Privacy notice

Updated 3 November 2026.

In short

This website runs no analytics or trackers. It sets no cookies. The booking page is the exception: when you press “Show times”, its calendar comes from Cal.com, which sets one security cookie.
There is no account sign-up on this website. If you email us, we receive what you write. If you book a call, Cal.com receives the answers you give on the booking page, for us.
We delete bookings and emails 12 months after our last contact with you, or sooner if you ask.
The course is not open yet. When it opens, UK course records will be kept apart from our US service.
We never hold information about the people you support. The practice home and everyone in it are fictional.

Who we are

Data controller for this website, bookings and emails: Sunset Matches Inc., a US company registered in Delaware, trading as Humble Guest. A UK company will be formed after a few meetings. When it is, this notice will name it.

Contact for privacy questions: hello@humbleguest.com. We have no postal address to publish yet, so please contact us by email.

Representative in the UK: we have not appointed one. A company outside the UK usually needs one under Article 27 of UK GDPR. There is an exception, in Article 27(2)(a), for processing that is occasional, does not include sensitive data on a large scale, and is unlikely to put your rights at risk. While we only book calls with UK organisations, we rely on that exception. We will appoint a representative, or form the UK company, before we take on customers.

Data protection fee: we have not registered with the Information Commission, the UK regulator, or paid its fee. It is not clear that the fee applies to a company with no base in the UK.

What this website collects

There are no analytics. Fonts are served from this website, not from anyone else's. The one third-party script is the Cal.com calendar on the booking page, and it loads only when you ask for times.

The “Looking for the US site?” link takes you to humbleguest.com, our US site, which has its own privacy notice.

On the booking page, the calendar comes from Cal.com. When you press “Show times”, and not before, your browser connects to Cal.com and to Sentry, which Cal.com uses to find errors. Cal.com says it sends Sentry no names, email addresses or IP addresses. Cal.com's security service, Cloudflare, then sets one cookie, __cf_bm, to tell people from automated programs. We can't read it. It expires after 30 minutes without activity. We checked this as far as Cal.com's booking form. We have not yet watched a full booking through to the confirmation, and if it uses anything else, we will add it here.

This website is part of humbleguest.com. We publish it with bolt.new, a service of StackBlitz, Inc., a US company. bolt.new may add a small script of its own to each page; this website’s security settings stop that script loading. Netlify, Inc., a US company, hosts this website for bolt.new. Its servers log each request, including your IP address, the page you asked for and your browser type, to keep the site running and secure. Netlify keeps these logs with providers in the United States. Its data processing agreement says its logs are kept online for 90 days and offline for a year. Netlify acts on our instructions under that agreement. It is on the Data Privacy Framework List and takes part in its UK Extension (see “Where it is stored” below).

When you email us

If you email us, for example to book a call or to ask about free seats, we receive what you write and your email address. We use them to reply and to set up your account if you ask us to, and for nothing else. We will not sell them or use them for advertising. Please don't include anything about the people you support.

Lawful basis: steps you ask us to take before a possible contract, such as answering your questions and arranging a call. And legitimate interests, for following up afterwards. You can object to that at any time (see “Your right to object” below).
Where it is stored: with Google LLC, a US company, which runs our email, calendar and video calls through Google Workspace. It acts on our instructions under its data processing terms. Google may keep mail in any country where it or its suppliers have facilities. Google LLC is on the Data Privacy Framework List and takes part in its UK Extension.
How long we keep it: we delete your emails 12 months after our last contact with you, or sooner if you ask. Google then deletes them from its systems within 180 days.

When you book a call

Our booking page asks for your name, your work email, your organisation, your role and roughly how many new starters you take on a month. When you press “Show times”, your browser passes your answers to Cal.com, which shows a calendar inside our page, and you pick a time. Our website does not keep your answers. Please don't include anything about the people you support.

Your answers reach Cal.com in the calendar's web address. If you press “Show times” but don't book, Cal.com and its hosting providers may still have your name and email in their server logs. Cal.com does not publish how long it keeps these logs.

If the calendar is not available, the page puts your answers into an email instead. Nothing is sent until you send it. We use what you send in the same way, and on the same lawful basis, as a booking made through the calendar.

We use these details to set up a video call with a member of our team, to hold the call, and to follow up on what you asked about. We will not sell them or use them for advertising. Nobody makes a decision about you by computer.

Lawful basis: steps you ask us to take before a possible contract, which here means setting up and holding the call you booked. And legitimate interests, for following up afterwards. Our interest is in answering a care provider or commissioner that asks to talk to us about training. You can object to the follow-up at any time (see below).
Who handles it for us: Cal.com, Inc., a US company, runs the calendar and sends your confirmation email. It acts on our instructions, under its data processing agreement. Cal.com also uses some details for its own purposes, such as keeping its service secure and preventing fraud. Its privacy notice explains this. The companies it uses are listed at trust.cal.com/subprocessors. The booking is also added to our Google Calendar, and the call uses Google Meet. Google LLC provides both, as set out in “When you email us”.
Where it is stored: Cal.com keeps bookings in the United States. Cal.com, Inc., Google LLC and Netlify, Inc. are each on the US Data Privacy Framework List and take part in its UK Extension. UK law allows personal data to go to organisations in the UK Extension (the Data Protection (Adequacy) (United States of America) Regulations 2023). You can see each entry on the Data Privacy Framework List.
How long we keep it: we delete the booking from Cal.com and from our calendar 12 months after our last contact with you, or sooner if you ask. After that, Cal.com's email provider keeps copies of booking emails, and the logs of sending them, for up to about 45 days. Cal.com does not publish how long its backups keep deleted bookings. Google deletes the calendar entry from its systems within 180 days.
You don't have to book online. If you'd rather not use Cal.com, email us at hello@humbleguest.com and we will find a time with you.

Your right to object. You can tell us at any time to stop using your details for this. Email hello@humbleguest.com. If you object to us following up with you about our training, we will stop.

If we contact you first

We may email registered managers and training leads at care providers in England about Humble Guest. We find providers in the Care Quality Commission's public directory of care services, and work email addresses through Apollo.io. We use your name, job title, work email address and your organisation's details, and nothing else. We email you once, or a few times at most, and a person sends each email.

Lawful basis: legitimate interests. Our interest is in telling care providers about training for their new staff. You can object at any time.
Who handles it for us: ZenLeads Inc., trading as Apollo.io, a US company, provides the contact details. Its processing notice explains how it collects them. It hosts its data in the United States and takes part in the US Data Privacy Framework and its UK Extension.
To stop: reply "stop", or email hello@humbleguest.com. We stop, and keep only your email address on a list so that we don't contact you again.
How long we keep it: 12 months after our last contact with you, except the "don't contact" list.

When your staff use the course

The course is not open yet. For each member of staff with a seat, we will hold their name, work email, their progress through the course and practice visits, and the sign-off records you make. We hold no data about the people you support, and the course does not ask staff to type anything about a real person.

For these records, your organisation decides what happens to them and we act on your instructions. Before your staff start, we will sign a data processing agreement with your organisation.

These records will be stored on a project for your organisation, and never on any project used for our US service. Before the course opens, we will update this notice to say where.

Who else handles the data

For this website: bolt.new (StackBlitz, Inc.) and Netlify, as set out in “What this website collects”.

For emails, bookings and calls: Google, Cal.com and the companies Cal.com uses, as set out above.

For contacting providers first: Apollo.io (ZenLeads Inc.), as set out in “If we contact you first”.

For the course: only the suppliers we need to run the service, under written contracts. Before the course opens, we will list them here, with where they keep data and the safeguard for any transfer outside the UK.

Your rights

Under UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, you can ask to see the data we hold about you, to correct it, to delete it, to limit how we use it, to object to how we use it, and to receive it in a portable form. Contact us using the details above. If you are a member of staff using the course, you can also ask your employer.

If you think we have handled your data wrongly, you can complain to us. Email hello@humbleguest.com. We will confirm we have it within 30 days and tell you what we are doing about it.

If you are unhappy with how we have handled your data, please tell us first. You can also complain to the UK regulator, the Information Commission, at ico.org.uk/make-a-complaint. It took over from the Information Commissioner's Office on 30 September 2026.

Changes

We will update this notice when the UK company is formed, before the course opens, and whenever what we do changes. The date at the top shows the latest version.