Privacy Policy

A Possible Space Ltd. ("we", "us", "our") operates Parts, a tool for therapists practising Internal Family Systems (IFS) to map their clients' inner worlds. This policy explains what personal data we handle, why, who we share it with, how long we keep it, and the rights you have. We've tried to write it in plain language; if anything is unclear, contact us at us@possible.space.

This is one of three documents that fit together: this Privacy Policy (how we handle personal data), the Terms of Service (the rules for using Parts), and the Data Processing Agreement (the data-protection contract between you and us for your clients' data, which prevails on data-protection matters).

• Controller: A Possible Space Ltd., company number 11617016, registered in England & Wales, registered office: The Old Bakery, 90 Camden Road, Tunbridge Wells, England, TN1 2QP.
• VAT number: GB364357384.
• ICO registration: ZC166893.
• Data-protection contact: us@possible.space. We are not required to appoint a Data Protection Officer; this address reaches the person responsible for data protection.
• Effective date: 2026-10-11. Version: 2026-10-11.

1. Our two different roles

Parts is used by therapists, who create an account and record information about their clients. Your clients do not have accounts — the therapist enters everything. This gives us two distinct roles, and which one we're in changes who is responsible for what:

• For a therapist's clients' information (the Maps they build), the therapist is the data controller — the person who decides what client information to record and is legally responsible for it. We are the **data processor** — we hold and handle that information only on the therapist's instructions, and never use it for our own purposes. The terms of that arrangement are in our Data Processing Agreement.
• For a therapist's own account, billing and marketing information, **we are the controller**, and this policy describes how we handle it.

Where client information comes from. We do not collect client information directly from clients — there is no way for a client to give it to us. It is entered into Parts by the client's therapist, who is its controller and the source of it. If you are a client wanting to know how your information is used, or to exercise your rights over it, please contact your therapist; we will support them in responding to you.

2. The information we handle

2.1 Therapist account information (we are the controller)

• Your email address and display name.
• A securely hashed version of your password (we never store it in readable form).
• If you ask to reset your password, a single-use reset code, which expires one hour after you first asked for it.
• If you change your email address: the new address and a single-use confirmation code, which expires after one hour. Once you confirm the change, we keep your previous address for 30 days, so we can help you if someone else changed it.
• Whether you are a member of our Founding Circle (our early-practitioner cohort).
• Your billing status: a "paid-through" date, your subscription's current status, and — if you subscribe — the reference number Stripe assigns you as a customer, which lets us match Stripe's payment notifications to your account.
• Account timestamps: when your account was created and last updated.
• Whether you get our product updates, and when you last made that choice.
• A random code in the unsubscribe link of our product updates, so that the link works without signing in.
• A record of the service notices and product updates we sent you, and when we sent them.

Providing this information is necessary to enter into and run our contract with you; without it we cannot create or maintain your account.

2.2 Client and Map information (we are the processor)

Recorded by the therapist about their client, and provided to us by the therapist. We hold it on the therapist's behalf and treat it as the most sensitive category of data:

• The Map itself and its title (which a therapist may use to identify a client), and whether and when the therapist archived it.
• Each Part: its type (manager, firefighter, exile, or unknown), its label, a free-text description, an optional body location, free-text notes, an optional colour tag, whether it is unburdened, and its position and size on the canvas.
• Each Relationship between Parts: its type, its intensity, and optional notes.
• Each Session: the date it started, an optional free-text trigger (what brought the client to the session), and the Part it activated.
• The conversation with each Part: entries recording what the Part, the client's Self, or the therapist said or did during a session. Entries are free text and may quote the client word for word.
• A full version history of the above — every change is retained so the Map can be reviewed over time.

This is information about a client's mental health — a **special category of personal data** under data-protection law — and may include free-text clinical notes and somatic (body-location) details. The therapist, as controller, is responsible for having a lawful basis (and any necessary consent) to record it. See section 4 on children.

2.3 Technical information

• Server logs, which may include your email address, kept to operate and secure the service.
• One essential session cookie that keeps you signed in (see section 10).

2.4 Waitlist and invitation information

Before Parts opened for sign-ups, we kept a waiting list and sent invitations to join. We no longer do either. If you joined the waiting list, we still hold the email address you gave us. If we sent you an invitation, we hold it: your email address and the single-use link in it. A link from an unused invitation now opens the normal sign-up page.

3. Why we use it, and our lawful bases

We do not carry out any automated decision-making or profiling.

4. Children's information

IFS is practised with adults, adolescents, and children, so a therapist may record information about a client who is a child. Where that happens, the therapist (as controller) is responsible for the lawful basis and for any parental or guardian consent required. We process such information only on the therapist's instructions. We do not knowingly collect information directly from a child — the only people who use Parts directly are adult professionals.

5. Who we share information with

We do not sell your information. We share it only with the service providers ("sub-processors") we rely on to run Parts, each bound to protect it and to use it only for the service:

When you subscribe or manage your subscription, you do so on **Stripe's own pages**, which are covered by Stripe's privacy policy.

We may also disclose information where the law requires it (for example, a valid legal request), or to establish, exercise, or defend legal claims.

6. Sending information outside the UK/EEA

Most of your information stays in the EU — our systems and backups are in Germany and France. A small amount goes to three providers outside the UK and EEA (Stripe, Fastmail and Google, for the video on our homepage). When it does, it is protected by the standard safeguards regulators require: for Fastmail, the UK International Data Transfer Agreement / EU Standard Contractual Clauses; for Stripe and Google, those plus the EU-US and UK Data Privacy Framework. You can ask us for a copy of the relevant safeguard at us@possible.space.

