Stone Leadership

Privacy policy

What we collect, why, how long we keep it, who helps us run the site, and what you can ask us to do about it. If anything here is unclear, ask: support@stone-leadership.com.

The short version

We collect what you give us and what we need to run your courses. Nothing more.
What you write in a workbook or the survey is yours. Your coach does not see an individual's answers unless you choose to share them.
We do not sell your information, and we do not use it to advertise to you.
You can download your answers at any time, and ask us to see, correct or delete everything we hold about you.
You can close your account yourself, at any time, from your account settings.

Who we are

This site is run by (not set: Admin, Settings), (not set: Admin, Settings). Under India's Digital Personal Data Protection Act 2023 we are the data fiduciary, and under UK and EU data protection law the controller: we decide how your information is used, and we answer for it. Ask us anything about it at support@stone-leadership.com.

This notice is in English. If you would like it in any of the 22 languages listed in the Eighth Schedule to the Constitution of India, write to us and we will send it to you.

Grievance Officer

If you have a question or a complaint about how we handle your information, write to our Grievance Officer, Colin Stone, at colin@stone-leadership.com, or by post to (not set: Admin, Settings), (not set: Admin, Settings). You can also use Contact us; put "Grievance" at the start of the subject so it reaches him quickly. We will acknowledge it, and answer it in full within 30 days. Indian law allows us up to 90 days; we aim to be much quicker than that.

What we collect, why, and for how long

Each row is one kind of information. "Until you close your account" means it is deleted the moment you close it; copies in our backups go as the backups are replaced, within 30 days.

What	Examples	Why	How long we keep it
Your account	Your name, email address, and a phone number if you add one. A scrambled form of your password, never the password itself. If you turn on an authenticator app, its secret key, stored encrypted.	To let you sign in, keep your account safe, and reach you about your account.	Until you close your account.
Your phone number	Only if you add one. We send a text message with a code, once, to check the number is yours.	To confirm the number. We do not use text messages for anything else: not for signing in, and not for resetting a password, which is done by email.	Until you remove it or close your account.
Signing in	When you signed in, whether it worked, the email address typed, the internet address it came from and the browser used. Sign-in codes we email you.	To keep your account safe, lock it after repeated failed attempts, and spot someone trying to get into it.	Sign-in records (one for each attempt, whether it worked or not) are kept for two years (Indian law asks for at least one), and are not deleted when you close your account. Codes are deleted when you close your account.
What you write	Workbook answers, including earlier versions when you change one; which answers you have shared with Andrea.	So your work is saved and you can come back to it. It is the point of the course.	Until you delete it or close your account.
The survey	Your answers, your score in each dimension, the written reading of your results, and the courses recommended from them.	To give you your results, your reading and your recommendations.	Until you close your account.
Asking which course is for you	What you write when you ask, and the suggestions you were given.	To suggest courses that fit.	Until you close your account.
How you use the courses	Which lessons you have opened and finished, how much of a video you have watched, and when you moved into and out of a workbook question. Never what you were typing until you save it.	To show you your progress and pick up where you left off, and, never identifying anybody, to improve the courses.	Until you close your account.
Course ideas	Course ideas you send us.	To plan new courses.	A course idea you sent is kept after you close your account, no longer linked to you.
Time with Andrea	The coaching hours that came with a course, the sessions you booked or cancelled, and the Zoom link for each.	To run the session and keep count of your hours.	Until you close your account.
Purchases	What you bought, the price and tax, your GSTIN if you gave one, invoices with your name and email address, refund requests and refunds, and the payment reference Razorpay gives us.	To give you what you paid for, to deal with refunds, and because tax and company law require us to keep records of sales.	For as long as Indian tax and company law require: at present eight years. These are kept after you close your account.
Messages	What you send through Contact us, and our replies.	To answer you, and to have a record of what was asked and answered.	Kept after you close your account. Ask us and we will delete them.
Emails we send you	A log of the reminder and notice emails sent: the address, the subject and whether it went.	So we do not send the same email twice, and can check what was sent.	Kept after you close your account. Ask us and we will delete it.
Requests about your information	Your name, email address, when you asked and that we answered.	To answer the request, and to be able to show that we did.	Two years. What we show you is not kept: you see it on the page and can download it then.

What

Examples

Why

How long we keep it

Your account

Your name, email address, and a phone number if you add one. A scrambled form of your password, never the password itself. If you turn on an authenticator app, its secret key, stored encrypted.

To let you sign in, keep your account safe, and reach you about your account.

Until you close your account.

Your phone number

Only if you add one. We send a text message with a code, once, to check the number is yours.

