The data controller for your personal information is Gaskell Enterprises, trading as Vision, Support and Challenge Publishing (VSC Publishing). The platform is operated by Steve Gaskell.
Contact for privacy matters: Contact page or write to Victoria Garden House, Albany Street, Newton Abbot, Devon TQ12 2AN.
We have not appointed a Data Protection Officer. For data protection queries, use the contact details above.
Account data: email address, password (hashed), full name, service status (serving/veteran/family/supporter), username, bio, profile image, preferred check-in time.
Self-check data: physical, mental and relational scores (1–5), honest-answer text, avoiding text, action-step text, warning flags, date and time of check.
Buddy check data: buddy name, contact notes, check-in date, status (solid/wobbly/struggling/worried), concerns, action taken, follow-up flag and date.
Buddy list data: names and contact notes for people you track.
Workbook data: exercise answers, chapter references, entry dates, completion status.
Group chat messages: message content, sender name, message type (regular, check-in, support request), date and time.
Group membership data: group IDs, member IDs, admin/moderator roles, invite codes.
Technical data: IP address, browser type, device information collected automatically by our hosting platform.
Policy acceptance records: which policies you accepted, the version, and the timestamp.
Your self-checks, buddy checks and group chat messages may reveal information about your mental health. Under UK GDPR, data concerning health is special category data (Article 9). We process this data only where necessary for the purposes of providing the peer-support tools you have requested, and only on the basis of your explicit consent (Article 9(2)(a)). You can withdraw this consent at any time by deleting your account or the relevant data, as described below.
Account creation and authentication — Legitimate interests (UK GDPR Article 6(1)(f)). We need an account to provide you with personalised tools and to keep your data private to you.
Self-checks, buddy checks and workbook entries — Your explicit consent (Article 6(1)(a) and Article 9(2)(a) for health data). You choose what to enter and can delete it at any time.
Group chat messages — Your explicit consent. Messages are visible only to members of your group. You choose what to share.
Group membership and roles — Legitimate interests. We need to know who is in which group to display the group and route messages correctly.
Policy acceptance records — Legitimate interests. We need to demonstrate that you accepted our terms for contract performance and legal compliance.
Reports of content or users — Legitimate interests and legal obligation. We need to investigate reports to keep the community safe and comply with the Online Safety Act 2023.
Technical data (IP, browser) — Legitimate interests. Our hosting platform collects this for security, fraud prevention and service operation.
Your data is stored on the Base44 platform, our hosting and database provider. Base44 infrastructure is cloud-based. See the International transfers section below for details.
You: Full access to your own self-checks, buddy checks, workbook entries, buddy list, and the groups you belong to.
Group members: Members of your buddy group can see messages and your display name in that group.
Platform administrators: The platform admin (currently Steve Gaskell) has technical access to all data for service operation, moderation, and legal compliance. Admin access is logged by the platform.
Base44 (processor): Our hosting platform has access as a data processor under our instructions. See Processors below.
Google (processor): If you sign in with Google, Google processes your authentication. Google Fonts are loaded from Google's servers; no cookies are set by Google Fonts in this configuration.
We do not sell your data to any third party. We do not use advertising or marketing trackers.
Base44 infrastructure may process data outside the United Kingdom. Where this occurs, transfers are made under the safeguards required by UK GDPR Chapter V, including the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as applicable. You can request a copy of the relevant safeguards via the Contact page.
We protect your data using the security measures provided by the Base44 platform, including encryption in transit (TLS), encrypted storage, Row-Level Security on all personal data entities, and strict access controls. Only the platform admin has administrative access. See our Information Security Policy (internal) for full details.
Important: Group chat messages are not end-to-end encrypted. The platform admin and Base44 infrastructure have technical access to message content for moderation and legal compliance purposes. Do not share information in group chat that you would not want a platform administrator to see in the course of their duties.
Under UK GDPR and the Data Protection Act 2018, you have the right to:
To exercise any of these rights, use the Account page or the Contact page. We respond to all requests within one month.
We do not use automated decision-making or profiling that produces legal or similarly significant effects. The streak count and mood summary shown on your dashboard are simple calculations from data you entered; they are not clinical assessments and do not determine your access to any service.
This platform is not directed at children and is not intended for users under 18. We do not knowingly collect data from anyone under 18. If you believe a child has provided us with personal data, contact us via the Contact page and we will delete it.
We may update this Privacy Notice when our practices change or for legal compliance. We will update the effective date at the top of this page. For significant changes, we will notify you in the app or by email.
© 2026 5 and 20 · Buddy Buddy · Steve Gaskell · Vision, Support & Challenge Publishing.