Trichotillomania.com

Privacy Policy

Last updated: 16 July 2026

The short version

We run this site to help people with trichotillomania and their families — not to harvest data. Here's the whole policy in four sentences:

We collect the minimum we need: your email if you subscribe, your payment details (handled by Stripe, never stored by us) if you buy the Parents' Guide, and the professional details therapists choose to publish in the directory. We never ask you to tell us about your health, and we never sell or rent anyone's data to anyone. We don't run ads. You can ask us what we hold about you, or ask us to delete it, at any time.

The rest of this page is the detail, in plain English.

Who we are

trichotillomania.com is operated by IPSU VENTURES LTD, a company registered in England and Wales (company number 12656961). Registered office: 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.

For anything to do with your data, contact us at hello@trichotillomania.com. We're the "data controller" for the personal data described on this page, under the UK GDPR and the Data Protection Act 2018.

A note about privacy and health

We know that for many visitors, simply being on this site is private. Trichotillomania is a condition most people hide, and we take that seriously.

  • We never ask you to tell us about your health. Nothing on this site requires you to disclose that you, or your child, pulls hair. Newsletter signups and purchases work exactly the same whether you have trich, are a parent, a therapist, or just curious.
  • We don't run ads, we don't use advertising trackers, and we don't share browsing data with ad networks or data brokers.
  • If you email us and choose to share personal details about your or your child's experience, we treat that as confidential. We use it only to reply to you, we don't add it to any database, and we delete it in line with the retention periods below.

What we collect, and why

If you just browse the site

Our hosting provider, Vercel, automatically processes technical data needed to serve pages — your IP address, browser type, and the pages requested. This is standard server-log data, kept for a short period and used for security and keeping the site running. Legal basis: our legitimate interest in operating a secure, working website.

If you accept analytics cookies (see Cookies below), we also use Google Analytics 4 to understand how the site is used — which pages are read, how visitors arrive, and roughly where in the world traffic comes from — so we can make the site more useful. Google Analytics 4 does not log or store IP addresses. Analytics runs only if you consent, and the site works exactly the same if you decline. Legal basis: your consent, which you can withdraw at any time via the cookie settings.

If you subscribe to the newsletter

We collect your email address, and use it to send you the emails you signed up for — new articles, practical tips, and occasional updates about the site. Legal basis: your consent. Every email includes an unsubscribe link, and unsubscribing takes effect immediately. Your address is stored with our email service provider, who processes it only on our instructions.

We don't segment subscribers by anything health-related, and subscribing tells us nothing about whether you have trich.

If you buy the Parents' Guide

To deliver your purchase we process your email address (to send the download and receipt) and order details (what you bought, when, and the amount). Legal basis: performing our contract with you.

Payment details are handled entirely by Stripe, our payment processor. Your card number never touches our servers and we never see or store it. Stripe's own privacy policy covers how they handle payment data: stripe.com/privacy.

If you request a refund under the 30-day guarantee, we process the emails involved in order to issue it, and we keep records of transactions and refunds for as long as UK tax and accounting law requires (six years).

If you're a therapist listed in the directory

The directory exists to be public — that's the point of listing. When you apply to be listed, we collect the professional details you provide: name, credentials and registrations, practice location(s), contact details, and the description of your practice. Legal basis: performing our agreement with you to publish your listing.

Two things worth knowing:

  • Your listing is published on the open web and will be indexed by search engines and AI tools. Only include contact details you're happy to make public.
  • You can update or remove your listing at any time by contacting us at hello@trichotillomania.com. Removal from the site is prompt, though search engines may cache old copies for a while — that part is outside our control.

We may verify credentials you provide against public professional registers before publishing.

If you email us

We keep the correspondence for as long as needed to deal with your enquiry, then delete it in line with the retention section below. If your email relates to a purchase or a legal matter, we may need to keep it longer.

Cookies

We keep cookies to the minimum:

  • Essential cookies — set during checkout by Stripe to process your payment securely and prevent fraud. These don't need consent because checkout can't work without them.
  • Analytics cookies (optional) — set by Google Analytics 4, only if you accept them in the cookie banner. They help us see how the site is used so we can improve it. You can decline them, or change your mind later, and everything on the site still works.

We don't use advertising or cross-site tracking cookies.

Who we share data with

We share personal data only with the service providers who make the site work, only for the purposes above, and under contracts that require them to protect it:

  • Vercel — website hosting
  • Stripe — payment processing
  • Google (Google Analytics 4) — website analytics, only with your consent
  • Our email service provider — newsletter and transactional email

We would also disclose data if the law genuinely required it (for example, a valid legal order), or as part of a sale or transfer of the site itself — in which case this policy would continue to apply to your data and we'd notify subscribers.

We never sell or rent personal data. We never share it with advertisers or data brokers. There are no exceptions to this.

International transfers

Some of our providers are US companies, so data may be processed outside the UK. Vercel, Stripe, and Google are each certified under the EU–US Data Privacy Framework and its UK Extension, which the UK government recognises as providing adequate protection for personal data transferred to the US. Where any transfer isn't covered by that certification, it's protected by the UK's approved standard contractual safeguards instead.

How long we keep things

  • Newsletter emails: until you unsubscribe, after which your address is removed from our mailing list.
  • Purchase and refund records: six years, as required by UK tax and accounting law.
  • Directory listings: for as long as you choose to be listed, plus a short administrative period after removal.
  • General correspondence: deleted within 12 months of the enquiry being resolved, unless it relates to a purchase or legal matter.
  • Analytics data: retained by Google Analytics for up to 14 months, then automatically deleted.
  • Server logs: kept by Vercel for a short period for security and reliability purposes.

Your rights

Under the UK GDPR you have the following rights, and we honour them for everyone regardless of where you live:

  • Access — ask for a copy of the personal data we hold about you
  • Correction — ask us to fix inaccurate data
  • Deletion — ask us to erase your data (we'll comply unless we're legally required to keep something, like tax records)
  • Objection and restriction — object to or limit certain processing
  • Portability — receive your data in a usable format
  • Withdraw consent — at any time, for anything based on consent (like the newsletter or analytics cookies)

To use any of these, email hello@trichotillomania.com. We'll respond within one month. We may need to verify you're the person the data relates to before acting.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ico.org.uk). If you're in the EU/EEA, you can complain to your local data protection authority instead.

Children

This site is written for adults — including parents of children who pull their hair. It isn't directed at children, and we don't knowingly collect personal data from anyone under 13. If you believe a child has given us personal data, contact us and we'll delete it.

A parent buying the Parents' Guide gives us their own data, not their child's. We never ask for — and please don't send us — identifying information about your child.

Security

We use reputable providers, HTTPS across the whole site, and access controls on the systems that hold personal data. Payments are handled by Stripe, which is certified to the highest payment-industry security standard (PCI DSS Level 1). No system is perfectly secure, but we deliberately hold as little data as possible — the safest data is the data we never collected.

Changes to this policy

If we change this policy in any meaningful way, we'll update the date at the top and, for significant changes affecting subscribers or customers, tell you by email. Minor clarifications may be made without notice.

Contact

Questions, requests, or concerns about your data: hello@trichotillomania.com

IPSU VENTURES LTD 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE