Privacy Policy
Version: 2.1 | Last updated: 2 July 2026
This Privacy Policy explains how Shooting Systems Ltd ("we", "us", "our") collects, uses, stores, and protects your personal data across all of our services. It applies to:
- the Zero mobile application ("the App"),
- the Zero: Financial Knowledge marketing website at
darrensterling.co.ukand its associated forms, - the Schools sample-pack programme and any follow-up correspondence relating to it,
- our business-to-business outreach to UK schools, colleges and trusts about the KS4 curriculum (see 2.7),
- email communications you receive from us at
darren@darrensterling.co.uk,darren@schools.darrensterling.co.uk, or any other@darrensterling.co.ukaddress.
We are committed to protecting your privacy and handling your data transparently.
1. Who We Are
Data Controller: Shooting Systems Ltd Company number: 16001177 (England and Wales) Registered office: Riverside House, 4 Melbourne Street, Stalybridge, SK15 2JE, United Kingdom Contact email: privacy@darrensterling.co.uk ICO Registration: ZC135407
2. What Data We Collect
2.1. The App: your data stays on your device
The App has no accounts, no sign-up, and no cloud database. Everything you enter — your onboarding answers (date of birth, UK jurisdiction, employment status, marital status, children, homeowner status), your finance records (accounts, bills, income, transactions, pots, debts, standing orders, insurance policies), and your saved calculator results — is stored only on your device.
We never receive, store, or have access to this information. Because it never reaches us, we do not process it within the meaning of the UK GDPR, and it cannot be exposed by a breach of our systems.
You can take a copy of everything at any time via Profile → Export data (JSON), and permanently remove everything via Profile → Erase all data.
2.2. Digital Legacy Vault (paused, not yet available)
The Digital Legacy Vault feature is a planned future addition. It is not currently available: the Vault tab in the App displays a Coming Soon placeholder, and no vault data is collected, processed, or stored under this version of the Privacy Policy. If and when the Vault feature launches, this Privacy Policy will be updated in advance to describe what is collected, how it is encrypted, and how next-of-kin access is handled.
2.3. Technical Data (App)
The only information that ever leaves your device is:
| Data | Purpose | Legal basis |
|---|---|---|
| Crash reports (via Sentry) | App stability, bug fixing. No personal or financial data included; IP addresses are stripped. | Legitimate interest |
| Usage analytics (via PostHog) | Product improvement. Anonymous feature-level events only. Only collected with your explicit opt-in consent (Profile → Privacy & Data → Analytics; off by default). | Consent |
Your App purchase itself is processed entirely by Apple or Google under their own privacy terms — we do not receive your payment details or store account information about you.
2.4. Marketing-site Lead Capture (darrensterling.co.uk)
When you submit a form on our marketing website (e.g. requesting the schools sample pack at /schools), we collect:
| Data | Purpose | Legal basis |
|---|---|---|
| Name | Personalising the materials we send you | Consent |
| Email address | Sending the requested materials and the related follow-up sequence (see 2.5) | Consent |
| Role (e.g. PSHE Lead) | Tailoring follow-up communications | Consent (optional field) |
| School / organisation name | Tailoring follow-up communications | Consent (optional field) |
| Jurisdiction (England / Scotland / Wales / other) | Sending region-relevant curriculum information | Consent (optional field) |
| IP address & user-agent at the time of submission | GDPR consent audit trail (proof of when and how consent was given) | Legitimate interest |
This data is stored in our Supabase database (EU region) and is accessible only by Darren Sterling. We do not share it with third parties for marketing.
2.5. Schools Sample-pack Follow-up Sequence
After you request the schools sample pack, you will receive a structured 5-email sequence over approximately 60 days:
| Sent | Purpose | |
|---|---|---|
| 1 — Sample pack | Immediately on form submission | Deliver the requested PowerPoint lesson and PDF chapter |
| 2 — Check-in | ~14 days later | Ask whether the materials landed and were useful |
| 3 — Use case | ~28 days later | Share an example of how another school used the materials |
| 4 — Pricing FAQ | ~42 days later | Answer the questions other schools have asked |
| 5 — Final note | ~56 days later | A time-limited offer; final email unless you reply |
Every email in the sequence includes a one-click "Unsubscribe" link in both the email body and the message header (RFC 8058 compliant — your email client will display a native Unsubscribe button). Unsubscribing is processed immediately and is permanent — once you unsubscribe, you will not be re-added even if you re-submit the form, unless you explicitly opt back in.