To confirm the number. We do not use text messages for anything else: not for signing in, and not for resetting a password, which is done by email.

Until you remove it or close your account.

Signing in

When you signed in, whether it worked, the email address typed, the internet address it came from and the browser used. Sign-in codes we email you.

To keep your account safe, lock it after repeated failed attempts, and spot someone trying to get into it.

Sign-in records (one for each attempt, whether it worked or not) are kept for two years (Indian law asks for at least one), and are not deleted when you close your account. Codes are deleted when you close your account.

What you write

Workbook answers, including earlier versions when you change one; which answers you have shared with Andrea.

So your work is saved and you can come back to it. It is the point of the course.

Until you delete it or close your account.

The survey

Your answers, your score in each dimension, the written reading of your results, and the courses recommended from them.

To give you your results, your reading and your recommendations.

Until you close your account.

Asking which course is for you

What you write when you ask, and the suggestions you were given.

To suggest courses that fit.

Until you close your account.

How you use the courses

Which lessons you have opened and finished, how much of a video you have watched, and when you moved into and out of a workbook question. Never what you were typing until you save it.

To show you your progress and pick up where you left off, and, never identifying anybody, to improve the courses.

Until you close your account.

Course ideas

Course ideas you send us.

To plan new courses.

A course idea you sent is kept after you close your account, no longer linked to you.

Time with Andrea

The coaching hours that came with a course, the sessions you booked or cancelled, and the Zoom link for each.

To run the session and keep count of your hours.

Until you close your account.

Purchases

What you bought, the price and tax, your GSTIN if you gave one, invoices with your name and email address, refund requests and refunds, and the payment reference Razorpay gives us.

To give you what you paid for, to deal with refunds, and because tax and company law require us to keep records of sales.

For as long as Indian tax and company law require: at present eight years. These are kept after you close your account.

Messages

What you send through Contact us, and our replies.

To answer you, and to have a record of what was asked and answered.

Kept after you close your account. Ask us and we will delete them.

Emails we send you

A log of the reminder and notice emails sent: the address, the subject and whether it went.

So we do not send the same email twice, and can check what was sent.

Kept after you close your account. Ask us and we will delete it.

Requests about your information

Your name, email address, when you asked and that we answered.

To answer the request, and to be able to show that we did.

Two years. What we show you is not kept: you see it on the page and can download it then.

We never see your card or bank details. Payment happens in Razorpay's own window and only the outcome comes back to us.

If your organisation arranges a place on a course for you, it may give us your name and email address so that we can invite you. We do not tell your organisation what you write.

Why we are allowed to use it

Under Indian law we use your information either because you consented to it, or because you gave it to us yourself for a particular purpose (creating an account, buying a course, booking a session, writing to us) and we use it only for that purpose. We keep purchase records because the law requires it.

If you live in the UK or the European Union, the UK GDPR (or the EU GDPR) gives you the same rights described below. Our lawful bases are:

contract: to run your account, give you the courses and coaching you bought, and take payment;
consent: sharing your answers with Andrea, being told when a course opens, and signing in with Google or Microsoft;
legitimate interests: keeping the site and your account secure, reminding you of a course you started, and improving the courses from figures that never identify anybody;
legal obligation: keeping records of sales for tax.

You can complain to the UK Information Commissioner's Office (ico.org.uk), or to the data protection authority where you live in the EU. We would like the chance to put it right first, so please write to us too.

Consent, and taking it back

Where we rely on your consent, taking it back is as easy as giving it, and you never need a reason:

Sharing your answers with Andrea: switch it off, answer by answer or all at once, on your answers.
Reminder emails, and being told when a course opens: the link at the foot of every reminder, which shows each email you can stop; or the switch on your information, or "No thanks" on the course.
Everything: close your account, or make a request.

Taking consent back stops that use from then on. It does not undo what was done while you had agreed, and it does not end what we need to keep by law. All of these choices are gathered on consent preferences.

Who sees your answers

Anything you write and do not share stays between you and your own record. Your coach sees how a group is moving (how many people answered a question, never what an individual wrote) and figures drawn from fewer than five people are never shown. If you choose to share an answer with Andrea, she can read that answer, and you can stop sharing it whenever you like. If you book time with Andrea, she sees your name and email address on the booking.

Where AI is used

Some features use an AI model to produce their answer. The model comes from an AI model provider, at present Anthropic's Claude. We may reach it directly from Anthropic or through Amazon Web Services (Amazon Bedrock), or use a model from another provider; whichever we use, the same limits below apply.

when you ask which course is for you, what you write is sent to produce the suggestions;
when you ask for a reading of your survey, your score in each dimension is sent to write it, not your individual answers;
course recommendations from your survey are put in order from your scores, without AI; where Andrea has not written the reason for a recommendation herself, an AI model may write it, from your scores only;
when you send us a suggestion, we may use an AI model to help draft our reply, so the text of your suggestion and your first name are sent; a person reads and sends every reply.

