REBUILD BY REECE STONE · PRIVACY

Your information. Your choices.

Last updated: 15 October 2026.

Current service: this site includes a local, interactive preview. Verified test accounts and cloud storage are connected through Neon. Paid membership and Stripe payment processing remain disabled. This notice distinguishes the local preview from connected test accounts. The operator must confirm the legal controller details and final processor/retention arrangements before paid launch.

Who to contact

For REBUILD privacy questions and data-rights requests, contact Reece Stone and the authorised team at media@stone-consulting.net. This service is presented as REBUILD by Reece Stone. The contracting legal entity and postal contact must be confirmed before paid registration opens; this page does not claim that an unverified company is the controller.

What the preview stores

The 90-day planner, actions, reflections, check-ins and preview choices you choose to save are stored in your browser’s local storage. For signed-out preview use, these entries are not sent to a member database or shared with other visitors. For an entitled signed-in test account, the workspace also synchronises with the connected database. A shared device can expose these entries to other people using that browser. Do not enter health records, bank details, account balances, identity documents or other sensitive information.

Your browser sends ordinary request information, such as IP address, user agent and requested page, to the hosting provider, Vercel, to deliver the site and protect it from abuse. We do not run advertising or audience-analytics scripts in this release.

Forms and email

In the preview, podcast, welcome-session, agenda and mentorship forms prepare an email for you to review and send in your own email application. They do not silently submit an application, book a session or take payment. The email becomes available to the team only when you send it. Your email provider’s terms also apply. Signed-in entitled test accounts can submit podcast, welcome-session and agenda requests directly to private review queues; submitting a request does not confirm a booking. Mentorship delivery is not yet connected.

Connected test accounts and planned paid membership

Connected accounts use your email, name, verified sign-in credentials and access status. Authentication is handled by Neon Auth. Your saved workspace, posts, replies, reports and the requests you explicitly submit are processed to provide the connected features. Card details will be entered on hosted Stripe Checkout rather than stored on this website; Stripe will manage recurring billing, receipts and the self-service billing portal.

Vercel hosts the application; Neon provides PostgreSQL storage and managed authentication. The selected database region is London (AWS eu-west-2). Authentication verification and password-reset messages use Neon’s shared test email sender. Stripe remains unconnected; operational mentorship email delivery also awaits configuration. A London database does not mean all hosting, authentication, email, support or backup processing stays in the UK. The operator must confirm processor contracts, safeguards, retention and any international transfers before public onboarding.

Why information is used

Requested account, billing and membership functions would ordinarily be processed to perform the membership contract or take steps at your request before that contract. Necessary security and abuse-prevention processing is based on the operator’s legitimate interests, balanced against your rights. Legal record-keeping may be required for completed payments. Optional external-media storage requires your consent, and any direct marketing would need its own appropriate basis and opt-out.

REBUILD is not a healthcare service. Do not submit special-category health or trauma records. A general form checkbox is not permission for unrestricted processing of sensitive information. Before enabling any feature intended to collect such information, the operator must establish an applicable UK GDPR Article 9 condition and appropriate safeguards.

Who can see member information

For connected accounts, your private workspace belongs to your account and is separate from the public preview and community forum. Posts and replies are shared with active members. Podcast applications and 30-minute welcome-session requests are restricted to the Administrator and authorised Managers by default. During setup, the authorised temporary administrator is the site builder; the final handover to Reece has not taken place. Delegated permissions are controlled by Reece. Reports are directed to the reporting tier immediately above the person reporting. Data is not sold to advertisers.

Cookies, local storage and embedded media

The privacy-choice record is saved for up to six months. Essential session cookies keep verified account sign-in functioning. Local planner entries are saved when you ask to use that feature; they remain until you clear them or your browser removes them. There are no optional advertising or analytics cookies in this release.

Videos hosted by an external provider do not load automatically. Optional embedded media remains off until you allow it and choose to load a video. You can choose “Accept all”, “Accept essential cookies” or “Reject optional cookies”. Rejecting optional storage does not prevent you from using the preview. Change your preference using Cookie settings at the foot of any page. Changing a choice does not automatically erase cookies already held by an external provider; your browser’s site-data controls can remove those.

Retention and deletion

Clear or export local preview entries from Account settings. Closing a browser tab does not erase local storage. Email enquiries are retained only as needed to respond and handle follow-up, disputes or legal obligations; contact the team to request deletion. The operator must document concrete retention periods for member records, inactive accounts, applications, moderation logs, hosting logs and backups before inviting real members; the current cloud setup is for testing.

Exporting your information

In Account settings, “Export my data” downloads the available application records for your signed-in account: profile, workspace, applications, posts, replies, reports and membership status. Each category is limited to 1,000 records in the download; the file identifies any category that may reach that limit. Authentication-provider records, hosting logs and other provider-held records are not part of this download. Contact the team for help with a fuller access request or deletion.

Your rights

Depending on the processing and applicable exemptions, you can ask to access, correct or erase your personal information; restrict or object to processing; obtain a portable copy; and withdraw consent without affecting prior lawful processing. Contact media@stone-consulting.net. Identity checks may be needed to protect your information. The usual response period is one month, with permitted extensions explained where relevant.

You can raise a concern with the UK Information Commissioner’s Office at ico.org.uk. You do not have to contact us first, although the team welcomes the opportunity to resolve a concern.

Security and automated decisions

The member implementation is designed to verify permissions on the server, not trust a role stored in a browser. No system can promise absolute security. The current preview does not make automated decisions with legal or similarly significant effects and is not a source of financial, medical or psychological advice.

Changes and launch review

This notice must be reviewed against the actual controller, providers and operations before paid membership and public onboarding open. A published notice alone does not certify GDPR compliance. Material changes will be reflected here.