1. Welcome and who we are
Your privacy matters to us. Sanctuary by Orion’s Embrace is an online wellbeing and personal-reflection website operated by Orion’s Embrace CIC. This combined Privacy & Cookies Policy explains what personal information we use when you browse the website, hold a membership, use Sanctuary features or contact us. It also explains the choices and rights you have.
Website: https://orionssanctuary.co.uk
Data controller: Orion’s Embrace CIC (company number 16405494)
Privacy contact: jenny@orionssanctuary.co.uk
Registered/contact address: 47 Long John Hill, Norwich, Norfolk, NR1 2JW
ICO registration (CIC): Our Director Jenny Wild is currently registered with the Information Commissioner’s Office (ICO) as a sole trader, under registration number ZC077211.
Please contact us using the details above to ask questions about your personal information, exercise your privacy rights or raise a concern.
2. What information we collect
The information we handle depends on the membership and Sanctuary features you choose. Some details below are collected only when a relevant feature or preference is enabled:
- Account and membership details: name or preferred display name, email, username, account preferences, registration date and membership level. Starlight is the free membership; Constellation is the £5 monthly plan; Galaxy is the £50 annual plan; and complimentary full access may be assigned to eligible Orion’s Embrace CIC clients (working name: Guiding Star). WordPress handles account passwords.
- Optional details: date of birth where age verification or a separately chosen birthday greeting is enabled; and town/city or county only if you choose to provide it for relevant local updates.
- Membership and payment records: for paid memberships we may process the selected plan, renewal and payment status, billing details and transaction references needed to manage subscriptions, refunds and accounts. Payment card details are handled through the checkout/payment provider rather than stored as Sanctuary Journal entries.
- Wellbeing and personal entries: your selected moods, daily intentions, evening reflections, Oracle and Affirmation Card results, questions and activities you choose to open. Full Sanctuary members may also record completion status and save private Pause & Ponder writing. Some entries may reveal sensitive information about health or feelings.
- Activity history: area-level Previous Activities for all registered members (including dates, times and resources opened or revisited); and, for Full members, completed activity statuses and cross-area My Sanctuary Journey and Journal entries, including relevant card results and saved reflections.
- Contact messages: name, email, enquiry subject and the message you send through the Sanctuary contact form or by email, together with the correspondence needed to respond.
- Technical information: IP address, device/browser information, security logs, login sessions and cookies needed to operate and protect the website, plus any optional analytics or embedded-media data that you agree to.
The Sanctuary is intended for adults aged 18 and over. We will not require more information about an Orion’s Embrace client’s treatment or support sessions just to give them complimentary Sanctuary access. You decide what to record in your own reflections; if you enter health or other special-category information, additional safeguards and a separate legal condition apply.
Complimentary client access: eligible people receiving support through Orion’s Embrace CIC may be given a Guiding Star membership, with full access during the relevant support period and one additional month. The Sanctuary needs only sufficient account and eligibility dates to administer this access; practitioner notes and support-session details are not required.
3. How and why we use information
We process information only for relevant purposes and with an appropriate lawful basis under UK data protection law. The main intended purposes and bases are:
| Purpose | Lawful basis |
| Create and manage member accounts and access | Contract — providing the Sanctuary account and membership requested. |
| Administer paid subscriptions and payment records | Contract; legal obligation where financial/tax records must be retained. |
| Verify complimentary Guiding Star eligibility and access dates | Contract or legitimate interests, depending on the arrangement; only minimal eligibility/access information is needed. |
| Protect the website and accounts from misuse | Legitimate interests in providing a secure service; legal obligation where applicable. |
| Store activity history, personal tools and reflections | Contract for requested membership features, including free Previous Activities and Full Journey/Journal, Favourites, Bookmarks and saved layout choices. Any special-category information requires a separate valid UK GDPR Article 9 condition. |
| Respond to member enquiries and requests | Contract or legitimate interests, depending on the enquiry; legal obligation where applicable. |
| Send optional birthday greetings | Consent through a separate preference, if this feature is activated. |
| Send optional Embrace marketing emails | Consent through a separate, unticked opt-in, if this is offered. |
| Use non-essential cookies or optional third-party embeds | Consent where required under UK cookie/privacy rules. |
Sensitive wellbeing entries can sometimes contain special-category data. Before relying on explicit consent for that processing, we must provide a separate, clear choice, keep evidence of it and offer a way to withdraw it. This is different from marketing or cookie consent. We do not use private reflections for advertising, profiling or deciding which wellbeing support to recommend.
4. Your private Sanctuary Journey and Journal
Previous Activities records eligible activities you have opened or returned to within each Sanctuary area. It is available to both Starlight and Full members. My Sanctuary Journey is a separate, private cross-area activity history for Full members, which can include completion status, dates, original results and saved reflections. Opening an activity alone does not mean it was completed.
My Sanctuary Journal is a read-only diary-style presentation of completed activities and saved results or reflections, available as an online view or printable/downloadable A4 PDF for Full members. Certain clearly labelled actions, such as “Selected to listen”, may also be included without representing completed listening. If a Full member moves to Starlight, their existing Journey and Journal stay available to read and their existing Journal can still be printed or downloaded until the relevant retention period ends. Free members cannot create new completion/Journal entries or save/edit paid-only reflections.
