1. Who We Are

We are Sarah and George Choy, the public-facing brand of My Castle Property Ltd, a company based in the United Kingdom.

2. What Data We Collect

We collect the following personal information:
- Name and Email Address (via MailerLite and Substack opt-in forms)
- Signup Form Source (e.g., the type of opt-in form completed, such as for a free download, bonus material, event, or challenge)
- Subscription Data (date of signup, open/click rates, and which emails were sent/opened)
- IP Address and Approximate Location (automatically collected by MailerLite)
- Google Forms Responses (if you contact us via one of our contact forms)

We do not collect sensitive personal data.

Note: We do not use a double opt-in process. By submitting your details via an opt-in form, you may be added to our mailing list—even if the form does not explicitly state this.

3. How We Use Your Data

We process your personal data to:
- Send newsletters, blog updates, and marketing emails
- Provide bonus content, downloads, and event-related communications
- Understand which emails and content are of most interest
- Respond to your messages submitted via Google Forms

Legal basis: We rely on your consent when you opt in to receive emails.

4. How Your Data Is Collected

You provide your data when:
- You subscribe via our Substack page
- You fill out a form in MailerLite (e.g., to receive bonus material or register for an event)
- You submit a Google Form to contact us

If you provide your email via MailerLite, we may copy it into our Substack mailing list.

5. Email Tracking

Emails sent via MailerLite may include an invisible tracking beacon to identify whether you’ve opened an email or clicked a link. Substack also tracks open and click activity. This helps us understand how effective our communication is.

You may opt out at any time by clicking the Unsubscribe link included in all of our emails.

6. Who We Share Data With

We use the following third-party services (data processors):
- MailerLite: for email opt-ins and newsletters
- Substack: for our main website and mailing list
- Stripe: for payment processing (we do not use Stripe-collected contact info for marketing)
- Google Forms: for surveys and contact messages

These services may store data outside the UK or EU; however, we only use providers with appropriate data protection safeguards in place.

We do not sell or share your personal data with third parties for their own marketing purposes.

7. Your Rights

Under the UK GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction or deletion of your data
- Object to or restrict our processing
- Request data portability
- Withdraw your consent at any time

To make a request, please contact us using this form

8. Data Retention

We retain your data for as long as you are subscribed to our mailing list or until you request deletion. If you unsubscribe or ask us to delete your information, we will promptly remove it.

9. Children

Our website and content are intended for adults. We do not knowingly collect data from children under 13.

10. Updates

We may update this Privacy Policy occasionally. Changes will be posted on this page with a new effective date.

11. Contact Us

For privacy or data protection queries, please contact us using this form.