rights and choices
Depending on the applicable law and processing, you may have rights to access and correct your information, request erasure or restriction, receive eligible data in a portable format, or withdraw consent. Withdrawing consent does not affect the lawfulness of earlier processing.
You can object to processing based on legitimate interests. Contact us and explain your circumstances so we can consider the request under the applicable rules. You can object to direct marketing at any time.
Use account settings where available or contact suganthan@snippet.digital. We may verify your identity reasonably to protect your information. Some rights have conditions or exceptions, including where other members’ rights or legally required records are involved. We will respond within applicable legal time limits. You do not need a paid subscription to make a privacy request.
You can complain to us or to the UK’s Information Commissioner’s Office, or another competent data-protection authority. We will handle complaints under the applicable requirements.
Children and policy updates
The membership terms are for adults aged 18 or over. We do not intend the community for children. Contact us if you believe a child has supplied information so we can investigate.
We will update this notice when the service or relevant processing changes, show the effective date and draw attention to material changes appropriately. A policy update does not itself enable a new provider, marketing campaign or invitation workflow.