Privacy Policy
Last updated: 11 October 2026
This policy explains how New Moon Art collects, uses and protects personal information when you visit our websites, use the David Essery app, purchase products or services, attend workshops and courses, or contact us.
1. Who we are
New Moon Art is a UK partnership operating the David Essery website and app and the New Moon Art business. We are the data controller responsible for the personal information we use for the purposes described in this policy.
You can contact us about privacy or your personal information at:
Email: david@newmoonart.co.uk
Postal address: New Moon Art, 13 Royston Place, New Milton, Hampshire, BH25 7AJ, United Kingdom
This policy covers david-essery.com, newmoonart.co.uk, our connected online shop and the David Essery app.
2. Information we collect
The information we collect depends on how you use our services.
Accounts and sign-in
When you create or use an account, we process your email address, account identifier and information needed to authenticate you and manage your account.
If you choose to sign in using Apple, Google or Facebook, we receive the information that provider makes available for sign-in, which may include your name, email address and provider account identifier. We do not receive the password for your Apple, Google or Facebook account.
We use Supabase to provide authentication. Its database for our app is hosted in Germany.
Orders, bookings and recording access
When you purchase a product, workshop, course or recording, we process information needed to fulfil your order. This may include:
- Your name and email address.
- Billing and delivery details, and a telephone number where required for your order.
- The products, events, courses or recordings purchased.
- Order references, payment status and transaction records.
- Your entitlement to attend events or access recordings.
Our online shop uses Shopify. Payment details are processed through the checkout and its payment providers. Our order records contain transaction information; we do not need your full payment-card details to provide app access.
Our website also stores booking and recording-access records. The app sends your account email address to our website to retrieve the events and recordings associated with your purchases. Where you link another purchase email address, we process that address and its verification information to connect the relevant records.
Messages and support
If you contact us, we collect your contact details, the content of your enquiry and any information you provide to help us respond.
Please avoid including sensitive information unless it is necessary for your enquiry.
Notifications
If you enable app notifications, we process a push-notification token identifying your app installation, your notification preferences and information needed to deliver relevant updates. These records may be associated with your account.
Technical information
Our website, app and service providers may process technical information such as IP addresses, browser or device details, operating system, app version, request times, security logs and error information.
Optional analytics and email tracking are explained below.
3. How we use information and our lawful bases
We use personal information for the following purposes:
| Purpose | Lawful basis |
|---|---|
| Create accounts, authenticate users, connect purchases and provide access to booked events and recordings | Performance of our contract with you, or steps you request before entering a contract |
| Process orders, deliver products and provide purchased services | Performance of our contract with you |
| Send necessary booking, access, order and account messages | Performance of our contract with you |
| Respond to enquiries and resolve support issues | Performance of a contract where relevant, or our legitimate interest in responding to people who contact us |
| Protect accounts, prevent fraud, investigate errors and maintain reliable services | Our legitimate interests in operating secure and dependable services |
| Keep accounting records and meet legal obligations | Compliance with legal obligations |
| Send optional marketing emails and push notifications | Consent |
| Use optional website and app analytics, Meta Pixel and tracking technologies that require permission | Consent |
| Include identifiable course participants in recordings | Consent, including explicit consent where required for sensitive information |
| Handle disputes and establish or defend legal claims | Our legitimate interests in protecting our business and legal rights, or legal obligations where applicable |
Where we rely on legitimate interests, we consider the effect on your rights and privacy.
Providing information needed for an account, booking or order is optional, but we may be unable to provide the relevant service without it. Optional analytics and marketing choices are not a condition of accessing your purchases.
You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that took place before you withdrew it.
4. Website cookies, analytics and Meta Pixel
Our websites use cookies and similar technologies for essential functions such as security, sign-in, shopping and remembering preferences.
With your permission, we also use:
- Google Analytics to understand website visits and how people interact with our content.
- Google Tag Manager to manage website tags.
- Meta Pixel to measure website activity and interactions associated with Meta services.
Optional Google Analytics and Meta Pixel tracking require consent through our website cookie controls.
Meta Pixel may transmit information such as pages visited, interactions, device and browser details, IP address and cookie identifiers. Meta may associate this information with a Meta account and use it in accordance with its own terms and privacy policy. We do not currently run paid advertising campaigns, but the presence of Meta Pixel still involves sharing information with Meta.
You can review or change your choices through the website’s cookie controls. You can also manage cookies in your browser, although blocking essential cookies may affect website functions.
See Google’s privacy policy and Meta’s privacy policy for information about their processing.
5. Optional app analytics
The David Essery app uses Google Analytics for Firebase to help us understand which features are used and improve the app.