If you reply to any email in the sequence, the automated cadence is paused for your record so we can have a normal one-to-one conversation.
We retain your contact details for 24 months from your last interaction (open, click, reply or new submission), after which the record is deleted. If you unsubscribe, your record is retained on a suppression list indefinitely for the sole purpose of preventing future emails — this is permitted under UK GDPR and is necessary to honour your unsubscribe.
2.6. Email Replies and One-to-one Correspondence
If you email us at darren@darrensterling.co.uk or any other @darrensterling.co.uk address, we collect and retain:
| Data | Purpose | Legal basis |
|---|---|---|
| Your email address | Replying and continuing the conversation | Legitimate interest |
| The content of your email | Responding appropriately | Legitimate interest |
| Headers and metadata your email client provides | Standard email handling | Legitimate interest |
Email is processed by Microsoft 365 (EU tenant) for inbound and outbound, and by Resend for the schools cadence and outreach emails. Both are documented in Section 5.
2.7. Cold Outreach to UK Schools (Legitimate Interest)
Separately from the opt-in sample-pack programme above, we run a limited business-to-business outreach campaign introducing our KS4 financial-education curriculum to UK secondary schools, colleges and multi-academy trusts. These emails are sent from darren@schools.darrensterling.co.uk.
What we process: the organisation's name, its publicly-listed or role-based contact email address (e.g. office@, info@), the jurisdiction (England / Scotland / Wales / Northern Ireland), and basic send and engagement status (queued, sent, delivered, bounced, replied, unsubscribed).
Source: this information is compiled from publicly available sources — schools' own websites, the Department for Education's Get Information About Schools (GIAS) service, and equivalent published directories. We do not buy lists from third-party data brokers, and we do not guess or target the personal addresses of named individuals — we contact generic, role-based organisational mailboxes only.
Lawful basis: Legitimate interest (UK GDPR Article 6(1)(f)). Our legitimate interest is introducing a relevant, curriculum-aligned educational resource to the organisations responsible for delivering the statutory KS4 financial-education requirement. We have carried out a legitimate-interests assessment and consider the processing proportionate: the recipients are organisations rather than consumers, the content is directly relevant to their statutory duties, the volume is low and throttled, and every message offers a one-click opt-out.
Your control: every outreach email carries a one-click "Unsubscribe" link in both the body and the message header (RFC 8058 — your email client shows a native Unsubscribe button). Unsubscribing is immediate and permanent — the address is moved to a suppression list and is not contacted again. You can also simply reply asking us to stop, or email privacy@darrensterling.co.uk. If you object to this processing, we will cease contacting you.
Retention: outreach contact records are retained for up to 24 months from the last send or interaction, after which non-responding records are deleted. Suppressed records (unsubscribed, bounced or complained) are retained on a suppression list solely to ensure we do not contact you again.
2.8. Cold Outreach to UK Institutions (Legitimate Interest)
We also run a limited business-to-business outreach campaign introducing our financial-education book, audiobook, classroom resources and app to UK institutions for whom they are directly relevant: public library services, further-education colleges and sixth forms, multi-academy trusts, money-advice and financial-education charities and credit unions, and trade unions, professional bodies and membership organisations (for member financial-wellbeing). These emails are sent from ZeroFinance@darrensterling.co.uk.
What we process: the organisation's name, its publicly-listed or role-based contact email address (e.g. office@, info@, enquiries@, libraries@), nation within the UK, website, the public source the address came from, and basic send and engagement status (queued, sent, delivered, bounced, replied, unsubscribed).
Source: this information is compiled exclusively from publicly available sources — organisations' own websites and published contact pages, and official open datasets and registers (for example the Department for Education's Get Information About Schools service, the Charity Commission register, and GOV.UK / Arts Council library datasets). We record the source of every address. We do not buy lists from third-party data brokers, and we contact generic, role-based organisational mailboxes — not the personal addresses of named individuals, and not sole traders or individual subscribers.
Lawful basis: Legitimate interest (UK GDPR Article 6(1)(f)). Our legitimate interest is introducing relevant, low-cost financial-education resources to the organisations whose remit they serve — library collections, post-16 education, money advice, and member wellbeing. We have carried out a legitimate-interests assessment per audience segment and consider the processing proportionate: recipients are organisations (corporate subscribers) rather than consumers, content is directly relevant to their function, the volume is low and throttled, and every message offers a one-click opt-out.
