Privacy Policy

Last updated: 9 November 2026

This policy explains how New Moon Art collects, uses and protects personal information when you visit our websites, use the David Essery app, participate in our communities, purchase products or services, attend workshops and courses, or contact us.

1. Who we are

New Moon Art is a UK partnership operating the David Essery website and app and the New Moon Art business. We are the data controller responsible for the personal information we use for the purposes described in this policy.

You can contact us about privacy or your personal information at:

Email: david@newmoonart.co.uk

This policy covers david-essery.com, newmoonart.co.uk, our connected online shop and the David Essery app.

2. Information we collect

The information we collect depends on how you use our services.

Accounts and sign-in

When you create or use an account, we process your email address, account identifier and information needed to authenticate you and manage your account.

If you choose to sign in using Apple, Google or Facebook, we receive information that provider makes available for sign-in. This may include your name, email address and provider account identifier. We do not receive the password for your Apple, Google or Facebook account.

We use Supabase for authentication and community data. Our Supabase database is hosted in Germany.

Some website recording-access features allow access using an email address without creating a full account. Community participation requires a full account and access to an appropriate space.

Orders, bookings and recording access

When you purchase a product, workshop, course or recording, we process information needed to fulfil your order. This may include:

Your name and email address.
Billing and delivery details, and a telephone number where required.
The products, events, courses or recordings purchased.
Order references, payment status and transaction records.
Your entitlement to attend events or access recordings.

Our online shop uses Shopify. Payment details are processed through its checkout and payment providers.

Our website stores booking and recording-access records. The app communicates with our website to retrieve your available events and recordings; it does not process purchases or collect your payment-card details.

Linked email addresses and booking groups

We may connect verified email addresses and booking records within a booking group so that purchases made using different addresses can be recognised together.

A booking group may be associated with your account to determine recording access and eligibility for community spaces. Workshop or course sign-ups may qualify a group for access to a particular space.

These connections do not make your email addresses or purchase history publicly visible to community members. We use them to administer access and resolve account enquiries.

Community profiles and contributions

If you participate in a community, we process information such as:

Your chosen display name, profile photograph and optional biography.
Posts, comments, replies, images and links you share.
Reactions and saved posts.
Space memberships, roles and access permissions.
Activity and read markers used to identify new posts or replies.
Notification preferences and onboarding acknowledgements.
Reports, moderation notes and access restrictions.

Your community profile is associated with your account and may be used across the spaces in which you participate.

Selecting an image or sharing a photo or YouTube link to the app allows you to prepare a contribution. Content you publish is uploaded or stored as needed to display it to its intended audience. Sharing a YouTube link does not upload the underlying video to our service.

Messages and support

If you contact us, we collect your contact details, the content of your enquiry and any attachments or other information you provide to help us respond.

Please avoid including sensitive information unless it is necessary for your enquiry.

Notifications

If you enable app notifications, we process a push-notification token identifying your app installation, your preferences and information needed to deliver relevant updates. These records may be associated with your account.

Technical information and searches

Our website, app and service providers may process IP addresses, browser or device details, operating system, app version, request times, security logs and error information.

Search terms may be transmitted to our services where needed to retrieve results. They may also appear in request logs or technical diagnostic context. We do not use search terms for cross-company advertising tracking.

Optional analytics and email tracking are explained below.

3. How we use information and our lawful bases

Purpose	Lawful basis
Create accounts, authenticate users, connect purchases and provide access to booked events and recordings	Performance of our contract with you, or steps you request before entering a contract
Process orders, deliver products and provide purchased services	Performance of our contract with you
Provide community profiles, publish contributions to their intended audience and operate requested community features	Performance of our agreement with you to provide those features
Determine space eligibility using invitations, memberships and workshop or course records	Performance of our agreement with you, or our legitimate interest in administering appropriate access
Send necessary booking, access, order and account messages	Performance of our contract with you
Respond to enquiries and resolve support issues	Performance of a contract where relevant, or our legitimate interest in responding to enquiries
Review reports, moderate content and restrict abusive access	Our legitimate interests in protecting members and operating a safe service, or legal obligations where applicable
Protect accounts, prevent fraud, investigate errors and maintain reliable services	Our legitimate interests in operating secure and dependable services
Keep accounting records and meet legal obligations	Compliance with legal obligations
Send optional marketing emails and push notifications	Consent
Use optional analytics, Meta Pixel and tracking technologies that require permission	Consent
Include identifiable course participants in recordings	Consent, including explicit consent where required for sensitive information
Handle disputes and establish or defend legal claims	Our legitimate interests in protecting legal rights, or legal obligations where applicable

Where we rely on legitimate interests, we consider the effect on your rights and privacy.

Providing information needed for an account, community feature, booking or order is optional, but we may be unable to provide that feature or service without it.

Optional analytics and marketing choices are not a condition of accessing your purchases.

You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that took place before you withdrew it.

4. Community privacy and visibility

Private spaces

Our current community spaces are private. Viewing and participation are restricted to accounts with appropriate access.

Your contributions and associated display name and photograph are visible to members who have access to the relevant space. Your profile biography may be viewed through your contributions by members entitled to view them.

Private spaces are not intended to be publicly browsable or indexed by search engines. However, private does not mean confidential: members can take screenshots, copy information or share material outside the service. Please consider this before posting.

Your account email addresses and booking records are not displayed as part of your community profile.

Future public spaces

We may introduce clearly identified public spaces in future.

Content published in a public space, including posts, comments, uploaded images and associated profile information, may be visible to people who are not signed in. It may also be indexed by search engines, linked to elsewhere or copied by other people.

Search engines and third parties may retain copies after content is edited or removed. We cannot guarantee removal of copies outside our control.

The introduction of public spaces will not, by itself, make existing private contributions public. Any proposal to change the audience for existing private content will be addressed separately, with appropriate notice and any permission required.

Moderation and reports

Authorised administrators and moderators may access relevant community information to administer spaces, investigate reports, enforce guidelines and provide support.

Reports may include the reported contribution, surrounding discussion, the accounts involved, the reporter’s explanation and private moderation notes.

Reporting does not automatically remove content or suspend another member. Administrators review concerns and may remove content or restrict access. A suspension can override access that would otherwise be available through an invitation or workshop list.

Losing access to a space does not automatically delete contributions already made there.

Sensitive information

A biography, image or discussion may reveal sensitive information, such as health information or religious or philosophical beliefs.

Please share only information you are comfortable making available to the relevant audience. Do not publish someone else’s sensitive or private information without appropriate permission.

Acknowledging this privacy policy or accepting community guidelines is not, by itself, explicit consent to every use of sensitive information. Where we need explicit consent for particular processing, we seek it separately, unless another applicable legal condition permits that processing.

5. Website cookies, analytics and Meta Pixel

Our websites use cookies and similar technologies for essential functions such as security, sign-in, shopping and remembering preferences.

With your permission, we also use:

Google Analytics to understand visits and interactions with our content.
Google Tag Manager to manage website tags.
Meta Pixel to measure website activity and interactions associated with Meta services.

Optional Google Analytics and Meta Pixel tracking require consent through our website cookie controls.

Meta Pixel may transmit pages visited, interactions, device and browser details, IP address and cookie identifiers. Meta may associate this information with a Meta account and use it under its own terms and privacy policy.

We do not currently run paid advertising campaigns, but the presence of Meta Pixel still involves sharing information with Meta.

You can change your choices through the website’s cookie controls. You can also manage cookies in your browser, although blocking essential cookies may affect website functions.

See Google’s privacy policy and Meta’s privacy policy for information about their processing.

6. Optional app analytics

The David Essery app uses Google Analytics for Firebase to help us understand which features are used and improve the app.

Analytics is disabled by default. A choice is presented when you first launch the app, including when signed out. Declining does not prevent you from using the app.

If you allow analytics, information may include:

App launches, sessions and engagement time.
Screens visited, using general screen names.
General interactions with articles, videos, events and recordings.
Actions such as sharing content, joining an event or opening a notification.
App version, device model, operating system and language.
Approximate location derived from network information.
A pseudonymous identifier for the app installation.

Our custom analytics events do not deliberately include your name, email address, account ID, booking details, message contents, content titles or specific booking or content identifiers. We do not collect precise GPS location for analytics.

The app’s analytics configuration disables advertising-identifier collection and advertising personalisation. We do not use app analytics for cross-company advertising tracking.

You can change your choice in Settings → Analytics.

Turning analytics off stops future analytics collection from that installation and resets locally stored analytics information and its identifier. It does not automatically erase information previously received by Google.

Community read markers, saved posts and notification preferences are operational features, separate from optional usage analytics.

7. App diagnostics

We use Sentry to identify crashes and technical errors and improve reliability.

Diagnostic reports may include error messages, technical activity leading up to an error, request details, app and operating-system versions, device information and an installation identifier. Request details may contain search terms or identifiers relevant to the failing operation.

These reports are not necessarily anonymous.

Our configuration disables automatic inclusion of default personal information and does not enable screenshots, session replay, performance tracing or profiling.

Diagnostics are separate from optional usage analytics. We use them for our legitimate interest in maintaining a secure, functioning app.

8. Emails and push notifications

Service emails

We send messages needed to provide services, such as authentication emails, order confirmations, event information and recording-access messages.

Supabase provides authentication emails. We use Postmark for event-related emails, and Shopify may send order-related messages.

These services process recipient details, message contents and delivery information as needed to send and troubleshoot emails.

Marketing emails

We use Mailchimp to send newsletters, news, event information and offers to subscribers.

Our campaigns use open and click tracking, including tracking links in plain-text emails. This can record whether an email was opened, which links were clicked and when. Open detection uses a small image and may be affected by your email provider’s privacy features.

Campaigns also use e-commerce and Google Analytics link tracking. Depending on connected services and your website cookie choices, visits or purchases may be associated with an email campaign.

We use this information to understand the usefulness of our emails and improve communications. Where consent is required for email tracking, that consent is separate from permission for website tracking.

You can unsubscribe using the link in a marketing email or contact us about your preferences. Unsubscribing does not stop necessary messages about an existing purchase or account.

Push notifications

Push notifications are optional. You can choose available categories in Settings → Notifications and manage permission through your device settings.

Community preferences may include new posts, replies to your posts, replies to your comments and activity on discussions you have participated in.

Notifications can contain information about community activity. Depending on your device settings, previews may appear on a lock screen or connected device.

We use Expo and Apple’s notification services for iOS delivery, and Expo and Google’s notification services for Android delivery.

Enabling notifications does not enable app analytics or subscribe you to the email newsletter.

9. Workshops, courses and recordings

Most workshop recordings focus on the presenter. Occasionally, a participant’s comment may be read aloud and their first name mentioned.

Some courses allow participants to speak or appear on camera. Where you agree to be included, a recording may contain your image, voice, displayed name and contributions.

We provide recording information and ask for consent before including identifiable course participation. You can keep your camera and microphone off. Non-video participants are hidden from the recorded participant view, and chat messages are not included with the recording.

Recordings containing course participants are available to the closed group enrolled on that course and are not made publicly available. There is currently no fixed end date for that group’s recording access.

Contributions may reveal beliefs or other sensitive information. Where processing requires explicit consent, we ask for it.

To withdraw recording consent or discuss removing a contribution, email david@newmoonart.co.uk. We can edit recordings under our control, although we cannot guarantee recovery of copies already lawfully downloaded by other participants.

We use Zoom for online sessions. See Zoom’s privacy statement.

10. Who receives your information

Provider or recipient	Purpose
WPMU DEV / Incsub	Website hosting and technical support
Supabase	Authentication, accounts, community data, uploaded community media and authentication emails
Shopify and checkout payment providers	Website orders, payments and transaction records
Postmark	Event and service emails
Mailchimp	Marketing emails and campaign reporting
Google Analytics / Firebase and Google Tag Manager	Optional analytics and website tag management
Meta	Website Meta Pixel and optional Facebook sign-in
Apple and Google	Optional sign-in and platform services
Expo, Apple and Google	Push-notification delivery and app-update infrastructure
Sentry	App crash and error diagnostics
Zoom	Online workshops and courses
YouTube / Google	Embedded or linked video playback
Community members and, where applicable, public visitors	Viewing contributions and profile information within the audience described above

Information may also be shared with delivery or fulfilment providers, professional advisers and authorities where necessary to complete orders, meet legal obligations or handle disputes.

Providers receive information relevant to their role. Some process it on our behalf; others act as independent controllers for particular activities under their own terms.

We do not sell customer mailing lists or booking records.

When you follow a link to another service or use third-party content, that service’s privacy policy also applies.

11. International processing

Our website is hosted in England, and our Supabase database is hosted in Germany. These locations do not mean all related processing takes place exclusively in those countries.

Some providers, support teams and subcontractors operate internationally, including in the United States, Canada and other countries. Information may be stored, accessed or processed outside the UK.

Transfer arrangements depend on the provider, destination and service. These may include UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework for eligible certified recipients, or contractual safeguards such as standard contractual clauses with the UK International Data Transfer Addendum.

Providers publish information about their international processing and safeguards in their privacy notices and data-processing terms.

Contact david@newmoonart.co.uk for information about a particular provider or to request details of relevant safeguards.