Analytics is disabled by default. A choice is presented when you first launch the app, including when you are signed out. Declining analytics does not prevent you from using the app.
If you allow analytics, information may include:
- App launches, sessions and engagement time.
- Screens visited, using general screen names.
- General interactions, such as opening an article, video, event or recording.
- Actions such as sharing content, opening a video, joining an event or opening a notification.
- App version, device model, operating system and language.
- Approximate location derived from network information.
- A pseudonymous identifier for the app installation.
Our custom analytics events do not deliberately include your name, email address, account ID, booking details, message contents, content titles or specific booking or content identifiers. We do not collect precise GPS location for analytics.
The app’s analytics configuration disables advertising-identifier collection and advertising personalisation. We do not use app analytics for cross-company advertising tracking.
You can change your choice at:
You → Analytics → Allow analytics
Turning analytics off stops future analytics collection from that installation and resets locally stored analytics information and its identifier. It does not automatically erase information previously received by Google.
6. App diagnostics
We use Sentry to identify crashes and technical errors and improve the app’s reliability.
Diagnostic reports may include error messages, technical activity leading up to an error, app and operating-system versions, device information and an installation identifier. These reports are technical diagnostic records and are not necessarily anonymous.
Our configuration disables automatic inclusion of default personal information and does not enable screenshots, session replay, performance tracing or profiling.
Diagnostics are separate from optional usage analytics. We use them for our legitimate interest in maintaining a secure, functioning app.
7. Emails and push notifications
Service emails
We send messages needed to provide your services, such as authentication emails, order confirmations, event information and recording-access messages.
Supabase sends authentication emails. We use Postmark for event-related emails, and Shopify may send order-related messages.
These services process recipient details, email contents and delivery information as needed to send and troubleshoot messages.
Marketing emails
We use Mailchimp to send newsletters, news, event information and offers to people who subscribe.
Our campaigns use open and click tracking, including tracking links in plain-text emails. This can record whether an email was opened, which links were clicked and when. Opens are detected through a small image in the email and may be affected by your email provider’s privacy features.
Campaigns also use e-commerce and Google Analytics link tracking. Depending on the connected services and your website cookie choices, this may associate visits or purchases with an email campaign.
We use this information to understand the usefulness of our emails and improve future communications. Where consent is required for email tracking, that consent is separate from permission for tracking on our website.
You can unsubscribe using the link in any marketing email or contact us about your preferences. Unsubscribing from marketing does not stop necessary messages about an existing purchase or account.
Push notifications
Push notifications are optional. You can choose the available notification categories within the app and disable notifications through the app or your device settings.
We use notification infrastructure provided by Expo, Apple and Google to deliver them. Enabling notifications does not automatically enable app analytics.
8. Workshops, courses and recordings
Most workshop recordings focus on the presenter. Occasionally, a participant’s comment may be read aloud and their first name mentioned.
Some courses allow participants to speak or appear on camera. Where you agree to be included in a recording, it may contain your image, voice, displayed name and contributions.
We provide recording information and ask for consent before including identifiable course participation. You can keep your camera and microphone off. Non-video participants are hidden from the recorded participant view, and chat messages are not included with the recording.
Recordings containing course participants are available to the closed group enrolled on that course and are not made publicly available. There is currently no fixed end date for that group’s recording access.
Please be mindful of what you choose to share. Contributions may reveal personal beliefs or other sensitive information. Where processing requires explicit consent, we ask for it.
To withdraw recording consent or discuss removing a contribution, email david@newmoonart.co.uk. We can edit recordings under our control, although we cannot guarantee recovery of copies already lawfully downloaded by other participants.
We use Zoom for online sessions. Its processing is also explained in Zoom’s privacy statement.
9. Who receives your information
We use service providers to operate our business and deliver our services. Relevant providers include:
| Provider | What we use it for |
|---|---|
| WPMU DEV / Incsub | Website hosting and related technical support |
| Supabase | App authentication, account information and authentication emails |
| Shopify and checkout payment providers | Online orders, payments and transaction records |
| Postmark | Event and service emails |
| Mailchimp | Marketing emails and campaign reporting |
| Google Analytics / Firebase and Google Tag Manager | Optional analytics and website tag management |
| Meta | Website Meta Pixel and optional Facebook sign-in |
| Apple and Google | Optional sign-in and platform services |
| Expo, Apple and Google | Push-notification delivery |
| Sentry | App crash and error diagnostics |
| Zoom | Online workshops and courses |
Where relevant, information is also shared with delivery or fulfilment providers to complete physical-product orders, and with professional advisers or authorities where necessary for accounting, legal obligations or disputes.
