Privacy Policy
How we handle your data. Plain English first, with the legal substance behind it.
Last updated: 3 November 2026
1. Who runs Distil
Distil is a sole-trader business operated by Sebastian Stallard, trading as "Distil". For the purposes of UK GDPR, the data controller is:
Sebastian Stallard, trading as Distil
Service address: Distil, 124 City Road, London, EC1V 2NX
Email: [email protected]
If we incorporate as a limited company in future, this policy will be updated and you will be notified.
2. What data we collect
Information you give us directly
- Intake questionnaire answers: including health goals, current medications, supplements, diet, sleep, exercise, alcohol and smoking habits, where you live, and (where you choose to share them) sensitive details such as conditions, pregnancy status, recent medical history, mental health, menstrual and reproductive health, and blood test results. We also store a record of which questions your answers made visible to you, so your report can be read against exactly the form you saw.
- Contact details: first name, last name, email address.
- Payment confirmation: Stripe handles your card details directly. We never see or store full card numbers, CVV, or expiry. We receive only a confirmation that payment succeeded, the amount, and a Stripe customer reference.
- Journal email signup (optional): if you subscribe to journal updates from a /journal essay, we store your email address, the timestamp, the source page, and your IP address (used only to rate-limit and prevent abuse). You can unsubscribe at any time from any email we send.
- Country waitlist (optional): if you tell us in the questionnaire that you live outside the United Kingdom and choose to join the waitlist, we store your email address, the country you chose (and the country you typed, if you chose "Somewhere else") and the time. Nothing else: not your IP address, and none of your other answers. We use it only to email you when the report is written for where you live.
Information collected automatically
- Essential cookies: see Section 8 below.
- Server logs: your IP address, the page you asked for (without anything after a "?" in the address, and with any report link masked), the time, the response status, your browser's own description of itself (its user agent), the website that linked you here (its address only, not the page), and whether you arrived from a link tagged with a campaign name or from Facebook. Used for security, debugging and understanding which links bring people here. Retained for 30 days.
- Error reports: when something breaks, an anonymised error report is sent to Sentry (see sub-processors below). No questionnaire content is included in error reports.
- A country hint: Cloudflare tells our server which country your connection appears to come from. The questionnaire uses this only to pre-select an answer to "Where do you live?", which you can change. We keep it only if you keep that answer and send the questionnaire.
3. Special category data (sensitive health data)
Some of the questions ask about diagnosed conditions, medications, mental health, pregnancy, and other matters classified as "special category data" under UK GDPR Article 9. We collect this only with your explicit consent at the point you submit the questionnaire, and we use it only to generate your supplement report.
You are not required to answer any specific question, but the more we know, the safer and more accurate your report will be. Skipping a sensitive question simply means our report will not factor it in.
4. Why we collect it (lawful basis)
| What we use it for | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Generating your report | Performance of contract (Art. 6(1)(b)) |
| Processing your payment | Performance of contract (Art. 6(1)(b)) |
| Sending your report and confirmation emails | Performance of contract (Art. 6(1)(b)) |
| Special-category health data | Explicit consent (Art. 9(2)(a)) |
| Keeping payment records for HMRC | Legal obligation (Art. 6(1)(c)) |
| Security logging and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Understanding how the site is used and which links bring people here (our server logs and usage logs, Section 8) | Legitimate interests (Art. 6(1)(f)) |
| Beta-tester feedback (where invited) | Legitimate interests (Art. 6(1)(f)). Opt-in only |
| Sending journal updates (where you subscribed) | Consent (Art. 6(1)(a)). Opt-in only, opt-out in every email |
| Emailing you when the report is sold where you live (where you joined the waitlist) | Consent (Art. 6(1)(a)). Opt-in only; ask us to remove you at any time |
5. Who we share it with
The following sub-processors receive parts of your data strictly to deliver the service:
| Provider | Purpose | Region |
|---|---|---|
| Anthropic | Generates your report (Claude AI). Receives your intake answers as the input to the model. | USA. Covered by Anthropic's Data Processing Addendum and Standard Contractual Clauses |
| Stripe | Payment processing. Receives only your name, email, and payment details. Never your health data. | Ireland (EU) / USA. Standard Contractual Clauses |
| Resend | Sending your confirmation and report-delivery emails. | EU (eu-west-1, Ireland) |
| Cloudflare | DNS, edge security, and (planned) report file storage via R2. | USA / global edge. Standard Contractual Clauses |
| Hetzner | Server hosting (where your report is generated and stored). | Germany (EU) |
| Sentry | Anonymised error monitoring. Receives no questionnaire content. | Germany (EU) |
| Substack | Delivering the journal newsletter, and only if you subscribe to it. Receives your email address and the essay you subscribed from. Never your questionnaire answers, your report, or any health data. | USA. Standard Contractual Clauses |
Each of the above is bound by a written data processing agreement and processes data only on our instructions.
Beyond the sub-processors listed above, we do not share your data with marketers, advertisers, insurers, employers, supplement brands, or anyone else. We do not sell your data, ever.
6. How long we keep it
| What | How long | Why |
|---|---|---|
| Intake questionnaire answers | 24 months from submission, then auto-deleted | So you can come back for a re-run or comparison; longer than this is unnecessary |
| Generated reports (HTML) | 24 months from generation, then auto-deleted | Same as above |
| Payment records (transaction confirmations only) | 7 years | HMRC tax record-keeping requirement |
| Email contact details, including the internal job record that builds and sends your report | Until you request erasure | So we can answer follow-up questions or honour future contact |
| Messages you send us through a form on this site, such as the interactions checker's "tell us what is missing" form or a feedback form | Until you ask us to remove them | So we can reply to you, and so we can add what you told us was missing |
| Our own usage logs (see Section 8) | 6 months | To see which pages people open, how many use the free tools, and where they stop |
| Counts of the interactions checks we could not answer, by name and date (see Section 8) | 6 months | So we know which medicines and pairs to add next |
| Server logs | 30 days | Security, debugging and understanding which links bring people here |
| Error reports (Sentry) | 90 days | Sentry default retention |
| Waitlist email and country | Until we have emailed you that the report is sold where you live, or until you ask us to remove you | So we can tell you once, and for nothing else |
You can request earlier deletion at any time. See Section 7.
7. Your rights
Under UK GDPR you have the right to:
- Access your data: get a copy of everything we hold about you.
- Rectify: ask us to correct anything that is wrong.
- Erase: ask us to delete your data (the "right to be forgotten").
- Restrict: ask us to stop processing your data while a question is being resolved.
- Object: object to processing based on legitimate interests.
- Portability: receive your data in a machine-readable format.
- Withdraw consent: at any time, with no detriment to you. Withdrawal does not affect processing already done lawfully before withdrawal.
- Complain to the ICO: if you believe we have mishandled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.
To exercise any of these rights, email [email protected]. We respond within 30 days. We may ask for proof of identity before releasing or deleting data.
8. Cookies
The site sets only the following essential cookie:
| Cookie | Purpose | Duration |
|---|---|---|
beta_master | Keeps the site operator signed in to the administration pages. It is set only when the operator logs in with the admin password, so a visitor using the site does not receive it. | 12 hours |
It is HttpOnly, Secure in production, and SameSite=Lax. It is exempt from consent requirements under PECR Regulation 6(4) (strictly necessary for the service requested).
In plain English
We use Cloudflare's Web Analytics to count page views and see roughly where our visitors come from. It does not set any cookies, does not fingerprint you, and does not track you across other sites. We also keep two small counting logs of our own, on our own server: one notes that someone ran an interactions check, the other notes which of our pages a visit opened, which website linked to it, and how far into the questionnaire the visit reached. Neither stores your IP address, and neither stores what you typed. Separately, we count the interactions checks we could not answer, by the names of the items and the date only, so we know what to add next. We never see who you are individually from any of this, only aggregate numbers like "37 people opened the questionnaire today".
We use Cloudflare Web Analytics for aggregate traffic measurement. It is cookieless, does not set any client-side identifiers, does not use device fingerprinting, and is enabled at the Cloudflare proxy layer (no third-party JavaScript runs in your browser for this purpose). The data we receive is aggregate: page-view counts per URL, anonymous referrer (which site sent you here), country (not city or IP), and browser/device class. Cloudflare Web Analytics collects, stores and shares no personally identifiable information. This processing is exempt from consent requirements under PECR Regulation 6(4) on the basis that it is anonymous statistical measurement strictly necessary for service operation, and is in any case carried out by Cloudflare in their capacity as our infrastructure provider. Cloudflare's analytics retention is 6 months.
We also keep two first-party usage logs on our own server, and this section describes them because they are ours rather than a sub-processor's. One records that an interactions check was run; the other records which of our pages was opened, the name of the website that linked to it, and which step of the questionnaire a visit reached. Neither sets a cookie. The first is written on our server from the request we already received. For the second, a few lines of script on our pages tell our server when a page is opened or a questionnaire step is reached, and our server notes when a questionnaire is sent and when you go on to payment. A page record holds that page's address on our site, the time, your browser's broad category and the name of the site you came from, such as google.com, never the address of the page you were reading there. Neither log stores your IP address, and neither stores what you entered, so the supplements, medications and questionnaire answers you type never appear in them. A page record carries no code of any kind. Every other record, including the separate note made when a visit opens our home page or a sample report, holds in place of an IP address a one-way code derived from it, mixed with a secret value and with the date, so the code changes every day and cannot be turned back into an address. We keep your browser type only as a broad category, such as browser or automated crawler, and in the second log the site that referred you only by its name, such as google.com. We retain both logs for 6 months.
We treat those daily codes as pseudonymous rather than anonymous, because a pseudonym is still personal data under UK GDPR even when we cannot identify anyone from it. In practice we cannot: the code rotates daily and we hold nothing that links it to you, which also means that if you ask us to erase your data we have no way to find your rows in these two logs. Everything else described in this policy that relates to you, including anything you send us through a form, we can and will erase on request. This processing is exempt from consent requirements under PECR Regulation 6(4) as statistical measurement strictly necessary for operating the service. If we ever introduce richer analytics with cookies or with identifiers that persist across visits, we will update this policy and provide a clear opt-in.
We also keep a count of the interactions checks we could not answer, so we know what to add to the checker next. When you check a supplement against a medicine and we have not yet assessed that pair, we add one to the count for those two names on that day. When you search for a medicine we know of but do not yet hold, we add one to the count for that medicine's name on that day. The names come only from our own database and lists: if what you typed is not one of those names, leaving aside capital letters, accents, punctuation and spacing, nothing is kept. The count holds no IP address, no daily code, no browser details and no time of day, only the names, the date and the number. It holds nothing that identifies you or anyone else, and we never combine it with any other record to work out who looked something up, so we treat it as anonymous. That is also why there is nothing in it we could find and erase on request. So that the same internet address does not add to a count again and again, the server holds a one-way code made from your IP address, a secret value and the date, together with the names already counted for that code. It holds these only in its working memory, never in a file, and forgets them at midnight UK time or sooner. Our lawful basis for this use of your IP address is our legitimate interest in keeping the counts accurate. Automated crawlers that identify themselves are not counted. A day here runs from midnight to midnight UK time, and each day's counts are deleted when they are 6 months old.
9. Security
Data is transmitted over TLS 1.2+ and stored on servers in Germany (Hetzner) and on Cloudflare's edge (where applicable). Access to production systems is restricted by SSH key authentication. Stripe handles all card data; we never see it. Special-category health data is logically separated from contact identifiers in our systems wherever possible.
No system is perfectly secure, and we will not promise otherwise. If we ever experience a personal data breach that meets the UK GDPR threshold, we will notify the ICO within 72 hours and notify affected users without undue delay.
10. International transfers
Some of our sub-processors (Anthropic, Stripe, Cloudflare) operate in the USA. Where data is transferred outside the UK/EEA, we rely on the UK Addendum to the EU Standard Contractual Clauses, plus the UK Government's adequacy decisions where relevant, to maintain UK GDPR-equivalent protection.
11. Children
Distil is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has used the service, please contact us and we will delete the data.
12. Changes to this policy
If we change this policy in any material way, we will update the "Last updated" date above and, if you have an active intake or report on file with us, we will notify you by email. Minor wording fixes will not be notified individually.
13. Contact
Questions, requests, or complaints about how we handle your data:
Email: [email protected]