Legal
A plain-English account of how Aesthetics Unlocked handles personal information across membership, courses, email, checkout and optional measurement.
Last updated · 28 August 2026
Aesthetics Unlocked® is a trading name operated by Bernadette Tobin. We are the controller for personal information collected through this site, our courses and our email programme. Questions or data requests can be sent to hello@aunlock.co.uk.
When you join, start a free course, buy a course or contact us, we collect the information needed for that action: normally your name, email address, account and course activity, messages, purchase record and the source that brought you to the site. Stripe handles card and wallet details; Aesthetics Unlocked does not receive your full card number. Security records may include limited technical information needed to prevent abuse.
We use personal information to create and secure your account, deliver course access, process purchases, send requested sign-in and course emails, answer enquiries, operate agreed follow-up and offers, measure the funnel, and meet our legal obligations. Our legal bases are performance of a contract or steps you ask us to take, consent for optional marketing measurement and marketing email, legitimate interests in keeping the service secure and improving it, and legal obligation where records must be retained.
For signed-in learners we record which lesson opens, whether it stays visible for 45 seconds, use of the Day 1 calculator and an explicit mark-complete action. These are separate signals: time on a page is not proof of completion or understanding. Daily records help us find access problems and improve course support. They contain no clinic figures and are not sent to advertising platforms. Optional marketing measurement remains governed by your cookie choice.
If you submit a course form from a campaign-tagged landing address, the form carries the campaign, ad-set and advert identifiers plus the landing path with your signup. Aesthetics Unlocked keeps this first-party source record with the member account to understand which acquisition activity results in a real enrolment. It does not require a tracking cookie and is not sent to Meta unless you separately allow optional advertising measurement.
We use selected providers to operate the service, including Supabase for member data and course access, Resend and Microsoft 365 for email, Stripe for payments, Vercel for hosting and measurement, and Cloudflare for anti-abuse checks. They receive only the information needed for their role. We do not sell personal information. Where processing takes place outside the UK, the provider's applicable transfer safeguards or adequacy mechanism applies.
Meta Pixel stays off until you actively allow Meta measurement, at a course signup, just after opening a new course, or through ‘Cookie settings’. If you allow it, Meta may receive a one-time event identifier, page context, browser identifiers and a one-way SHA-256 hash of the normalised signup email, plus limited technical data, to match and deduplicate the conversion. Separately, when you create a new free account, we send Meta a single server-side Lead event through the Meta Conversions API under our legitimate interest in measuring which adverts bring genuine members. That event is built only from what you typed into our form, the connection details of that request and the advert link you followed: a one-way SHA-256 hash of the normalised email, your IP address and browser user agent, the course name, a one-time event identifier and, if you arrived from a Meta advert, the click reference that Meta placed in that link. It reads and sets no cookie or other device storage and never includes a Meta browser identifier unless you allowed measurement. You can object at any time through ‘Cookie settings’ or by emailing hello@aunlock.co.uk, and objecting does not affect course access, email delivery or checkout. For an accepted checkout, your measurement choice still controls the server-side Purchase event.
Essential sign-in, purchase and course-access messages are sent because you asked us to provide the service. Educational follow-up and promotional offers are sent where you opted in or where another lawful permission applies. Every marketing email includes an unsubscribe route. Unsubscribing from marketing does not remove service messages needed for an active account or purchase.
We keep account and course records while the account is active and for only as long as needed afterwards; purchase and tax records for the applicable statutory period; email-marketing data until you unsubscribe or it is no longer needed; and consent or security records for as long as needed to demonstrate the choice or protect the service. The cookie policy lists browser-side durations. You can ask for the current retention position for your record at hello@aunlock.co.uk.
Depending on the circumstances, you can ask to access, correct, erase, restrict or receive a copy of your personal information, object to certain uses, and withdraw consent at any time without affecting earlier lawful processing. Email hello@aunlock.co.uk. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Necessary technology supports sign-in, security and checkout. Optional site analytics and Meta advertising measurement are off on a first visit and load only after permission. No consent panel blocks the page. Use ‘Cookie settings’ in the footer at any time to opt in or choose the two purposes separately. See the cookie policy for the current inventory and durations.