Only what is needed for that one answer is sent, at the moment you ask for it. Under the provider's commercial terms it is not used to train their models. Nothing you write in a workbook is sent to an AI model unless you have shared it, and even then only with your name and anything identifying you removed, as our terms of use explain. No decision with legal or similarly significant effects on you is made by AI alone.

Who helps us run the site

These companies process information for us, only to provide their service and only on our instructions, under contract:

Amazon Web Services: hosts the site, its database and its files, in Mumbai, India. Through it we also send our emails (Amazon SES) and the text message that confirms a phone number (Amazon SNS). Two more AWS services work only on Andrea's own lessons, never on anything of yours: Amazon Transcribe writes the captions from her voice, and Amazon Polly can read a lesson script aloud.
Razorpay (India), takes payments and makes refunds.
Cloudflare: only on the page where you ask what we hold about you, its Turnstile box checks you're a person rather than a program. It sees your internet address and browser.
Bunny.net: streams the lesson videos. When you watch, it sees your internet address and browser, as any website you load does.
Zoom: hosts coaching sessions. When you book, we ask Zoom to make the meeting; we send it the course name and the time, not your name or email address. When you join, Zoom handles what you share in the meeting (the name you enter, your video and voice) under its own terms.
AI model providers: at present Anthropic, directly or through Amazon Web Services, for the features listed above.
Google and Microsoft: only if you choose to sign in with them. They tell us your name and email address; we never see your password with them. If you write to us by email, it arrives in our Microsoft 365 mailbox.

We will share information with anyone else only if the law requires us to, or to protect somebody's safety. If you ask us, we will tell you which of these companies have your information.

Where your information is processed

Our database and files are in India, in Amazon Web Services' Mumbai region. Some of the companies above work outside India: Anthropic, Zoom, Google and Microsoft mainly in the United States, and Bunny.net, which serves videos from the location nearest you. Indian law allows this except to countries the Government of India has restricted. For people in the UK and EU, we rely on the safeguards the law recognises, such as the providers' standard data protection clauses or the UK–US data bridge, and each provider is bound to protect your information to the standard the law requires.

Keeping it safe

Everything travels over an encrypted connection, and browsers are told never to use an unencrypted one.
Passwords are stored only in a scrambled form that cannot be turned back into the password, and an authenticator app's key is stored encrypted.
An account is locked after repeated failed sign-ins, and you can add a second step with an authenticator app.
The database and files are private: access is limited to the people who run the site.
What you write in a workbook is not shown to anyone else unless you share it.

If something goes wrong

If there is a breach of personal data that affects you, we will tell you without delay: what happened, what it means for you, what we are doing about it and what you can do. We will also tell the Data Protection Board of India, and where the law requires it the UK Information Commissioner's Office, within 72 hours of finding out.

Your rights

Wherever you live, you can ask us to:

tell you what we hold: a summary of your information and what we do with it, and who we have shared it with, or a full copy;
correct, complete or update anything that is wrong or missing;
delete your account and your information, except what the law requires us to keep;
stop or limit how we use it, or object to a particular use;
withdraw a consent you gave us;
hear a complaint: our Grievance Officer, above;
nominate someone to use these rights for you if you die or become unable to act for yourself. Tell us their name and email address through Contact us, and you can change or cancel it at any time.

To see what we hold, use What do you hold about me?: we email you a code to check the address is yours, then show you everything at once, with or without an account. You can also do these yourself, straight away: download what you have written from your answers, change your details in account settings, change your choices in consent preferences, or close your account. For anything else, use Contact us; we will reply within 30 days, and usually much sooner.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India, once you have first raised it with our Grievance Officer. In the UK, the Information Commissioner's Office; elsewhere, the data protection authority where you live.

Indian law also asks something of you: that the information you give us is true, and that you do not pretend to be someone else or make a request you know to be false.

Children

These courses are written for working adults. They are not for anyone under 18, and you must be 18 or over to create an account. If we learn that an account belongs to someone under 18, we will close it and delete its information.

Cookies

We use only the cookies the site needs to work, and no analytics or advertising cookies. The full list is in the cookie policy.

Changes

If we change how we use your information in a way that matters, we will tell you by email before it takes effect, rather than quietly editing this page, and where the change needs your consent we will ask for it. The date below says when this page last changed.

Last updated 26 October 2026.