What we collect, why we collect it, who we share it with, and how to exercise your rights.
This policy explains what personal data SleepOriginal collects, why, who we share it with, how long we keep it, and the rights you have over it. We have written it to describe what our systems actually do rather than to cover every theoretical possibility.
Business details. SleepOriginal is a trading name of Akram Azouagh, a sole proprietor registered in Morocco under the auto-entrepreneur regime, national register number 0038465820000089.
Registered address: Secteur B, Rue 11, No 4, El Bassatine, 50000 Meknes, Fes-Meknes, Morocco
Contact: hello@sleeporiginal.com
We sell digital products only. Nothing is shipped.
Who we are
SleepOriginal ("we", "us", "our") publishes sleep education content, sells digital sleep guides, and recommends third-party sleep products. For the purposes of UK and EU data protection law we are the data controller for the personal data described in this policy.
For any privacy question, request, or complaint, contact privacy@sleeporiginal.com.
What we collect
We collect only what a given interaction requires. We do not buy personal data from third parties, and we do not build advertising profiles.
Information you give us
- Newsletter and guide signups: your name (where you provide it), email address, the page or campaign you signed up from, and a record of the consent you gave, including its date and the exact wording shown to you.
- Sleep quiz: your answers to the quiz questions, a confirmation that you are over 18, your result category, and the guide recommended to you. If you choose to receive your result by email, your email address is linked to that quiz session.
- Purchases: your email address, the items ordered, order totals, currency, and the status of the payment. We never see or store your card or bank details — those go directly to our payment provider.
- Downloads: your email address and a one-way hash of your download token, used to verify your access to a purchased file.
- Direct correspondence: anything you send us by email.
Information collected automatically
- Analytics events: which content modules you viewed and which internal links you clicked, together with the article and product involved, an opaque random session identifier, your browser's user-agent string, and a one-way cryptographic hash of your IP address. We do not store raw IP addresses for site analytics, and these events carry no name or email address.
- Security and administration: if you hold an administrator account, we record IP address, user agent and activity in an audit log so account misuse can be investigated.
- Cookies: described in our Cookie Policy.
A note on sleep quiz answers
Your quiz answers describe sleep habits — bedtimes, routines, how rested you feel. Depending on what you enter, this may be information you consider sensitive.
We want to be direct about how we handle it. We use your answers only to generate your result and recommend a relevant guide. We do not use them to infer any medical or health condition, we do not use them for advertising or profiling, we do not sell them, and we do not share them with product partners. The quiz is an editorial tool, not a diagnostic or screening instrument, and it produces no medical assessment of any kind.
Where quiz answers are processed at all, we rely on your consent, which you may withdraw at any time by contacting us.
Why we use your data, and our legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Fulfil your order | Take payment, deliver your digital guide, and provide download access | Performance of a contract |
| Send marketing emails | Sleep tips, new guides and offers | Consent — withdrawable at any time |
| Deliver quiz results | Generate your result and recommend a guide | Consent |
| Measure content performance | Understand which guides and modules are useful, using hashed and non-identifying data | Legitimate interests — improving our content, balanced against your privacy by not storing raw IPs |
| Keep the site secure | Detect abuse, rate-limit requests, maintain an admin audit trail | Legitimate interests — securing our service |
| Keep financial records | Retain transaction records for tax and accounting | Legal obligation |
Who we share your data with
We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We use a small number of service providers who process data on our behalf under contract:
| Provider | Purpose | What they receive |
|---|---|---|
| PayPal | Payment processing | Order amount, currency, and the payment details you enter directly with them |
| Stripe | Payment processing, where offered | As above |
| Brevo | Email delivery | Your name and email address, and whether you opened our emails |
| Google Fonts | Website typography | Your IP address and browser information, by virtue of your browser requesting the font files |
| jsDelivr and Tailwind CDN | Serving site scripts and styles | As above |
We may also disclose data where we are legally required to, or to establish or defend legal claims.
Amazon and other retailers
When you click a link to a retailer such as Amazon, you leave our site and that retailer's own privacy policy applies. Amazon may set its own cookies to attribute a purchase to us. We receive only anonymous, aggregated commission reports — we do not receive your name, address, payment details, or a list of what you bought. See our Affiliate Disclosure.
International transfers
Some of our providers are based outside the UK and EEA, principally in the United States. Where personal data is transferred outside the UK or EEA, we rely on safeguards recognised under applicable law — typically the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, and where relevant the EU–US Data Privacy Framework. You may request details of these safeguards from us.
How long we keep it
- Marketing contacts: until you unsubscribe or ask us to erase your record, and we review inactive contacts periodically.
- Quiz sessions: up to 24 months from your last activity, then deleted or anonymised.
- Orders and download entitlements: retained for as long as needed to provide access and to meet tax and accounting obligations, which is typically six years.
- Analytics events: up to 26 months, in a form that already contains no direct identifiers.
- Administrator audit logs: up to 24 months.
Your rights
If you are in the UK or the EEA, you have the right to:
- be told how your data is used, and to access a copy of it;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict or object to our processing, including any processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, without affecting processing already carried out; and
- complain to a supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EEA it is your national data protection authority.
To exercise any of these, email privacy@sleeporiginal.com. We respond within one month and will not charge you or treat you differently for asking.
If you are in California
Under the CCPA as amended by the CPRA you have the right to know what personal information we collect and why, to request deletion or correction, to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising these rights.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not knowingly process the sensitive personal information categories defined by the CPRA for the purpose of inferring characteristics. To make a request, email privacy@sleeporiginal.com.
Children
SleepOriginal is intended for adults. Our quiz asks you to confirm you are over 18, and our products are not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
How we protect your data
We serve the site over HTTPS, store passwords using a strong one-way hash, store download tokens only as hashes, hash IP addresses used for analytics, apply a Content Security Policy, rate-limit sensitive endpoints, restrict administrative access by role, and keep an audit trail of administrative actions. No system is perfectly secure, but we take these measures seriously and review them.
Changes to this policy
If we change how we use personal data, we will update this page and revise the effective date below. Where a change is significant, we will tell subscribers by email.
Contact us
Privacy questions and requests: privacy@sleeporiginal.com. Anything else: hello@sleeporiginal.com.