Your control: identical to Section 2.7 — every email carries a one-click Unsubscribe (RFC 8058) in body and header; unsubscribing is immediate and permanent via a suppression list; you can reply asking us to stop or email privacy@darrensterling.co.uk, and we will cease contacting you.
Retention: as Section 2.7 — up to 24 months from last interaction for non-responders; suppressed records retained solely to honour the opt-out.
3. What We Do NOT Collect
- We do not collect the personal or financial data you enter in the App — it never leaves your device
- We do not require an account, email address, or any registration to use the App
- We do not collect your bank login credentials (the App uses manual entry, not Open Banking)
- We do not use advertising SDKs or share data with advertisers
- We do not sell your data to third parties — ever
- The App does not use cookies (it is a native mobile application). The marketing website uses essential cookies only — see Section 9.
- We do not track your location
- We do not add anyone to the schools cadence who has not actively requested the sample pack
4. How We Use Your Data
| Purpose | Data used | Legal basis |
|---|---|---|
| Improve the App | Opt-in anonymous analytics, crash reports | Consent / Legitimate interest |
| Send the schools sample pack and its 5-email follow-up sequence | Marketing-site lead data (see 2.4, 2.5) | Consent |
| Respond to your enquiries | Email address, message content | Legitimate interest |
| Comply with legal obligations | Lead-capture consent audit trail | Legal obligation |
The data you enter in the App is used only by the App, on your device, to provide its features — it is not transmitted to us and we make no use of it.
5. Data Sharing
We share data only in these limited circumstances:
| Recipient | What | Why | Country |
|---|---|---|---|
| Supabase (database, edge functions) | Marketing-site lead data (schools programme) | Infrastructure — Data Processing Agreement in place | EU (Ireland) |
| Resend (transactional email) | Schools sample pack + 5-step cadence emails | Email delivery — Data Processing Agreement in place | EU (Ireland) |
| Microsoft 365 (inbound/outbound mail) | Email replies and one-to-one correspondence | Mailbox provider — Data Processing Agreement in place | EU (Ireland tenant) |
| Cloudflare (DNS, edge protection, CDN) | IP addresses, request metadata (website) | Security — DDoS protection, WAF | UK + global |
| Vercel (marketing-website hosting) | Request-level metadata (no submitted form data — that goes directly to Supabase) | Hosting darrensterling.co.uk | USA — Standard Contractual Clauses in place |
| Sentry (crash reporting, App) | Crash data with IP addresses stripped; no personal or financial data | App stability | EU (Frankfurt) |
| PostHog (App analytics, opt-in only) | Anonymous usage events (with your consent only) | Product improvement | EU (Frankfurt) |
| Apple / Google (App purchase) | Your App purchase is between you and the platform; we receive aggregate sales reporting only | Store distribution | USA |
| Amazon Kindle Direct Publishing | Book purchase data (book sales metadata only — no contact between us and individual purchasers via this route) | Book distribution | USA |
| Law enforcement | Data we actually hold (see above) if required by valid legal order. Note: we hold none of the data you enter in the App, so we cannot provide it. | Legal obligation | UK |
We do not share your data with any other third parties.
6. Your Rights (UK GDPR)
Under the UK GDPR, you have rights over personal data we hold about you. Because the App keeps your data on your device, most App-related rights are satisfied by design and under your direct control:
| Right | In the App | For website / schools / email data |
|---|---|---|
| Right of access | Your data is on your device; Profile → Export data (JSON) produces a complete copy | Email privacy@darrensterling.co.uk — response within 30 days |
| Right to rectification | Edit any data directly in the App | Email privacy@darrensterling.co.uk |
| Right to erasure | Profile → Erase all data (immediate, permanent) | Email privacy@darrensterling.co.uk; for schools-cadence data, click any unsubscribe link or email us |
| Right to data portability | Profile → Export data (JSON) | Email privacy@darrensterling.co.uk |
| Right to object / withdraw consent | Analytics toggle in Profile → Privacy & Data (off by default) | Click the unsubscribe link in any cadence email, or email privacy@darrensterling.co.uk |
| Right to complain | You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data rights have been infringed | Same |
We respond to all subject-rights requests within 30 days as required by the UK GDPR. For complex requests, we may extend by an additional 60 days and will notify you within the first 30 days if so.
