Mastermind9 App

Privacy Policy

for the Mastermind9 App (the “App”)

Effective date: 22 September 2026

1. Who we are

The App is provided by Outside Ideas Ltd, trading as Mastermind9 (“Mastermind9”, “we”, “us”, “our”), a company registered in England and Wales whose registered office is at 2nd Floor Wessex House, 127 High Street, Hungerford, England, RG17 0DL.

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Mastermind9 is the data controller of the personal data described in this policy.

2. Who this policy applies to

The App is currently only available to existing Mastermind9 members in the UK. This policy covers the personal data we collect and use through the App itself — it does not cover the mastermind9.com website, which has its own privacy policy and cookie policy.

3. What data we collect

Because the App is built around goal-setting, accountability and business performance tracking within your mastermind group, it holds more sensitive commercial information than a typical membership account. We collect:

Account and identity data

• Name, email address and phone number
• Login credentials
• Your mastermind group and assigned coach/facilitator

Goals, planning and accountability data

• Targets, milestones and action plans you set within the App
• Progress updates, check-ins and notes you or your coach add against those targets

Business and financial performance data

• Figures you submit for accountability purposes — e.g. revenue, turnover, KPIs, or other business metrics tracked in the App

Usage data

• Log-in times, device and browser/app version information
• Crash reports and diagnostic logs

4. How we collect it

• Directly from you, when you create an account or enter information into the App
• From your coach or facilitator, where they log notes or updates on your behalf
• Automatically, through your use of the App (see Usage data above)

5. Why we use it, and our legal basis

We only use your personal data where we have a proper legal basis to do so:

• Performance of a contract — to provide the accountability and planning features that are part of your membership.
• Legitimate interests — to run and improve the App, support coaches in running effective sessions, and keep the service secure.
• Legal obligation — e.g. keeping records for accounting, tax or regulatory purposes.
• Consent — for anything optional, such as non-essential analytics or communications, which you can withdraw at any time.

6. Who sees your data

Within your mastermind group

• Your assigned coach or facilitator can see everything you record in the App, including your goals, progress notes and financial or business performance figures, in order to support and hold you accountable.
• Other members of your mastermind group can see your goals for the current period (e.g. your quarterly targets), so the group can support one another — but they cannot see your financial or business performance figures. Those are visible to your coach only.

Service providers who process data on our behalf

We use the following categories of third party to run the App. They only process your data under our instructions and under contract (including a data processing agreement where required):

• Supabase — our database, authentication and storage provider. Our Supabase account is a UK-based account, hosted in Supabase’s UK (London) region, meaning your core data (database, authentication and file storage) is held in the UK.
• Supabase’s own infrastructure and support sub-processors (e.g. cloud hosting, monitoring and error-tracking tools) — some of these are based outside the UK. Where that happens, appropriate safeguards (such as the UK’s International Data Transfer Addendum or equivalent standard contractual clauses) are put in place. An up-to-date list of Supabase’s sub-processors is available from Supabase on request.
• Fluff Software — our app development agency, who build and maintain the App on our behalf.
• Any analytics, crash-reporting or push-notification tools built into the App by Fluff Software, where used — these only process the usage and device data described in Section 3, under our instructions.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

Other disclosures

We may disclose data where we’re legally required to (e.g. to a regulator or law enforcement), or to protect the rights, property or safety of Mastermind9, our members, or others.

7. Where your data is stored

Your core App data (account records, goals, progress notes and business performance data) is hosted with Supabase on our UK-based Supabase account, in Supabase’s UK (London) region — so it sits on UK-based infrastructure. Some ancillary processing — such as backups, system monitoring, or customer support tooling used by Supabase or our developer — may involve providers outside the UK. Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place (such as the UK International Data Transfer Addendum) before that transfer happens.

8. How long we keep your data

• While you’re an active member: for as long as your membership continues.
• After membership ends: your account, goals and progress data are deleted or anonymised within 12 months of your membership ending.
• Financial and business performance figures: we keep these for 6 years after your membership ends, in an archived form rather than as part of your live App account.

9. Your rights

Under UK GDPR, you have the right to:

• Request access to the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request erasure of your data, where there’s no good reason for us to keep processing it
• Object to processing based on legitimate interests
• Request restriction of processing in certain circumstances
• Request a portable copy of data you’ve provided to us
• Withdraw consent at any time, where we’re relying on consent

To exercise any of these, contact us using the details in Section 15. We will respond within 30 days, and will let you know if we need longer for a particularly complex request (UK GDPR allows up to a further 2 months in that case).

Deleting your account

If you ask us to delete your App account and data, we will do so within 30 days of verifying your request, other than the financial/business performance records we retain under Section 8. Supabase’s tools support full deletion of a user’s authentication and database records, so this is technically achievable within that timeframe.

10. Security

• Data is encrypted in transit (TLS) and at rest (AES-256) by Supabase
• Access to member data within the App is limited to those who need it to do their job (e.g. your coach, or admin staff)
• Supabase holds SOC 2 Type 2 and ISO 27001 certification for its platform
• We have procedures in place to identify, investigate and, where legally required, report data breaches

11. Children

The App is intended for use by Mastermind9 members and is not directed at, or intended for use by, anyone under 18.

12. Cookies and similar technologies

The App may use local storage, device identifiers, or similar technology (for example, to keep you logged in, or for crash reporting and analytics) rather than browser cookies. These are used only for the purposes described in this policy, and not for third-party advertising.

13. Automated decision-making

We do not currently use your data to make any decisions about you solely by automated means (i.e. without human involvement). If this changes — for example, if the App starts generating automated recommendations or scores — we will update this policy and tell you how it works.

14. Changes to this policy

We may update this policy from time to time, for example if the App’s features change or the law changes. We’ll let you know about any significant changes through the App or by email, and encourage you to review this policy periodically.

15. Contact us and your right to complain

Questions or requests about this policy or your data should go to:

• Email: ops@outside-ideas.com
• Post: 2nd Floor Wessex House, 127 High Street, Hungerford, England, RG17 0DL

If you’re unhappy with how we’ve handled your data, we’d appreciate the chance to sort it out directly first. You also have the right to complain to the UK’s supervisory authority, the Information Commissioner’s Office (ICO): ico.org.uk/concerns, or by phone on 0303 123 1113.