Privacy policy
How I look after your data.
I run this site and my private work myself, as a French micro-entrepreneur. This page explains what personal data I collect, why I collect it, who helps me handle it and what you can ask me to do with it.
The short version: I collect what I need, I don’t sell it, and what you share in our work stays private.
1. Who’s responsible for your data
The data controller is:
- Alexia Leachman EI (entrepreneur individuel, micro-entreprise), France
- SIRET: 891 526 121 00027
- Email: hello@alexialeachman.com
Because I’m based in France, I follow the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés). The supervisory authority is the CNIL, cnil.fr. If you’re in the UK, the UK GDPR gives you the same rights and you can also go to the ICO, ico.org.uk.
2. What I collect
Things you tell me
- Contact details: your name, email address, phone number and, if you buy something, your billing address.
- Work context: your business, your role and whatever you tell me in a form, an application or an email.
- Purchase details: what you bought, when and for how much. Card details are handled by the payment providers. I never see or store your full card number.
- The Wednesday email: your email address, and whether you open and click the emails.
- The AlexAI chat: whatever you type into the chat (the Chat to AlexAI button on every page).
Sensitive information
My work is emotional and psychological. If you apply for or do private work with me, you’ll probably tell me about things like stress, burnout, anxiety, your patterns, your history and your wellbeing. The GDPR treats this as health data, which is a special category.
I only use it with your explicit consent (GDPR Article 9(2)(a)), which you give when you share it with me in an application, an assessment or the work itself. You can withdraw that consent at any time by emailing me. That doesn’t undo anything done lawfully before, and it may mean we can’t carry on with the work.
The website forms only need a line or two about what’s going on. Keep the private detail for when we talk.
Things collected automatically
- Technical data: your IP address, browser, device and operating system, recorded in the web host’s server logs.
- Usage data: which pages you visit and where you arrived from, recorded by Google Analytics and Improvely, and only if you say yes in the cookie banner. The cookie policy has the detail.
3. What I do with it, and the legal basis
| Why | What data | Legal basis |
|---|---|---|
| Reply to your enquiry, form or fit conversation request | Contact details, work context | Legitimate interest (you asked me to) |
| Work out with you whether we’re a fit | Work context, sensitive information | Explicit consent |
| Do the work you’ve bought | Contact details, sensitive information | Contract, plus explicit consent for sensitive information |
| Take payment and keep my accounts | Contact details, purchase details | Contract and legal obligation |
| Send receipts, booking links and access details | Contact details | Contract |
| Send the Wednesday email and tell you about my work | Contact details, email activity | Consent |
| Understand how the site is used | Usage data | Consent (the cookie banner) |
| Keep the site secure and working | Technical data | Legitimate interest |
| Answer you in the AlexAI chat | What you type | Legitimate interest (you started the chat) |
I don’t sell your data. I don’t make automated decisions about you that have legal or similarly significant effects.
4. Who helps me
These services handle data on my behalf. Where one is outside the EU, the transfer is covered by the EU Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework.
| Service | What it does | Where |
|---|---|---|
| HighLevel (LeadConnector) | Contact records, forms, bookings and email | USA |
| ThriveCart | Checkout pages | Outside the EU |
| Stripe | Card payments | EU and USA |
| PayPal | PayPal payments | EU and USA |
| Google Analytics | Site statistics, only with your consent | USA |
| Improvely | Which pages and sources lead to signups, only with your consent | USA |
| Google Fonts | The fonts on this site. Your browser fetches them from Google, which sees your IP address | USA |
| Pickaxe | The AlexAI chat and the AI model behind it | USA |
| A2 Hosting | Website hosting | Netherlands |
| Zoom | Our video calls | USA |
5. How long I keep it
| Data | How long |
|---|---|
| Enquiries and applications that don’t go further | 12 months |
| Client records | 3 years after we last worked together |
| Invoices and accounting records | 10 years, as French law requires |
| My session notes | No longer than one month |
| Mapping session recordings | Until you’ve downloaded your copy, and no longer than a month |
| The Wednesday email | Until you unsubscribe, or 3 years after you last opened or clicked |
| Analytics | 14 months |
| Server logs | Up to 12 months |
After that, data is deleted or fully anonymised. You can ask me to delete your data sooner, apart from the records the law says I have to keep.
6. What you share in our work
What you share in our work is confidential. I don’t share it with anyone without your permission, unless the law requires it or someone’s safety is at serious risk.
Recordings. I record the mapping session at the start of our work. I use that recording in the first week, and I share it with you so you can watch it back. Once you’ve downloaded your copy, I delete mine, and I don’t keep it for more than a month. If we do a wound healing on a call, I record only that part, with you muted, so the recording is just my voice. I don’t record any other calls.
Notes. My session notes are a few scribbled words, like “responsibility” or “people saying no”. They don’t identify you, and I keep them for no longer than a month.
7. Your rights
You can ask me to:
- show you the data I hold about you and give you a copy
- correct it
- delete it
- limit what I do with it
- send it to you or someone else in a usable format
- stop using it, including for marketing, which you can stop at any time with the unsubscribe link in any email
You can also withdraw any consent you’ve given, and under French law you can tell me what you’d like to happen to your data after your death.
Email me at hello@alexialeachman.com. I’ll reply within one month, and I may need to check it’s really you first. If you’re not happy with how I’ve handled your data, you can complain to the CNIL (or the ICO in the UK). I’d appreciate the chance to sort it out with you first.
8. Keeping it safe
The site and every service I use run over HTTPS. Access to your data is limited to me and the services listed above. Private material from our work is kept in accounts with restricted access. If there’s a data breach, I’ll tell the CNIL within 72 hours where the law requires it, and I’ll tell you if it puts you at high risk.
9. Age
My work is for adults. If you think I hold data about someone under 18, email me and I’ll delete it.
10. Other sites
This site links to other sites, including my other brands and my Substacks. They have their own privacy policies.
11. Changes
If I change this policy, the new version goes here with a new date.
Last updated: 28 September 2026