Privacy Policy — The Misfit Arena

Who we are

The Misfit Arena is run by The Business Misfit World (Joyous Misfit), based in the UK. We are the "data controller" — the company responsible for deciding how your personal information is used.
Our email address for everything privacy-related is admin@joyousmisfit.com.

We only collect what we need to run your membership, bookings and applications. Here is the full list:

Account details: your name, email address, private mobile number and password (or your Google account if you sign in that way). These come from you when you sign up.
Profile details you choose to add: photo, business name, logo, bio, website and social links, and what you offer or need. These are optional.
Privacy choices: whether your profile is visible to other members, and which contact details (if any) other members can see.
Bookings and tickets: which events you have booked, your ticket type, any dietary requirements you tell us, and your arrival status at events you attend.
Applications: what you apply for (speaking, exhibiting, sponsorship, magazine, podcast and so on), your answers to the application questions, and your name, email and mobile number.
Academy: your application answers, your membership plan and renewal dates, and whether you have booked your monthly 1:1.
Messages between members: intros and replies you send through Connect and the Matchmaker.
Payment records: what you bought, how much you paid and when. Payments are taken by Stripe, so we never see or store your full card number — Stripe keeps that.
Basic usage information: which pages you visit and magazine analytics such as how far through an issue you read. This helps the app work properly and tells us what content lands.

We use your information to run The Misfit Arena, and for nothing else. Specifically:

To run your account, membership, bookings, Academy access and event tickets.
To take payments and send receipts, booking confirmations, reminders and order updates.
To review applications to speak, exhibit, sponsor, write or collaborate, and to email you about them — including an invite to book a call if your application is approved.
To keep attendees safe: your name, mobile number and email are visible to the organiser (Emma and her team) for every event, in case of an emergency — even if your profile is hidden.
To suggest people you might want to meet through the Matchmaker. Hidden profiles are never suggested.
To send service emails about your account, bookings and membership. We do not send marketing you have not asked for.
Our legal basis: we use your information to deliver the contract you sign up to (your membership, tickets and bookings), because we have a legitimate interest in running a safe event business, and where the law requires it (keeping payment records).

Other members only see what your privacy settings allow. You can hide your profile or any contact detail at any time from your Profile page.
Your mobile number and email are never shown publicly, including on the Misfit Nation line-up page.
Admins (Emma and her team) can see your name, email and mobile for bookings, applications and event safety, even when your profile is hidden.
Confirmed speakers, exhibitors and sponsors choose what appears on the public line-up: name, photo, business, logo, talk title and bio. Their contact details stay private.
We use trusted providers to run the app: a hosting and database provider, Stripe for payments, an email delivery service, and an AI service for the Matchmaker. They only process your information on our instructions.
We never sell your information, and we never share it for other companies' marketing.

We keep your information only as long as we need it, then delete it:

Account and profile details: while you use your account. If you ask us to delete it, we remove your profile and personal details within 30 days.
Inactive accounts: if you haven't signed in for 12 months, we email you first, then delete your account and personal details if you don't come back.
Payment and booking records: 7 years after the tax year they relate to, because UK tax law requires it. These are kept even if you delete your account.
Applications (speaking, exhibiting, sponsorship, magazine, podcast, Academy and so on): up to 2 years after you apply, so we can invite you to future opportunities. Ask us to delete sooner and we will.
Dietary requirements and event check-in details: deleted 3 months after the event.
Messages between members (intros and replies): while your account is open, and deleted with your account.
Magazine reading analytics: up to 2 years, then deleted.

We keep tracking to a minimum. We don't use advertising cookies, and we don't sell or share your browsing with advertisers.

Essential sign-in storage: your browser stores a small sign-in token so you stay logged in. Without it you can't use your account, so it can't be switched off.
Essential app memory: your browser remembers small things to make the app work, like the page you were on in the magazine, where to take you after signing in, and whether you've already seen a pop-up. None of it is shared.
Magazine analytics: when you open or read the magazine, we record which issue, how long you read and a random session code (plus your account, if you're signed in). It tells us which content lands. It never leaves our own system.
Payments: when you pay, Stripe sets its own cookies to prevent fraud. These are covered by Stripe's privacy policy.
Google sign-in and booking calendars: if you sign in with Google or open a booking calendar, Google may set its own cookies, covered by Google's privacy policy.
Hosting: our hosting provider counts page visits in an anonymous, cookie-free way to keep the site running well.
Managing your preferences: go to your Profile page and use 'Cookies & analytics' to switch off magazine reading analytics or optional cookies (we don't use any optional cookies today, and they stay off unless you tick the box). Your choice saves straight away. You can also clear or block cookies and site storage in your browser settings at any time (this will sign you out), or email us and we'll delete your reading history.

Under UK GDPR you have real rights over your information, and we make them easy to use yourself:

Make a request from your account: on your Profile page, under "Your data", choose a copy of your data, a correction, or deletion and tap Send. You can see the status of every request there.
See your information: view and edit your profile, bookings and applications any time in the app.
Correct it: edit most details yourself on your Profile page, or ask us.
Download it: send a request from your Profile page, or email us, and we will send you a copy of your information in a common format, within one month.
Delete it: send a deletion request from your Profile page and we will remove your profile and personal details within 30 days, except records we must keep by law.
Object or restrict: you can object to how we use your information, or ask us to pause using it while we check a complaint.
Change your mind: where you have given consent (for example to receive certain emails) you can withdraw it at any time.
Complain: if you're unhappy with how we handle your information, email us first at admin@joyousmisfit.com — then you can complain to the Information Commissioner's Office at ico.org.uk.

The quickest way: sign in and use "Your data" on your Profile page.
Or for any privacy question or request, email admin@joyousmisfit.com.
Tell us your name and, if you can, the email address on your account, so we can find your details quickly.
We reply to every privacy request within one month. If a request is complicated, we will tell you within the first month and may take up to two more.
We never charge a fee for a privacy request.