7. How long we keep it

When you erase information, it disappears from our live systems straight away and is gone from our encrypted backups within 30 days. After erasure we keep only anonymised records that can no longer identify anyone (for example, internal change logs re-attributed to a placeholder) — these are no longer personal data.

8. How we protect it

We use boring, proven technology and keep our security measures in proportion to how sensitive this data is:

• Encryption in transit (HTTPS) and at rest, and encrypted off-site backups that are encrypted before they leave us, so our backup provider cannot read them.
• Access controls that limit access to authorised, named personnel on a least-privilege basis, and that scope each therapist's Maps to that therapist.
• Staff and contractors are bound by confidentiality obligations.
• An audit log of changes to clinical records, and a dedicated, restricted code path for erasure.
• We keep clinical content out of our operational logs and error alerts — these record only technical details, never a client's notes.

No system is perfectly secure, but data safety is a primary concern in how Parts is built and run. If a breach affects information we control and is likely to be a risk to you, we will notify the ICO without undue delay (within 72 hours where required) and tell you if the risk to you is high.

9. Your rights

For information we control (your account, billing, and marketing data) you have the right to: access a copy; correct it; erase it; receive it in a portable format; and restrict or object to certain processing. Where we rely on our legitimate interest (server logs, invitations, product updates), you can object to that processing. Where we rely on your consent (for example, the waiting list, or product updates you subscribed to in Parts), you can withdraw it at any time by emailing us@possible.space; withdrawing does not affect processing we carried out before you withdrew. You can stop product updates yourself at any time (see section 11).

You can do much of this yourself on your Account page: change your display name, email address and password; download a copy of all your data (every Map, and your account details); and delete your account, which erases it straight away. For anything else, contact us@possible.space. We respond within one month.

For a client's information, the therapist is the controller — a client should contact their therapist, and we will help the therapist respond.

You can also complain to the UK's data-protection regulator, the **Information Commissioner's Office (ICO)**, at ico.org.uk — though we'd appreciate the chance to put things right first.

10. Cookies

Parts uses a single strictly-necessary cookie: a session cookie that keeps you signed in. It holds only a random identifier, and you get a new one each time you sign in. We use no advertising or tracking cookies, and our website analytics (Plausible) work without cookies.

Our homepage embeds our walkthrough video from YouTube, in its privacy-enhanced mode: YouTube stores nothing in your browser until you play the video. If you play it, YouTube (Google) may store cookies or similar data in your browser, under Google's own privacy policy.

Because our own cookie is essential to providing the service, we show no cookie-consent banner; YouTube stores data only once you choose to play the video.

11. Service emails and product updates

We send service emails as part of providing Parts: for example the welcome email, password resets and security notices, billing emails, and notices about changes to Parts or to these documents. You can't turn these off while you have an account, because we need them to run it.

We also send occasional product updates: news about new features and changes in Parts. They are optional:

• When you create an account, you choose whether to get them.
• If your account was created before 2026-10-11, you get them only if you subscribe in Parts.
• You can stop them at any time: use the unsubscribe link in any product update (one click, no sign-in needed), or turn them off on your Account page.

If you joined our waiting list, we may email you to tell you that Parts is available, because you asked us to. We send marketing only about Parts, and we never sell or share your email address for anyone else's marketing.

12. Changes to this policy

We may update this policy. Each version carries a date, and material changes are listed in the "Changes" section below. Where a change is significant, we'll tell you by email.

13. Contact

Questions, requests, or concerns: us@possible.space, or write to A Possible Space Ltd. at the registered office above.

Changes to this policy

• 2026-10-11 — Map content (section 2.2): the policy now lists Sessions (date, trigger, and the Part activated), the conversation with each Part, Relationship intensity, a Part's colour tag, unburdened status and size, and whether a Map is archived. Product updates: we now send optional product-update emails (sections 3, 9 and 11). New accounts choose at sign-up; accounts created before 2026-10-11 get them only if they subscribe in Parts; anyone can unsubscribe at any time. Self-service account management: you can now change your email address, download all your data, and delete your account yourself on your Account page (section 9); deleting your account is immediate. Section 2.1 lists password-reset codes (single-use, expiring after one hour), the email-change record (the new address and a confirmation code that expires after one hour, and your previous address, kept for 30 days after a change so we can help you if someone else changed it), the product-update preference, the unsubscribe code, and the record of emails we sent you; sections 3 and 7 give their lawful bases and retention. Section 2.1 no longer lists the times of an erasure request. Section 2.4: we no longer run the waiting list or send invitations; section 7 now covers unused invitations, and waitlist emails are kept for at most 24 months after you joined. Section 3 lists service emails. Section 5: since 2026-07-28 our emails are sent by Scaleway, not Fastmail; Fastmail now only receives your replies. Sections 5, 6 and 10: the walkthrough video on our homepage is embedded from YouTube (Google). Section 10: the session cookie holds only a random identifier, renewed at each sign-in. Section 12: we tell you about significant changes by email.
• 2026-08-01 — Self-serve billing: the account-information list (section 2.1) now describes the subscription details we hold (subscription status and a Stripe customer reference, alongside the paid-through date), and the Stripe entry in section 5 spells out what Stripe receives. Also corrected section 2.1: we do not hold a username — accounts use your email address and display name.
• 2026-06-05 — Initial version.