The usual retention period for Previous Activities, Journey, Journal and saved reflections is 13 calendar months from the original activity or event date. Returning to an activity or changing membership does not reset that period. Favourites and Bookmarks are different: Full members’ saved selections are retained while the account remains active, including after downgrading, unless removed or subject to account deletion. Personalised Dashboard layout preferences may likewise remain stored for return to Full. Private reflections are not public posts, but authorised technical access may be needed for maintenance, security, data-rights requests or legal obligations.
5. How long we keep information
- Previous Activities, Journey and Journal activity records and saved written reflections: intended to be retained for 13 calendar months from the original activity/event date, then automatically deleted once the deletion process has been implemented and verified.
- Favourites, Bookmarks and saved Dashboard layout: retained while the relevant member account remains active, including when Full access is downgraded; subject to member removal options, account closure, privacy rights and verified system settings.
- Account closure and deletion requests: we respond without undue delay and normally within one calendar month, subject to identity checks, lawful exceptions and any permitted extension. Some financial and other legally required records cannot always be deleted immediately.
- Invoices, payment and accounting records: normally retained for the applicable tax/accounting period (often six years), with actual retention verified against the CIC’s obligations.
- Support correspondence: normally up to 12 months after an enquiry has been resolved, unless longer retention is necessary.
- Routine security logs: normally up to 90 days, unless a longer justified period is necessary for security or legal reasons.
- Cookie-consent records: retained according to the Complianz consent-management settings.
We may keep certain records longer where reasonably necessary for legal, accounting, security or dispute purposes. Website backups follow their own restricted retention and secure-deletion cycle. Downloaded or printed A4 Journal copies kept by you are outside our website’s automatic retention process.
6. Who receives your information
We use services and suppliers to operate Sanctuary, manage accounts and support members. The providers described below reflect the intended arrangements and will be updated to match those actually in use:
- Hostinger: website hosting and related infrastructure.
- WordPress and Paid Memberships Pro: website accounts, membership levels and access administration.
- Payments: [Insert the provider actually used at checkout, and its role, after the membership/payment integration has been tested.]
- Contact forms: messages sent through our Sanctuary contact form are processed through a WordPress form service and email notifications, when enabled. They are not automatically sent to HubSpot.
- Email, security and backup suppliers: services used to send membership notices and operate and protect the website.
- External music and media providers: services you choose to open or embedded features you consent to use; external websites have their own privacy terms.
Only if you separately opt in to Orion’s Embrace CIC updates, the minimum contact information needed for those communications (such as name, email, optional location and consent record) may be passed to HubSpot when that integration is enabled. Sanctuary mood entries, Journal reflections, payment-card details and date of birth are not transferred to HubSpot for marketing.
We do not sell your personal information. We may share information where legally required or reasonably necessary to establish, exercise or defend legal claims.
7. International transfers and security
Some service providers may handle data outside the UK. Where international transfers occur, we assess the providers and use appropriate transfer arrangements required by UK data protection law. You can ask us for more information about relevant safeguards.
We use access controls, authenticated accounts, restricted administrator permissions, security protections and practical safeguards to protect information. Sensitive member entries must not be exposed through normal member-facing lists or publicly searchable pages. No online system can promise absolute security.
8. Your data protection rights
Depending on the circumstances and any applicable legal exemptions, you can:
- Ask for a copy of the personal information we hold about you.
- Ask us to correct inaccurate or incomplete information.
- Ask for information to be deleted where the right to erasure applies.
- Ask us to restrict certain uses of your personal information.
- Object to processing based on legitimate interests, and object to direct marketing at any time.
- Request a portable copy of certain information where the law applies.
- Withdraw consent at any time where we rely on consent.
To make a request, please use the privacy contact details in Section 1 — Welcome and who we are. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk if you are unhappy with how your information is handled.
9. Sanctuary messages and Orion’s Embrace marketing
We send necessary membership, security and account messages using our Sanctuary email service. Where optional birthday greetings are offered, they are sent only if you have separately chosen to receive them.
Optional promotional messages about Orion’s Embrace CIC events, wellbeing activities and community opportunities are separate from Sanctuary membership. We send these only if you actively opt in. If a HubSpot marketing connection is enabled, only the limited agreed contact details and permission record are shared, not private Sanctuary content.
You may change your marketing preferences or unsubscribe at any time without affecting Sanctuary membership. Town/city or county will only be used for local updates if you chose to supply it. Privacy enquiries can be sent to jenny@orionssanctuary.co.uk.
10. Children and young people
Sanctuary membership is intended for adults aged 18 and over. The registration process must check eligibility and prevent underage accounts before public use. Young people’s or family-managed accounts are not part of the current launch. Any future provision for them will need a separate safeguarding and privacy review.
11. Cookies and similar technologies
Cookies and similar technologies help the website function, for example by supporting login sessions, preferences and security. Other technologies may be associated with analytics or external videos/music. Where UK law requires consent, we should not set or access non-essential cookies until you have chosen to allow them.
We use Complianz to manage cookie choices and display the live cookie list. You can accept, reject or change optional preferences using the cookie banner and the Cookie Settings link. A current list of cookies, their purposes, providers and retention periods appears beneath this section on our website.
12. Changes to this policy
We review this combined policy when membership options, Sanctuary plugins, data handling, external providers or applicable requirements change. We show the latest publication date and inform members about significant changes when required.