Privacy Policy

1. Who We Are

This Privacy Policy explains how Sister Health Directory ("Sister", "we", "us", or "our") collects, uses, and protects your personal information when you visit or use our website at www.sisterdirectory.com.

Sister is a clean beauty product discovery platform operated by Bear Grylls Ventures (BGV), registered in the United Kingdom. We act as the data controller for the personal data described in this policy.

Contact for privacy enquiries:

Email: ruby@sisterdirectory.com

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

2. What Data We Collect

We collect different categories of data depending on how you interact with Sister. Below is a detailed breakdown.

2.1 Account Data

When you create an account, we collect:

| Data field | Required? | When collected |

|---|---|---|

| Email address | Yes | At signup |

| First name | No | At signup or later |

| Last name | No | At signup or later |

| Profile image URL | No | When you add a profile photo |

| Preferred region (UK/US) | No | When you set a preference |

| Bio | No | When you edit your profile |

| Twitter URL | No | When you edit your profile |

| Instagram URL | No | When you edit your profile |

2.2 Beauty Preferences (Potentially Sensitive Data)

If you choose to personalise your experience, you may provide:

Skin type (e.g., oily, dry, combination)
Skin concerns (e.g., acne, sensitivity, ageing)
Budget range
Certification preferences (e.g., organic, cruelty-free)
Ingredient blacklist (ingredients you wish to avoid)

Some of this information, particularly skin concerns and ingredient avoidance preferences, may relate to your health. We treat this as potentially sensitive data. We only collect it when you voluntarily provide it, and you can update or delete it at any time. See Section 4 for details on the lawful basis for processing this data.

2.3 Analytics and Usage Data

When you browse Sister, we automatically collect:

| Data field | Purpose |

|---|---|

| IP address | Security, fraud prevention, approximate location |

| User agent string | Browser and device compatibility |

| Referrer URL | Understanding how users find us |

| Page URL | Understanding which pages are visited |

| Duration on page | Improving content quality |

| Scroll depth | Understanding content engagement |

| Search terms entered | Improving search results and product listings |

| Device type and viewport size | Optimising layout for different devices |

2.4 Session Data

We create pseudonymous session records to understand aggregate usage patterns:

Session ID — a randomly generated UUID stored in your browser's sessionStorage (not linked to your identity)
Page views, search count, favourite count per session
Device type, browser, referrer
UTM tracking parameters (if you arrived via a marketing link)

2.5 Outbound and Affiliate Click Data

When you click through to a retailer from Sister, we record:

Product clicked and destination URL
Hashed IP address (SHA-256; we do not store your raw IP for click tracking)
User agent and referrer
Region (UK/US)

This data helps us understand product interest and supports the affiliate commissions that fund the platform. We do not track your activity after you leave Sister.

2.6 User-Generated Content

If you participate in our community features, we store:

Discussion posts (title and content, linked to your user ID)
Discussion replies (content, linked to your user ID)
Product comments and ratings (content and rating, linked to your user ID)
Favourites (which products you have saved)

2.7 Cookies, Local Storage, and Session Storage

We use the following storage mechanisms:

#### Strictly Necessary

|---|---|---|---|

#### Analytics and Functionality (Require Consent)

|---|---|---|---|

You can manage your cookie preferences at any time through our cookie consent banner. Withdrawing consent for non-essential cookies will disable analytics tracking. See Section 7 for more details.

3. How We Use Your Data

We use your personal data for the following purposes:

Providing the service — displaying products, managing your account, saving your favourites, and serving content appropriate to your region
Community features — enabling you to post discussions, comments, and ratings
Personalisation — tailoring product recommendations based on your beauty preferences (if you provide them)
Analytics — understanding how our platform is used so we can improve it
Security — detecting and preventing fraud, abuse, and technical issues
Transactional emails — sending account-related emails such as welcome messages and password resets
Affiliate tracking — recording outbound clicks to support the platform financially

We do not use your data for:

Automated decision-making or profiling that produces legal or similarly significant effects
Selling or renting your personal data to third parties
Sending marketing or newsletter emails (we only send transactional emails related to your account)

4. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis for each processing activity. The table below sets out the basis we rely on for each purpose.

| Processing activity | Lawful basis | Explanation |

|---|---|---|

| Account creation and management | Contract (Art. 6(1)(b)) | Necessary to provide the service you signed up for |

| Saving favourites and preferences | Contract (Art. 6(1)(b)) | Core functionality of your account |

| Transactional emails (welcome, password reset) | Contract (Art. 6(1)(b)) | Necessary for account operation |

| Beauty preferences (skin type, concerns, ingredient blacklist) | Explicit consent (Art. 9(2)(a)) | You voluntarily provide this potentially health-related data; you can withdraw or delete it at any time |

| Analytics and usage tracking | Legitimate interest (Art. 6(1)(f)) | We have a legitimate interest in understanding how users interact with our platform to improve it. We minimise data collected and use pseudonymous identifiers |

| Non-essential cookies and local storage | Consent (Art. 6(1)(a)) | Set only after you provide consent via our cookie banner |

| Outbound click tracking | Legitimate interest (Art. 6(1)(f)) | Necessary to operate our affiliate-funded business model. IP addresses are hashed to minimise privacy impact |

| Security and fraud prevention | Legitimate interest (Art. 6(1)(f)) | Protecting our platform and users from abuse |

| User-generated content (posts, comments, ratings) | Contract (Art. 6(1)(b)) | You choose to contribute content as part of using the platform |

Where we rely on legitimate interest, we have conducted balancing assessments to ensure our interests do not override your rights and freedoms. You can request details of these assessments by contacting us.

5. Who We Share Your Data With

We share personal data only with the following third-party service providers, each acting as a data processor on our behalf:

|---|---|---|---|---|

We do not sell, rent, or trade your personal data to any third party. We do not share data with advertising networks.

6. International Data Transfers

Our primary database is hosted by Supabase in AWS eu-west-2 (London, UK), so most of your data remains within the UK.

Some of our service providers are based in the United States. For these transfers, we rely on the following safeguards:

UK-US Data Bridge — Vercel and Resend are certified under the EU-US Data Privacy Framework, which is recognised under the UK Extension (UK-US Data Bridge) as providing adequate protection for personal data transfers.
Standard Contractual Clauses (SCCs) — Where a provider is not DPF-certified, we use UK International Data Transfer Agreements or EU SCCs (with the UK Addendum) as appropriate.

You can request further details about the safeguards in place by contacting us.

7. Cookies and Consent

Cookie Categories

We categorise our cookies and similar technologies as follows:

Strictly Necessary — These are essential for the website to function. They include your session cookie (`sister.sid`), authentication tokens, and your region preference. These do not require consent under UK PECR.

Analytics — These help us understand how visitors use our website. They include pseudonymous session identifiers used for aggregated analytics. These are only activated after you give consent.

Functionality — These remember choices you make to provide a more personalised experience. The `cookie_consent` record stores your preference so we do not ask you repeatedly.

How to Manage Consent

Cookie banner: When you first visit Sister, a consent banner allows you to accept or decline non-essential cookies and storage.
Changing your preference: You can withdraw consent at any time by clearing your browser's cookies and local storage for sisterdirectory.com, after which the consent banner will reappear.
Browser settings: You can also block or delete cookies via your browser settings. Note that blocking strictly necessary cookies may prevent the site from functioning correctly.

Under the UK Privacy and Electronic Communications Regulations (PECR) and the Data (Use and Access) Act 2025, we obtain consent before placing any non-essential cookies or similar storage on your device.

8. Data Retention

We retain your data for only as long as necessary for the purpose it was collected:

| Data category | Retention period |

|---|---|

| Account data | Until you delete your account, or 2 years after last login if the account becomes inactive |

| Beauty preferences | Until you delete them or delete your account |

| Analytics and session data | 2 years from collection, then deleted or anonymised |

| Outbound click data | 1 year from the click event |

| User-generated content (posts, comments, ratings) | Until you request deletion or delete your account |

| Favourites | Until you remove them or delete your account |

| Transactional email logs (via Resend) | 30 days (controlled by Resend's retention policy) |

| Server logs | 30 days |

When data is no longer needed, it is securely deleted or irreversibly anonymised.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data. To exercise any of these rights, please contact us at ruby@sisterdirectory.com.

