Privacy Policy

Last updated: September 2026

This policy explains what personal information Week1 collects, how we use it, who we share it with, and the rights you have over it.

Week1 is a service provided by Modas Group Limited, trading as Week1 ("Week1", "we", "our", or "us"). We are the data controller for the personal information described in this policy. For anything to do with your privacy, email us at support@week1.io.

1. Who this policy is for

This policy covers people who visit our website, join our waitlist, create a Week1 account, or use the Week1 app. Week1 is a tool for founders and businesses. It is not intended for children, and you must be at least 18 to create an account.

2. Information we collect

Information you give us

• Account details: your name, email address, and a password (which we store only as a secure one-way hash, never in plain text).
• Your product and marketing profile: the information you provide during onboarding and in your settings, such as what your product is, your website or brochure link, who your customers are, your pricing, your current traction, the channels you use or prefer, your goals, your strengths, your available time, and your weekly schedule.
• Content from your website: if you give us a link to your product or brochure page, we fetch that page and use its content to draft a product profile for you to review and edit.
• Your activity in the app: the plans generated for you, actions you complete or swap, the feedback and reflections you submit each week, your progress and any user or customer numbers you record, and your streaks.
• Support and other messages: anything you send us, for example through the in-app support form or by email.

Information we collect automatically

• Technical and usage data: your IP address, browser and device information, and log data about how you use the Service, which we use to run, secure, and debug it.
• Security and anti-abuse data: signals used to verify you are a real person at sign-up and password reset (see Cloudflare Turnstile below), and security tokens for email verification, password resets, and email changes (stored only as hashes).

Payment information

When you subscribe, your payment is handled by Stripe acting as merchant of record. Stripe collects and processes your card and billing details directly. We do not see or store your full card number. We store only limited billing status information, such as your subscription state, plan, trial end date, and identifiers that link your account to Stripe.

3. How we use your information, and our legal bases

Under UK data protection law we must have a lawful basis for using your personal information. We use it to:

• Provide the Service: create and manage your account, generate your weekly plans, and run the app. Basis: performance of our contract with you.
• Personalise your plans, including with AI: turn your product and marketing profile into specific, tailored actions (see the AI section below). Basis: performance of our contract, and our legitimate interest in making the Service useful.
• Take payment and manage your subscription. Basis: performance of our contract, and compliance with legal obligations such as tax and accounting.
• Send you service and account emails you need to receive, such as verification, password resets, billing notices, and important account changes. Basis: performance of our contract.
• Send you optional notification emails, such as "your plan is ready", check-in reminders, and progress updates, which you can turn on or off in your settings at any time. Basis: your consent, which you can withdraw.
• Keep the Service secure and prevent abuse: authentication, bot detection, rate limiting, and fraud prevention. Basis: our legitimate interest in protecting the Service and our users, and compliance with legal obligations.
• Support you and respond to your messages. Basis: performance of our contract and our legitimate interest in helping our users.
• Improve the Service: understand how it is used and make it better. Basis: our legitimate interest in improving Week1. We use aggregated or de-identified data for this where we can.
• Comply with the law and enforce our Terms. Basis: legal obligation and legitimate interest.

4. AI and automated processing

Week1 uses artificial intelligence to do two things: draft a product profile from your website, and generate your weekly marketing plans. To do this, we send relevant parts of your product and marketing profile (for example your product description, audience, stage, goals, and preferred channels) to our AI provider, Anthropic, and we send short pieces of your product text to Voyage AI to match it against our library of marketing actions.

These providers process this information only to return a result to us. Under our agreements with them, they do not use your data to train their models. We do not sell your data or use it to train models of our own.

The AI helps prepare your plan, but it does not make decisions that have a legal or similarly significant effect on you. You are always in control: you review and edit the drafted profile, and you choose whether to do, skip, or swap any suggested action. If you would like a human to look at anything the AI produced for you, email support@week1.io.

5. Who we share your information with

We do not sell your personal information, and we do not share it for third-party advertising. We share it only with service providers who help us run Week1, and only as needed. These providers process your data on our behalf under contracts that require them to protect it:

We may also disclose your information if the law requires it, to protect our rights, users, or the Service, or as part of a business sale or reorganisation, in which case we will tell you if your data becomes subject to a different privacy policy.

6. International data transfers

Some of our providers are based outside the United Kingdom, including in the United States. When your personal information is transferred outside the UK, we rely on appropriate safeguards, such as the UK's International Data Transfer Agreement or Addendum, Standard Contractual Clauses, or a country the UK has decided offers adequate protection. You can ask us for more detail about these safeguards.

7. How long we keep your information

We keep your personal information for as long as your account is active. If you delete your account, we delete or anonymise your personal information within 30 days, except where we need to keep certain records for longer, for example:

• billing and tax records, which we and Stripe keep for as long as the law requires (typically up to 6 years);
• information we must keep to resolve disputes, prevent abuse, or comply with a legal obligation.

Residual copies may persist in secure backups for a short period before they are overwritten.

8. How we protect your information

We use technical and organisational measures to protect your data, including encryption in transit, hashed passwords and security tokens, access controls, and secrets management. No online service can be completely secure, but we work to protect your information and to respond quickly if something goes wrong. Tell us at support@week1.io if you think your account has been accessed without permission.

9. Your rights

Under UK data protection law, you have the right to:

• Access a copy of the personal information we hold about you;
• Correct information that is wrong or incomplete (you can edit most of it directly in the app);
• Delete your information ("right to erasure"), which you can do by deleting your account or by asking us;
• Restrict or object to certain processing, including processing based on our legitimate interests;
• Portability: receive certain information in a portable format;
• Withdraw consent at any time where we rely on it, for example by turning off notification emails.

To exercise any of these, email support@week1.io. We will respond within the time the law allows (usually one month). You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we would appreciate the chance to help first.

10. Cookies and local storage

We keep our use of cookies and similar technologies to what the Service needs to work. We use:

• Essential storage to keep you signed in and remember basic preferences;
• Cloudflare Turnstile at sign-up and password reset to check you are a real person.

We do not use advertising cookies or cross-site tracking. If we ever add optional analytics, we will update this policy and, where required, ask for your consent.

11. Changes to this policy

We may update this policy as the Service changes. If we make significant changes, we will let you know by email or in the app, and we will update the date at the top of this page.

12. Contact

For any privacy question, or to exercise your rights, email us at support@week1.io.