12. How long we keep information

Information	Retention period or criteria
Account and profile information	While your account remains open, unless removed earlier or retention is otherwise justified
Purchase, booking and recording-access records	As needed to provide ongoing access and administer purchases; recording access currently has no fixed end date
Community posts, comments and attachments	While available as part of the discussion, subject to removal requests, moderation and the deletion arrangements below
Memberships, read markers, saved posts and community preferences	While needed to operate the account and community features
Community reports, moderation notes and suspension records	As needed to investigate concerns, enforce restrictions and handle related disputes
Accounting and tax records	Normally at least five years after the 31 January filing deadline for the relevant tax year, or longer where legally required
Support enquiries and associated attachments	Three months after the ticket is closed, unless needed for an unresolved dispute or legal obligation
App notification history	One month
Routine operational logs and backups under our control	30 days
Google Analytics event-level data	Configured retention of two months
Google Analytics user-level data	Configured retention of 14 months, reset when new user activity occurs
Marketing subscriber details	While subscribed; afterwards, the minimum information needed to respect an unsubscribe
Course recordings	While available to the enrolled group, subject to consent withdrawal and applicable rights

Google Analytics settings apply to relevant user-level and event-level data. Aggregated reports may remain available longer.

Provider-held delivery records, diagnostic reports, security records and backups may have separate retention periods under the service’s settings and policies.

The app and browser may retain local copies of content and images to improve performance and reduce repeat downloads. Removing content from the service does not necessarily erase a copy immediately from every device.

Where no fixed period is specified, we consider the purpose, whether information is still needed, continuing access being provided and legal requirements. Limited records may be retained longer to resolve disputes, prevent fraud or meet legal obligations.

13. Removing community content and deleting your account

Community content

You can use available editing and removal controls for your own contributions, or contact us for help.

Removing a contribution from normal view is not always the same as immediately erasing every stored copy. Removed material may remain accessible to authorised administrators for moderation or restoration. A removed-comment placeholder may remain where needed to preserve replies.

Leaving a space, having an invitation revoked or being suspended does not automatically delete your earlier contributions.

Account deletion

You can request deletion in the app at:

Settings → Login details → Delete account

You can also use our account-settings page or email david@newmoonart.co.uk.

Deletion removes the authentication account and connected sign-ins included in that account, community profile and avatar, associated account links and relevant notification registrations.

Account deletion does not automatically erase every post, comment or attachment previously shared. Contributions may remain in discussions after their account association is removed. Text, images or information quoted by other members may still identify you.

If you also want contributions or attachments removed, contact us so we can assess and action your request under your applicable rights.

Earlier purchase and booking records are treated separately. We may retain information needed to provide continuing purchase rights, meet accounting obligations or handle legal claims.

Account deletion does not automatically unsubscribe a separately held newsletter subscription. Use an email’s unsubscribe link or ask us to do this when requesting deletion.

Backup copies may remain until backups expire. Account deletion and disabling analytics do not automatically erase historical analytics stored under a separate installation identifier.

We cannot guarantee deletion of screenshots, downloaded copies, search-engine records or other copies outside our control.

14. Security

We use technical and organisational measures intended to protect personal information, including authentication, access controls and encrypted connections.

Access to private information is limited to authorised people and service providers who need it for their work, alongside the community visibility arrangements described above.

No online service can guarantee absolute security. Please protect your sign-in details and consider the audience before sharing personal information.

15. Automated decisions

Shopify provides automated fraud indicators that may flag orders for review. A flag informs our review; it does not by itself determine the final decision.

Community access may be calculated automatically from invitations, memberships and qualifying workshop or course records. Contact us if you believe an access decision is incorrect.

We do not use solely automated decisions that produce legal or similarly significant effects on you.

16. Your rights

Depending on the circumstances, you have rights to:

Request access to your personal information.
Ask us to correct inaccurate or incomplete information.
Request deletion.
Ask us to restrict processing.
Object to processing based on legitimate interests.
Receive certain information in a portable format.
Withdraw consent where we rely on it.

You can object to direct marketing at any time.

Rights are subject to applicable conditions and exceptions. For example, some records may need to be retained to meet legal obligations.

Email david@newmoonart.co.uk to exercise your rights. We may ask for information to verify your identity. Requests are normally free, and we normally respond within one month, subject to extensions or exceptions permitted by law.

17. Complaints

Please contact us if you have concerns about how we use your information.

You also have the right to complain to the UK Information Commissioner’s Office:

Website: ico.org.uk/make-a-complaint

If you live outside the UK, you may also have the right to contact your local data-protection authority.

18. Changes to this policy

We may update this policy when our services, processing practices or legal requirements change. The date at the top shows when it was last updated.

Where changes materially affect how we use your information, including the audience for community contributions, we will provide appropriate notice and seek fresh consent where required.