Privacy Policy
Last updated: 22 March 2025
What is TherapySpace
TherapySpace (therapyspace.co) is a website hosting platform for private therapists, operated by Humble Moonshots Ltd (company number 14909510). This policy explains what happens with data — both yours as a therapist using the platform, and data from visitors to the sites hosted here.
Two groups of people use TherapySpace
- Therapists — you signed up, you pay for hosting, and your website lives here
- Site visitors — people browsing a therapist's website hosted on TherapySpace
This policy covers both. Each therapist's website also has its own privacy policy covering how that therapist handles your interactions with them.
If you're visiting a therapist's website
Analytics
TherapySpace uses Plausible Analytics to understand how people use the sites hosted here. Plausible is a privacy-focused analytics tool that:
- Does not use cookies
- Does not track you across websites
- Does not collect personal information
- Only provides aggregate data ("this page had 50 views", not "this person visited this page")
The analytics script runs through the site's own domain, so your browser never contacts Plausible directly.
Cookies
Sites hosted by TherapySpace do not set any cookies. None.
Fonts
Fonts are downloaded and bundled into the site at build time. When you load a page, your browser is not making requests to Google or any other font provider.
Contact forms
Some therapist sites have a contact form. If you fill one in, your name, email address, and message are sent to the therapist by email using Amazon Web Services Simple Email Service (AWS SES).
Your form submission is not stored. Once the email is delivered to the therapist, TherapySpace no longer has access to it. What happens after the therapist receives your message is covered by their own privacy policy and professional obligations.
What TherapySpace doesn't do
- No advertising or remarketing
- No social media tracking pixels
- No fingerprinting or cross-site tracking
- No selling of data
- No cookies (worth repeating)
If you're a therapist using TherapySpace
Your account and website content
Your email address is stored to identify your account, communicate with you, and set up billing. Your website content — including your name, contact details, qualifications, and everything else that appears on your site — is stored in a PostgreSQL database hosted by Supabase. Images and other assets are stored in Supabase's file storage.
Profile imports
When first setting up your site, we may use publicly available information from professional directories like BACP, Psychology Today, or UKCP to get a head start. This is publicly listed information — your name, qualifications, areas of work, and so on.
If we build a site for you as part of outreach and you ask for it to be taken down, we will do so immediately. If there's no response at all, the site is automatically taken down after 30 days.
Payments
Stripe handles all payments. When you check out, Stripe receives your email address and your site's internal ID. Stripe handles everything else — card details are never seen or stored by TherapySpace.
Stripe's privacy policy: stripe.com/gb/privacy
AWS SES (based in Ireland, eu-west-1) handles email delivery. This includes:
- Contact form submissions from your website visitors, delivered to your inbox
- Transactional notifications from TherapySpace
Emails are sent on your behalf using a dedicated sending configuration for your account. Email content is not stored after delivery.
For everyone
Third-party services
Here's every service that handles data as part of running TherapySpace:
| Service | What it does | What data flows to it |
|---|---|---|
| Plausible | Analytics | Aggregate page views, referrers, device info. No personal data. |
| Vercel | Hosting | Web requests, IP addresses (standard web hosting logs) |
| Supabase | Database and file storage | Therapist accounts, site content, images |
| Stripe | Payment processing | Therapist email, site ID, subscription and payment data |
| AWS SES | Email delivery | Email addresses, contact form messages |
| Upstash | Caching | Subscription status (cached for 24 hours), favicon data (cached for 48 hours) |
Their privacy policies:
Where your data is stored
All primary data is stored in the EU:
- Supabase (database and storage): eu-west-1 (Ireland)
- AWS SES (email): eu-west-1 (Ireland)
- Upstash (caching): primary in eu-west-1 (Ireland), with read replicas in us-east-1 (N. Virginia), us-west-1 (N. California), and eu-west-2 (London)
- Vercel (hosting): global edge network, with origin servers in the EU
- Plausible: EU-based infrastructure
Data retention
- Therapist accounts and site content: kept for as long as your account is active. On cancellation, see the terms of service for what happens to your data.
- Cache (subscription status, favicons): automatically expires after 24-48 hours
- Contact form submissions: not retained by TherapySpace. Delivered to the therapist by email and then gone from the system.
- Analytics: subject to Plausible's own retention policy
Security
- All traffic is served over HTTPS
- Payment card data is handled entirely by Stripe (PCI DSS compliant) — never seen or stored by TherapySpace
- Secrets and API keys are encrypted at rest
- Database access is restricted to the application
Your rights
Under UK data protection law, you have the right to:
- Ask what information is held about you
- Request corrections to your information
- Ask for your information to be deleted
- Request a copy of your data in a portable format
In practice, very little is held. But the rights are yours.
If you have questions, email oc.ecapsypareht@ttorem. If you're not happy with how something has been handled, you can contact the Information Commissioner's Office (ICO) at ico.org.uk.
Changes to this policy
This policy may be updated from time to time. Any changes will be posted on this page and the "last updated" date will change. For material changes, therapists will be notified by email.
Contact
TherapySpace
oc.ecapsypareht@ttorem