7. Data Security
| Measure | Detail |
|---|---|
| App data isolation | All App data is stored in the App's sandboxed storage on your device, protected by platform security (iOS Data Protection / Android app sandboxing) and your device passcode or biometrics. It is not transmitted to us. |
| Encryption in transit | The App's only network traffic (crash reports, opt-in analytics) and all website traffic use HTTPS (TLS 1.2 minimum, TLS 1.3 preferred) |
| Edge protection (website) | Cloudflare WAF, DDoS protection, rate limiting |
| Email authentication | SPF, DKIM, and DMARC (p=quarantine) published for darrensterling.co.uk to prevent spoofing |
| Access control (leads) | Schools lead data is held in Supabase (EU) with access restricted to Darren Sterling |
| Monitoring | Sentry error monitoring; Checkly uptime monitoring for the website |
8. Data Retention and Deletion
| Data type | Retained while | On deletion request |
|---|---|---|
| App data (profile, finance, saved calculations) | On your device, under your control | You delete it: Profile → Erase all data, or delete the App |
| App crash reports | 90 days (Sentry default) | No user link exists — already anonymised |
| Opt-in App analytics | Indefinite | Anonymous — no user link exists |
| Schools sample-pack lead data | 24 months from last interaction | Permanently destroyed immediately on request, OR moved to a suppression list (email + hash only) on unsubscribe |
| Schools-cadence audit log (which email was sent when) | 6 years (UK statute of limitations) | Lead identifier removed; aggregate retained |
| Email correspondence | 24 months from last reply | Permanently destroyed immediately on request |
Erasing your App data:
- Navigate to Profile → Privacy & Data → Erase all data
- You will be shown a clear statement that this permanently removes everything from your device and cannot be undone
- Confirm — all App data on the device is destroyed immediately
Deleting the App from your device also removes its data (subject to your platform's backup behaviour — check your iCloud / Google backup settings if you want copies removed there too).
Schools-cadence unsubscribe:
- Click any "Unsubscribe" link, or use your email client's "Unsubscribe" button
- Your record is moved to a suppression list immediately — you will receive no further emails
- The suppression list contains only your email address (hashed) and the date you unsubscribed
- You may request full deletion of even the suppression-list record by emailing privacy@darrensterling.co.uk; we will comply, with the consequence that we cannot guarantee not to email you again if you re-submit a form in the future
9. Cookies and Similar Technologies
The App does not use cookies (it is a native mobile application).
The marketing website (darrensterling.co.uk) uses only essential cookies necessary for the site to function:
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| Session token | Vercel (hosting) | Page rendering and security | Session |
__cf_bm and similar |
Cloudflare | Bot management, security | 30 minutes |
We do not use analytics cookies, advertising cookies, or any third-party tracking on the marketing website. No consent banner is shown because no consent is required for strictly-essential cookies under PECR.
10. Children's Privacy
The App's financial content is intended for adults; purchase requires meeting the App Store / Google Play minimum age requirements. The App collects no personal data from anyone — see Section 2.1.
The schools sample-pack programme is intended for teachers and education professionals, not students.
11. International Transfers
The data we actually hold is processed and stored within the European Economic Area (EEA) and the United Kingdom:
- Supabase (schools leads): EU (Ireland) region
- Resend: EU (Ireland) region
- Microsoft 365: EU (Ireland) tenant
- Sentry / PostHog: EU (Frankfurt)
A small number of processors operate from the United States and process limited data on our behalf:
- Vercel (marketing-website hosting). Standard Contractual Clauses (SCCs) in place. No personal form-submission data flows through Vercel — submissions go directly from the user's browser to Supabase.
- Apple / Google (App distribution and purchase). Your relationship with the store is governed by its own privacy policy.
- Amazon Kindle Direct Publishing (book distribution). Book sales data only — no contact between us and individual purchasers via this route.
Where data is transferred outside the UK/EEA, we rely on the UK International Data Transfer Addendum to the EU SCCs, or equivalent safeguards.
12. Changes to This Policy
We may update this Privacy Policy from time to time. The current version is always available at https://darrensterling.co.uk/privacy.
For material changes, we will:
- Publish the updated policy at the URL above with a new "Last updated" date
- For App users: notify you via in-app messaging in an App update before the changes take effect
- For schools-cadence subscribers: include a brief notice in the next scheduled email
The "Last updated" date at the top of this policy reflects the most recent revision.
13. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:
Email: privacy@darrensterling.co.uk
Postal: Shooting Systems Ltd, Riverside House, 4 Melbourne Street, Stalybridge, SK15 2JE, United Kingdom
ICO: If you are not satisfied with our response, you may contact the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.