Privacy Policy

Last updated: 17 April 2026

1. Who We Are

Holy Flow is a faith-based period tracking application and community for Christian women, operated from Edinburgh, Scotland. When we say "we", "us", or "our" in this policy, we are referring to Holy Flow.

If you have any questions about this privacy policy or how we handle your data, please contact us at [email protected].

2. What Information We Collect

Information you provide to us

• Waitlist sign-up: First name, last name, and email address when you join our waitlist.
• Contact form: Name, email address, and the content of your message when you get in touch.
• Community participation: Any information you choose to share when joining our Cycle Circles or community groups.

Information collected automatically

• Analytics data: With your consent, we use Google Analytics to collect anonymised usage data such as pages visited, time on site, browser type, and general location (country/city level). This helps us understand how people use our website.
• Cookies: We use cookies and similar technologies as described in our Cookie Policy.

Information we do not collect

Our website does not collect any health or cycle data. When the Holy Flow app launches, cycle and health data will be stored locally on your device by default. We will update this policy before launch with full details of how the app handles your data.

3. How We Use Your Information

We use the information we collect to:

• Add you to our waitlist and notify you when Holy Flow launches.
• Respond to your enquiries and messages.
• Send you updates about Holy Flow (you can unsubscribe at any time).
• Improve our website and understand how visitors use it.
• Comply with legal obligations.

4. Legal Basis for Processing (UK GDPR)

We process your personal data under the following legal bases:

• Consent: When you sign up to our waitlist, submit a contact form, or accept analytics cookies.
• Legitimate interests: To improve our website and services, provided this does not override your rights.
• Legal obligation: Where we are required by law to retain or share your data.

You can withdraw your consent at any time by contacting us at [email protected] or by updating your cookie preferences.

5. Who We Share Your Data With

We do not sell your personal data. We may share your information with the following trusted third parties who help us operate our services:

• GoHighLevel: Our website and CRM platform, which processes waitlist sign-ups and contact form submissions. Data is stored on their servers in the United States.
• Google Analytics: Anonymised website usage data (only with your consent).

All third-party providers are bound by data processing agreements and are required to protect your data in accordance with applicable laws.

6. International Data Transfers

Some of our service providers are based outside of the United Kingdom. Where your data is transferred internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses.

7. How Long We Keep Your Data

• Waitlist data: Until the app launches and you either create an account or ask to be removed.
• Contact form messages: For up to 12 months, or until your enquiry is resolved.
• Analytics data: Retained by Google Analytics for up to 14 months in anonymised form.

You can request deletion of your data at any time.

8. Your Rights

Under the UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify any inaccurate or incomplete data.
• Erase your personal data ("right to be forgotten").
• Restrict or object to certain processing of your data.
• Data portability - receive your data in a portable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please email us at [email protected]. We will respond within 30 days.

9. Data Security

We take reasonable measures to protect your personal data from unauthorised access, loss, or misuse. This includes using secure connections (HTTPS), access controls, and working only with trusted service providers. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Children's Privacy

Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Significant changes will be communicated via email where possible.

12. Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or your personal data, please contact us:

Holy Flow
Edinburgh, Scotland
Email: [email protected]