Providers receive information relevant to their role. Some process it on our behalf; others also act as independent controllers for particular activities under their own terms.
We do not sell customer mailing lists or booking records. Information is shared to provide our services, operate the technologies described in this policy, or meet legal requirements.
If you follow a link to another service, such as YouTube, or use third-party content, that service’s privacy policy also applies.
10. International processing
Our website is hosted in England, and our Supabase authentication database is hosted in Germany. These hosting locations do not mean that all related processing takes place exclusively in those countries.
Some providers and their support teams or subcontractors operate internationally, including in the United States, Canada and other countries. Information may therefore be stored, accessed or processed outside the UK.
The transfer arrangements depend on the provider, destination and service. These may include UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework for eligible certified recipients, or contractual safeguards such as standard contractual clauses with the UK International Data Transfer Addendum.
Our providers publish information about their international processing and applicable safeguards in their privacy notices and data-processing terms. You can contact us at david@newmoonart.co.uk for further information about a particular provider or to request details of the safeguards relevant to your information.
11. How long we keep information
We retain information for the purposes described in this policy, using the following periods or criteria:
| Information | Retention |
|---|---|
| App account information | While your account remains open, unless deletion is required sooner |
| Purchase, booking and recording-access records | For as long as needed to provide ongoing access and administer your purchases; recording access currently has no fixed end date |
| Accounting and tax records | Normally at least five years after the 31 January filing deadline for the relevant tax year, or longer where legally required |
| Support enquiries | Three months after the ticket is closed, unless needed for an unresolved dispute or legal obligation |
| App notification history | One month |
| Routine operational logs and backups under our control | 30 days |
| Google Analytics event-level data | The configured retention period is two months |
| Google Analytics user-level data | The configured retention period is 14 months, reset when new user activity occurs |
| Marketing subscriber details | While subscribed; after unsubscribing, we retain the minimum information needed to respect your choice |
| Course recordings | While made available to the enrolled group, subject to consent withdrawal and applicable rights |
Google Analytics retention settings apply to relevant user-level and event-level data. Aggregated reports may remain available beyond those periods.
Provider-held email delivery records, diagnostic reports, security records and backups may have separate retention periods under the relevant service’s settings and policies. These are distinct from the periods for records under our direct control.
Where a fixed period is not specified, we consider the purpose, whether the information is still needed, the service or access being provided, and any legal requirements. We may retain limited information for longer where necessary to resolve a dispute, prevent fraud or meet a legal obligation.
12. Deleting your app account
You can request deletion within the app at:
You → Login details → Delete account
You can also use our account-settings page or email david@newmoonart.co.uk.
Deleting your app account removes the app authentication account and associated account links and notification registrations.
It does not automatically erase all records of earlier purchases or bookings. We may retain records needed to provide continuing purchase rights, meet accounting obligations or handle legal claims. Please contact us if you also want us to consider deleting those records.
Account deletion does not automatically unsubscribe a separately held newsletter subscription. You can use the unsubscribe link in an email or ask us to do this when requesting deletion.
Information in backups may remain until those backups expire. Turning off analytics or deleting your account does not automatically delete historical analytics held under a separate pseudonymous installation identifier.
13. Security
We use technical and organisational measures intended to protect personal information, including access controls, authentication and encrypted connections where appropriate.
Access is limited to people and service providers who need it for their work. No online service can guarantee absolute security.
14. Automated decisions
Shopify provides automated fraud indicators that may flag orders for review. A flag informs our review; it does not by itself make the final decision about an order.
We do not use solely automated decisions that produce legal or similarly significant effects on you.
15. Your rights
Depending on the circumstances, you have rights to:
- Request access to your personal information.
- Ask us to correct inaccurate or incomplete information.
- Request deletion.
- Ask us to restrict processing.
- Object to processing based on legitimate interests.
- Object to direct marketing at any time.
- Receive certain information in a portable format.
- Withdraw consent where we rely on it.
These rights are subject to applicable conditions and exceptions. For example, we may need to retain certain records to meet legal obligations.
To exercise your rights, email david@newmoonart.co.uk. We may ask for information to verify your identity. Requests are normally free, and we normally respond within one month, subject to any extensions or exceptions permitted by law.
16. Complaints
If you have a concern about how we use your information, please contact us so we can investigate.
You also have the right to complain to the UK Information Commissioner’s Office:
Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
If you live outside the UK, you may also have the right to contact your local data-protection authority.
17. Changes to this policy
We may update this policy when our services, processing practices or legal requirements change. The date at the top shows when it was last updated.
Where a change materially affects how we use your information, we will provide an appropriate notice and seek fresh consent where required.