How we handle your application data

Who we are

The data controller for this application form is archie bird. You can contact us about this notice or your data at archiebirds@icloud.com.

What we collect, and what's required

When you apply to the pilot, we collect: your full name and email address; your goal, target amount, deadline, time available, budget, equipment, existing skills, previous attempts, communication and mobility constraints, anything you're not willing to do, your confidence level and why this matters to you; and your confirmations that you are 18 or older, live in the United Kingdom, are willing to complete tasks and submit evidence, understand that results are not guaranteed, understand that a human reviews AI-assisted plans, and that you have read this notice and the Pilot Rules.

Every field on the application form is required. We cannot assess your application without all of it.

Email verification

Before the application form is made available, we ask you to verify that you control the email address. For this purpose we process the address, a one-time verification code, request and network information used for abuse prevention, and limited delivery or provider status needed to operate the process.

The address and one-time code are sent to Resend solely so that Resend can deliver the transactional verification message. The code expires after 15 minutes. EARNED stores only a keyed digest of the code, not the raw code. The email delivery provider must necessarily process the raw recipient address and code to send the message.

EARNED does not write the raw request IP address to its database for verification rate limiting. It stores context-separated HMAC-derived identifiers for email and IP abuse controls. These temporary identifiers and unsuccessful verification records are retained only for the periods described below.

How we use your IP address

When you verify your email or submit the form, your IP address is processed transiently, in server memory, to generate a one-way HMAC-SHA256 hash. The raw IP address is never written to our database. Only the resulting hash is stored, and only to support basic rate limiting — recognising that an unusually high number of attempts is coming from the same source in a short window.

AI-assisted planning and human review

If your application is accepted, your profile information (goal, skills, time, budget, equipment and constraints) may be used to draft a starting plan with the help of an AI planning tool. A human always reviews that draft before you see it, and may change or reject it — no plan reaches you unreviewed.

The planning service receives a pseudonymised allowlisted planning brief with basic contact-detail redaction. Direct name, email and raw application-identifier columns are excluded. In selected free-text fields, the basic filter removes ordinary email addresses, common UK phone formats, obvious http/https or www URLs, and obvious @social handles.

This basic filtering cannot guarantee complete anonymisation of free text. It does not reliably identify names, postal addresses, non-UK phone numbers, disguised contact details or identifiers written in unexpected formats. Regeneration may also include separately stored, basic-redacted advisory reviewer feedback, a previous model draft, and safe validation codes and paths. Internal reviewer-note history is not sent to the planning service. Requests disable provider-side response storage with store: false, but the provider still processes the request and may retain limited data under its applicable abuse-monitoring and data-control terms. This is not a promise of zero provider retention.

Why we process it, and on what basis

• We process your application because you have asked us to take steps that may lead to a contract with you — accepting you into the pilot and creating your plan. This is necessary to assess your application; it is not based on your consent, and you are not asked to "consent" to it. The checkbox on the form asks you to confirm you have read this notice, not to agree to processing.
• We use basic anti-abuse measures — including limiting how many times a single connection can submit the form (via the hashed IP described above) and a hidden field that helps us ignore automated submissions — based on our legitimate interest in keeping the application process secure and fair, in a way that does not override your rights. See "Your right to object" below for how this specific basis affects your rights.
• We do not currently use your application data for marketing, and we do not send marketing communications based on this form. There is no marketing consent to give.

Where your data is hosted and processed

Application data is stored in a database provided by Supabase. The website itself is hosted on Vercel, transactional verification email is delivered through Resend, and pseudonymised planning briefs may be processed by OpenAI. These organisations act as service providers rather than determining EARNED's purposes for using application data.

Depending on the provider arrangements in force, this processing may occur outside the United Kingdom. Appropriate safeguards for any such transfer (for example, UK-recognised standard contractual clauses or an adequacy decision) must be reviewed and confirmed with each provider before this site is used for a public launch. Processor and data processing agreement arrangements, including Resend's, must also be completed operationally; this notice does not claim that those reviews are already complete.

Who can see it

Applications and AI-assisted draft plans are reviewed directly by the founder through a private, authenticated review interface. It is not linked from the public website.

How long we keep it

If your application is not selected for the pilot, we delete your application data within 90 days of the selection decision being finalised, and in any case no later than 6 months after you submitted it, whichever comes first.

If you are selected to join the pilot, after establishing secure participant access you must read and acknowledge the current version of a separate selected-participant privacy and evidence notice before activation or evidence submission. That acknowledgement is recorded against your participant enrolment.

Participation and evidence records are kept while participation is active and erased within 90 days after completion, revocation, withdrawal, or closure of an unused invitation. A verified erasure request may require earlier deletion. Specific information is kept longer only for a documented legal obligation or legal claim, and only for the period genuinely needed.

Active email challenges and verified but unconsumed sessions expire after at most one hour. Revoked or expired verification records, together with their generation history, are eligible for bounded deletion after 30 days. Verification rate-limit events are retained for at least the 24-hour enforcement window and then become eligible for bounded deletion. A failed-send generation follows its parent verification record.

When an application is submitted, its consumed verification proof is retained with the application so we can demonstrate that the mailbox was verified. It is removed through the same controlled owner-only erasure process as the related application; it is not silently deleted while that application is retained.

Automated decisions

Acceptance into the pilot, and the plan you receive, are not decided solely by automated means. A person reviews each application, and each AI-assisted plan draft, before any decision is made or anything is sent to you. No decision that produces legal effects or similarly significant effects on you is made solely by automated processing.

Your rights

Subject to applicable law, you have the right to: access the data we hold about you; request that we correct (rectification) inaccurate data; request erasure of your data; and request that we restrict how we process it. To exercise any of these, contact us at archiebirds@icloud.com.

Complaints

If you're unhappy with how we've handled your data, please contact us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.