Legal
Privacy Policy
Last updated: 20 July 2026
1. Who we are
This policy explains how David Alston, a sole trader trading as Only One You Pro Bio Pages, handles personal data when you visit onlyone.you, contact us, buy a subscription, use the customer account area, create a bio page, or interact with a page created using the Service.
Our address is Halton Mill, Mill Lane, Halton, Lancaster, LA2 6ND. For data-protection enquiries, email help@onlyone.you.
We are registered with the Information Commissioner's Office under registration number ZA431043.
2. When we are responsible for personal data
We are the controller for personal data used to operate the OOY website, administer enquiries and subscriptions, provide setup and support, and provide the OOY account and bio-page service.
The account and bio-page platform is a white-label service hosted and operated for us by First Ignition Media Ltd, an Irish company. Its Data Processing Agreement identifies OOY as controller and First Ignition as processor for Customer Data.
Our customers decide what content, contact methods and optional integrations appear on their own published pages. Where a customer uses a page to collect information for that customer's own purposes, the customer may also be a controller and should provide suitable privacy information. You may contact the page owner directly or contact us if you are unsure who is responsible.
3. Personal data we handle
3.1 Website visitors
When the website is requested, our hosting and delivery providers may process technical request data such as IP address, browser/device information, requested page, referring address, date and time, and security logs.
3.2 Enquiries, setup and support
We receive the name, email address, topic, message and consent confirmation submitted through our contact form. Setup and support communications may also include your page preferences, domain or technical information, and anything else you choose to send us.
3.3 Purchases and subscriptions
We and Stripe handle your name, email address, billing or transaction information, subscription plan, payment status, renewal and refund records. Stripe collects payment credentials in its own checkout environment. OOY does not receive or store your full card number.
3.4 Accounts and customer content
The platform processes account identifiers and login details, account settings, support information and the text, links, images, media, contact information and other content you add to your bio page. The branded login at bio.onlyone.you uses an eight-hour session cookie and an eight-hour cross-site-request-forgery protection cookie. The dashboard bundle also supports a local theme preference.
3.5 Visitors to customer-created pages
Depending on how a customer configures a page, ordinary delivery and security processes may handle IP address, browser/device and request information. First Ignition describes the built-in customer analytics as anonymous and limited to country and hit counts. The platform may also process information a visitor submits through a contact or lead form. First Ignition has told us that form submissions are transmitted to the SMTP account or webhook configured for the page rather than retained as a form-submission database. Delivery, error, security or support logs may still be generated.
Customers may enable ShareThis, media embeds, SMTP, webhooks or custom code. Those features can send information to third parties selected by the customer. They are not part of the standard OOY marketing website and their own privacy information may apply.
4. Why we use personal data and our lawful bases
To answer enquiries and provide requested setup or support: taking steps at your request, performing our contract, or our legitimate interest in communicating about OOY.
To create and administer an account, publish customer content and provide the Service: performance of our contract.
To take payment, administer renewals, cancellations and refunds: performance of our contract and compliance with accounting, tax and consumer-law obligations.
To send essential account, billing, security and service communications: performance of our contract and our legitimate interest in operating the Service safely.
To secure, troubleshoot and prevent misuse of the website and Service: our legitimate interests in security, fraud prevention and reliable service delivery, and legal obligations where applicable.
Where you make an optional choice requiring consent: consent, which you may withdraw without affecting earlier lawful processing.
When we rely on legitimate interests, we consider the necessity and effect of the processing and your reasonable expectations. You may object as explained below.
5. Who receives personal data
Stripe: hosted checkout, subscription payments, fraud prevention, refunds and payment records. Stripe may act as an independent controller for some activities.
Bunny.net/BunnyCDN: hosting and delivery of the public OOY website and operation of the contact-form endpoint.
Cloudflare Turnstile: security and automated-abuse checks on protected forms.
SMTP2GO: delivery of contact, setup, support and essential service email.
First Ignition Media Ltd: processor hosting and operating the customer-account and bio-page platform.
Liquid Web: First Ignition's hosting subprocessor. OOY customer-account and bio-page data is stored in First Ignition's database on Liquid Web servers in the United States. No other standard subprocessor for the customer-account and bio-page platform has been identified to OOY.
We may also disclose information to professional advisers, courts, regulators, law-enforcement bodies or another party where reasonably necessary to establish or defend legal rights, comply with law, or protect people and systems. We do not sell personal data.
6. International processing
The public website and the providers named above may involve processing outside the UK. First Ignition is established in Ireland and has told us that OOY customer-account and bio-page data is stored in its database on Liquid Web servers on the east coast of the United States.
First Ignition says it relies on Liquid Web's participation in the EU–US Data Privacy Framework for its EEA-to-US hosting transfer. Liquid Web publicly states that it also participates in the UK Extension to that framework. Its active status should be checked on the US Department of Commerce Data Privacy Framework list; further information is in Liquid Web's privacy policy. First Ignition's DPA requires an appropriate lawful mechanism for any restricted transfer not covered by that arrangement. Contact us if you would like further information we hold about a transfer affecting your data.
7. How long we keep personal data
Enquiries and setup messages: normally up to two years after the matter is resolved, unless they become part of an ongoing customer relationship or are needed for a legal claim.
Support correspondence: normally up to two years after resolution.
Subscription, invoice, refund and accounting records: normally six years after the relevant accounting period or transaction, where required for tax, accounting or legal purposes.
Active account data and customer content: while the subscription and account remain active. First Ignition says live account data is deleted on cancellation and backup copies are removed through its normal backup cycle. Its DPA also permits limited retention where required for legal compliance, security, fraud prevention, disputes and legitimate business records. It has not supplied OOY with a fixed maximum backup-cycle period.
Anonymous page analytics and delivery/security logs: for the period reasonably needed to provide, secure and troubleshoot the platform. First Ignition says customer analytics are limited to anonymous country and hit counts, but has not supplied OOY with a fixed analytics- or log-retention period.
We delete or anonymise information when it is no longer required, subject to the qualifications above.
8. Your rights
Depending on the circumstances, you may have rights to access your personal data; correct it; ask for erasure or restriction; receive portable data; object to processing based on legitimate interests; object at any time to direct marketing; and withdraw consent. You may also have rights concerning solely automated decisions with legal or similarly significant effects. OOY does not currently make such decisions.
Your right to object: if we process personal data on the basis of legitimate interests, you may object by explaining your circumstances. We will stop unless we have compelling legitimate grounds or need the information for legal claims. We will always stop using your data for direct marketing if you object.
Email help@onlyone.you to exercise a right. We may ask for information needed to verify identity. We normally respond within one month. Some rights are qualified by law.
Customers can manage account and page information through self-service controls and can download their data using the platform's export button. Where those controls are not sufficient, OOY may invoke the assistance promised by First Ignition in its DPA.
9. Security
OOY uses HTTPS, access controls, limited administrative access, form-abuse protection and Stripe-hosted payment processing. We require service providers to protect personal data under their applicable contractual obligations. First Ignition's DPA commits it to appropriate technical and organisational measures, confidentiality, incident handling and restricted support access.
No internet service can guarantee absolute security. Please use a strong, unique password and tell us promptly if you believe your account or data has been compromised.
10. Children
The Service is intended for adults and is not directed at children. Customers must not submit children's data or special-category data to the platform unless OOY and First Ignition have first agreed appropriate arrangements in writing. If you believe a child has supplied personal data, contact us so that we can investigate and take appropriate action.
11. Complaints
Please send a data-protection complaint to help@onlyone.you. We will acknowledge it within 30 days, investigate without undue delay, provide appropriate progress information, and give you a written outcome.
You may also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
12. Changes and related documents
We may update this policy when the Service, providers or law changes. We will post the revised date here and give reasonable notice of a material change where appropriate.
Please also read our Terms and Conditions, Refund Policy and Cookie and Similar Technologies Policy.
David Alston also operates davealston.com and Sing Yourself Happy at singyourselfhappy.com. Their own policies apply when you use those separate services.
13. Contact us
For any questions about this Privacy Policy or your personal data, please contact:
David Alston
Trading as Only One You Pro Bio Pages
Halton Mill, Mill Lane, Halton, Lancaster, LA2 6ND