Right of access (Art. 15) — You can request a copy of the personal data we hold about you. You can also export your data directly from your profile page using the "Export My Data" button.
Right to rectification (Art. 16) — You can request correction of any inaccurate or incomplete personal data. You can also update most information directly in your account settings.
Right to erasure (Art. 17) — You can request deletion of your personal data. We will comply unless we have a legal obligation to retain it.
Right to restrict processing (Art. 18) — You can request that we limit how we process your data in certain circumstances (e.g., while we verify accuracy).
Right to data portability (Art. 20) — You can request your data in a structured, commonly used, machine-readable format (JSON).
Right to object (Art. 21) — You can object to processing based on legitimate interest. We will stop unless we have compelling legitimate grounds that override your interests.
Right to withdraw consent — Where processing is based on consent (e.g., beauty preferences, non-essential cookies), you can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We will respond to all rights requests within one month. If a request is complex, we may extend this by a further two months, but we will inform you within the first month.

There is no fee for exercising your rights, unless a request is manifestly unfounded or excessive.

10. Information for US Residents

California Residents (CCPA/CPRA)

While Sister may not currently meet the revenue or data volume thresholds that trigger obligations under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), we extend the following rights to California residents as a matter of good practice:

Right to know what personal information we collect, use, and disclose
Right to delete your personal information
Right to correct inaccurate personal information
Right to opt out of the sale or sharing of personal information — We do not sell or share (as defined by the CCPA/CPRA) your personal information. No opt-out is necessary, but you can contact us if you have questions.
Right to non-discrimination for exercising your privacy rights

Categories of personal information collected (as defined by the CCPA):

Identifiers (email address, name, IP address)
Internet activity (browsing history on our site, search queries)
Inferences (region preference)

We do not sell personal information. We do not share personal information for cross-context behavioural advertising.

Other US State Privacy Laws

Residents of other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others) may have similar rights to access, delete, and correct their personal data. Please contact us at ruby@sisterdirectory.com to exercise these rights.

Do Not Track

Our website does not currently respond to "Do Not Track" browser signals, as there is no industry-standard method for doing so. However, you can decline non-essential cookies via our consent banner.

Affiliate Disclosure

Sister earns affiliate commissions when you click through to retailers and make a purchase. This is disclosed on relevant pages in accordance with Federal Trade Commission (FTC) guidelines. Affiliate tracking is limited to recording the click event on our platform; we do not track your activity on retailer websites.

11. Children's Privacy

Sister is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us immediately through the community discussion forums on the Platform and we will promptly delete it.

For users in the UK, we recommend that individuals under 16 obtain parental or guardian consent before creating an account, in line with the UK Age Appropriate Design Code.

12. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

HTTPS encryption for all data in transit
Secure, httpOnly, SameSite cookies for session management
SHA-256 hashing of IP addresses for affiliate click tracking (raw IPs are not stored for this purpose)
Database hosted in a UK/EU data centre with Supabase's enterprise security controls
Pseudonymous session identifiers rather than persistent personal tracking
Connection pooling limited to prevent database exhaustion

No system is perfectly secure. If you become aware of a security vulnerability, please contact us at ruby@sisterdirectory.com.

13. Whether Providing Data Is Required

Account data (email): Required if you wish to create an account. Without it, you can still browse products but cannot save favourites, post comments, or access personalised features.
Beauty preferences: Entirely optional. Not providing them will not affect your ability to use the platform.
Analytics data: Collected automatically if you consent to non-essential cookies. Declining consent means analytics data will not be collected, and your browsing experience will not be affected.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

Update the "Last Updated" date at the top of this page
Post a notice on our website
Where appropriate, notify registered users by email

We encourage you to review this policy periodically. Your continued use of Sister after changes are posted constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a privacy concern, please contact us: