Home › Privacy
Privacy policy.
What we do with personal information, written to be read rather than skimmed past.
Last updated 2 September 2026
In short
CPIndex is a counselling index built by counsellors. This policy explains what we do with personal information while the site is in its holding phase, and as we open early access to our first group of counsellors.
- We hold nothing about people looking for a counsellor. There is no client sign-up, no enquiry form and no matching questionnaire. When you contact a counsellor, you contact them directly, off our site. We never see it.
- For counsellors, we hold what you agree to show, and very little beyond it. You choose where each part of your profile appears: on your public page, or on a professionals-only page behind a login that is closed to the public. Behind both we keep only what is needed to run your account and keep it secure.
- Bio builder conversations are deleted, and we tell you when. We keep the biography you approve. We do not keep the conversation that produced it. During our launch phase it is held for 28 days, and that comes down to seven days once the builder is settled.
If anything here is unclear, email privacy@cpindex.co.uk and a person will answer.
Who we are
CPIndex Ltd is the data controller for the personal information described in this policy.
- Company: CPIndex Ltd, registered in England and Wales, company number 17382054
- Registered office: 18 Wycliffe Road, Bournemouth, England, BH9 1JS
- Privacy matters and data rights requests: privacy@cpindex.co.uk
- Complaints, including data protection complaints: complaints@cpindex.co.uk
- General enquiries: hello@cpindex.co.uk
All three reach the same small team. If you write to the wrong one we will route it, not bounce it back to you.
We are registered with the Information Commissioner's Office, the UK's data protection regulator. [Registration number to be inserted]
What this policy covers
This policy covers the CPIndex website at cpindex.co.uk, including the FAQ pages, the public directory and the professionals-only section behind a practitioner login. It also covers email to and from any address at the cpindex.co.uk domain, our early-contact list and newsletter, and counsellor accounts, profiles and the bio builder as these open to our first group of counsellors.
It does not cover other websites we link to, or the websites of the counsellors listed with us. Those have their own policies.
What we hold, and why
If you are looking for a counsellor
We do not collect personal information from people using the site to find a counsellor. There is no account, no enquiry form and no saved search.
When you contact a counsellor you do so directly, by email, phone or their own booking system. That conversation is between you and them. CPIndex is not a party to it and does not receive a copy.
Some counsellors choose to embed a booking or scheduling tool, such as Calendly, on their CPIndex page. If you use one of those tools you are sharing information with that provider and with the counsellor, under their arrangements rather than ours. We say clearly on the page when a tool is embedded.
If you are on our early-contact list
Before launch we asked people whether we could contact them about CPIndex, using a Microsoft form. Where you said yes, we hold:
- your name, email address and, if you gave it, your phone number
- the answers you gave to the other questions on that form
- a record of the consent you gave, and when
We use the answers to plan what to build and who to open to first. They are not published anywhere, they are not attached to any public listing, and they are not shared outside CPIndex. If you later create a counsellor account, your form answers do not become part of your profile.
To stop hearing from us, reply to any message or email us, and we will remove you. There is no cost and no consequence. You can also ask us for a copy of your answers, or ask us to delete them while staying on the contact list.
Lawful basis: consent.
If you subscribe to our newsletter
We hold your email address, and your name if you gave it, together with a record of your subscription. To stop it, reply to any message with the word unsubscribe, or email us. We will remove you and confirm that we have.
While CPIndex is small we send these ourselves from our own Microsoft 365 mailbox rather than through a marketing platform, and we do not track whether you opened a message or clicked a link. When we move to a proper sending system we will add a one-click unsubscribe link, and we will update this policy before we do.
Subscribing is always a separate decision from anything else. We will not add you to the newsletter because you created an account, and we will not require a subscription in order to be listed.
Lawful basis: consent.
If you email us
This applies to every address at cpindex.co.uk: hello@, privacy@, and any other address we publish or give you, including the personal addresses of the people who work on CPIndex. They all arrive in mailboxes we run on Microsoft 365, and they are all handled the same way.
We hold the message, your contact details and any attachments for as long as we need them to deal with what you wrote to us about, and to keep a record of the answer we gave. Messages are read by the small number of people who run CPIndex, and only by those who need to see them to answer you.
If you are writing about something that would be better handled formally, please use the address that matches it: privacy@cpindex.co.uk for a data rights request or a privacy question, and complaints@cpindex.co.uk for a complaint or a concern about a listed practitioner. Those two are logged and answered properly rather than sitting in an individual's inbox.
Lawful basis: legitimate interests in running the business and answering the people who contact us.
Emails we send you
There are two kinds, and they work differently.
- Emails that are part of the service. Your sign-in code, and notices about your own profile, such as when it has gone live or when we need you to change something. You cannot opt out of these while you have an account, because without them the account does not work.
- Our newsletter. Entirely optional and entirely separate, as described above.
We do not track our emails. We do not record whether you open a message from us, and we do not track which links you click. Our emails contain no tracking pixels. If we ever change that, we will say so here, and you will be able to see the same information we do.
Emails that are part of the service are delivered for us by Resend, listed in Section 5. They are sent from servers in Ireland, and they are cryptographically signed so that your email provider can confirm they really came from us.
If you have a counsellor account
| What | Why |
|---|---|
| Name and email address | To identify your account and contact you about it. Your email address is how your account is identified, so we hold it for as long as your account is open |
| Sign-in codes | To let you sign in. We do not use passwords. When you sign in we email you a short numeric code, which works once and expires after 60 minutes |
| Contact details for your practice | To publish on your profile, where you choose to publish them |
| Professional body and registration number | To confirm you are registered with a body recognised by the Professional Standards Authority, and so clients can verify you independently |
| Your biography and profile content | To publish as your page |
| Availability, and whether you are accepting new clients | To publish, and to determine whether your listing appears in results |
| Anything else you upload through your dashboard | Because you chose to add it to your profile |
Lawful basis: performance of our contract with you, and consent for anything you choose to publish.
Our rule on this. We set out to hold only information you have agreed can be shown on the site, plus the small amount needed to run your account and keep it secure. If you cannot see it on one of your pages or in your dashboard, we should not be holding it. If you find that we are, tell us and we will fix it.
Checking your registration
We check your professional body registration when you join, and again when your registration comes up for renewal with that body. We set the next check date from your renewal date, and we hold that date alongside your registration number so we know when to look again. Between those points we do not monitor your registration, and we rely on you to tell us if it changes.
If your registration lapses, is suspended or is withdrawn, you must tell us. Anyone can also tell us by emailing complaints@cpindex.co.uk, and we will check it and act. What we hold, in short: your registration number, your body, the date we last checked, and the date we will check next. All four are visible to you in your dashboard.
A person at CPIndex reads what you submit. Before a profile goes live, one of us reads it and checks your registration against your professional body's public register. CPIndex is two people, both practising counsellors. We record who carried out each check and when, so we can answer the question later if it is ever asked.
Everything else on your profile is yours. We do not verify the content of your biography, your approach, your fees or your availability. You are the one who declares that it is true and accurate, and you can correct it at any time. What that means for responsibility is set out in our Terms of Use rather than here.
Where your profile appears: public and professionals-only
CPIndex has two kinds of profile page, and you decide what goes on each.
Your public page. Open to anyone, including people looking for a counsellor and search engines. This is your client-facing listing.
Professionals-only pages. Some of what CPIndex does is for practitioners rather than clients: supervision, peer connection, room and job listings, and the rest of the for-professionals section. Pages in that section sit behind a login and are visible only to people who have registered with us as practitioners and whose professional body registration we have checked. They are not open to the public, and we exclude them from search engines.
Two things worth being plain about:
- Gated is not private. Anyone who holds a verified practitioner account can see a professionals-only page. That may include colleagues, former supervisees, people you have worked alongside, and people you would rather not hear from. Put on it what you would be content for any peer to read, and nothing you would not.
- Nothing crosses over by itself. Information you put on a professionals-only page is not published on your public page, and information on your public page is not moved into the professionals-only section, unless you put it there. Each is a separate choice in your dashboard, and either can be withdrawn without affecting the other.
Images and files on your pages. Photographs and logos shown on profiles are held in a media library that serves them over public web addresses, which is how images work on most websites. Anyone who has the exact address of an image can open it, even if the page it appears on sits behind a login. The addresses are not listed and cannot be browsed. Please do not put an image on a professionals-only page that you would mind being seen outside it.
We do not tell other users who has viewed your page, and we do not show you who has viewed theirs.
Lawful basis: consent for what you choose to show in each place.
Sensitive information in your profile
Some counsellors choose to show information that data protection law treats as a special category, such as that you offer faith-based work, or that you specialise in working with a community you belong to.
We show it only because you chose to put it on one of your pages, and we treat that as your explicit consent to show it in the place you put it. You can remove it at any time from your dashboard. We do not ask you for this information, and nothing about your listing or your ranking depends on giving it.
Bio builder conversations
The bio builder works as a conversation. You answer questions, and it produces a structured biography that you review and approve.
- What we keep: the biography you approve, as part of your profile.
- What we delete: the transcript of the conversation.
How long we keep the transcript. During our launch phase, transcripts are deleted after 28 days. Once the builder is out of that phase this drops to seven days, and we will update this policy when it does.
The longer window exists for the launch and not beyond it, for three reasons:
- the builder is new and, although it is intuitive to use, we need to review how it performs in its early months, and to improve the questions it asks
- counsellors often start a biography, leave it, and return to it during onboarding, and the transcript is what lets us restore your work rather than asking you to start again
- if you query or complain about how your biography was produced, we need the material to look into it properly within the same onboarding cycle
Nothing else is done with transcripts. We do not archive them, we do not sell them, and we do not share them outside CPIndex and the provider named below. Neither we nor that provider use them to train AI models.
We do use them to improve the builder. Seeing where a conversation went well or badly is how we rewrite the questions it asks and the instructions that sit behind them, so that the next counsellor gets a better conversation than the last one. This is our own editing work on our own wording. It changes the builder, not any AI model, and nothing that identifies you comes out of it. The transcript is still deleted when the window ends.
The builder is powered by Anthropic's Claude API, which processes your conversation in order to produce the biography. Anthropic acts on our instructions, under commercial terms that mean your content is not used to train their models.
Analysing how well the builder works. Within the retention window above, we also run an automated analysis over transcripts to see how effectively the builder is working: where conversations stall, which questions produce weak answers, and where the result needed heavy editing. What comes out of that analysis is a picture of the tool, not of you, and we use it to improve the questions the builder asks. We keep those aggregate findings, which do not name you and cannot be traced back to an individual conversation, and the transcript itself is still deleted at the end of the window.
Lawful basis: legitimate interests. This is a declared, time-limited window for quality control, improving the builder, and supporting you on a new system.
When you visit the website
Our website is hosted by Vercel and our data by Supabase. Their systems keep short-term technical logs covering IP address, browser type and the page requested. These exist to deliver the site and protect it from attack and abuse.
Lawful basis: legitimate interests in keeping the site available and secure.
Who else handles your information
We keep this list short deliberately. Each of these acts on our instructions, under a contract, and none of them may use your information for their own purposes.
| Provider | What they do | Where |
|---|---|---|
| Vercel | Hosts the website | Global content delivery; company based in the USA |
| Supabase | Hosts our database, and manages account sign-in | Ireland (EU) |
| Microsoft 365 | Our mailboxes, our newsletter sending, and the form used for the early-contact list | Microsoft's data centres in Europe, including the UK |
| Resend | Delivers our automated service emails, such as your sign-in code and notices about your profile. They receive your email address, your name where we use it, and the content of the message, and nothing else | Sending servers in Ireland (EU); company based in the USA |
| Anthropic | Powers the bio builder conversation and its effectiveness analysis, through the Claude API | Company based in the USA; transfers covered by their data processing terms |
Resend never receives your profile, your qualifications, your professional body registration, or anything you write in the bio builder.
We do not sell personal information. We do not share it with advertisers, data brokers or lead-generation services, and we do not pass counsellor contact details to third parties for marketing. We may disclose information if we are legally required to, or where it is necessary to protect someone's safety.
International transfers
Our database is hosted in Ireland, which the UK recognises as providing an adequate level of protection. Our Microsoft 365 tenant sits in Microsoft's European region, which covers the UK and the EU. Our automated emails are also sent from servers in Ireland, although Resend is a US company, so US law may in some circumstances reach what it holds.
Where a provider processes information outside the UK or EEA, we rely on the safeguards in their data processing terms, which include the UK International Data Transfer Addendum or standard contractual clauses. If you want to know precisely where a particular provider holds data, ask us at privacy@cpindex.co.uk and we will tell you what we know and point you to the provider's own published information.
How long we keep things
| Information | How long |
|---|---|
| Sign-in codes | Each works once and expires after 60 minutes |
| Bio builder transcripts | 28 days during our launch phase, reducing to seven days thereafter |
| Early-contact list | Until you ask us to remove you, or until we close the list |
| Newsletter subscription | Until you unsubscribe |
| Counsellor account and profile | For as long as your account is open |
| Closed counsellor accounts | Deleted within 30 days of closure, except anything we must keep for accounting or legal reasons |
| General enquiries by email | 12 months from the last message in the exchange |
| Complaints and data rights requests | 3 years, so we can show how we handled them |
| Anything with a contract or payment attached | 6 years from the end of the financial year it relates to, which is the period company law requires us to keep accounting records for |
| Technical logs | Short retention periods set by our hosting providers |
Your rights
Under UK data protection law you have the right to:
- be told what we hold about you and why, which is what this policy is for
- get a copy of your information
- have mistakes corrected
- have information deleted, where we have no continuing reason to hold it
- object to or restrict what we do with it, including anything we do on the basis of legitimate interests
- withdraw consent at any time where consent is the basis, including for the newsletter and the early-contact list
- take your information elsewhere in a portable format
To exercise any of these, email privacy@cpindex.co.uk. We will respond within one month, and there is no charge.
We do not make automated decisions about you that have a legal or similarly significant effect. Listing order on the site is shuffled on a rotation and is not based on a profile of any individual.
Complaints
Please tell us first. If you think we have got something wrong, email complaints@cpindex.co.uk. We will acknowledge your complaint within 30 days, look into it properly, and tell you the outcome. If it is easier to raise it with whoever you were already dealing with, do that. Any address at cpindex.co.uk will reach us, and we will route it.
You also have the right to complain to the Information Commissioner's Office at any time. Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone 0303 123 1113. ico.org.uk/make-a-complaint
Complaining to us does not remove your right to go to the ICO.
Security, children, and changes
We use HTTPS across the site. We do not use passwords. Signing in is by a single-use code sent to your email address, so there is no password for us to store and none for us to lose. Access to the database is controlled by row-level security policies, and access to systems is limited to the small number of people who run CPIndex. No system is perfect; if something goes wrong that puts your information at risk we will tell you, and the ICO, where the law requires it.
The professionals-only section is protected by the same controls: the gate is enforced in the database, not only in the page you see, so a professionals-only page is not served to anyone who is not signed in as a verified practitioner. Those pages are also excluded from search engine indexing.
CPIndex is a directory for adults looking for counselling and for practitioners. It is not designed for or directed at children, and we do not knowingly collect information about anyone under 18.
CPIndex is being built, and this policy will change as it grows. When we change it we will update the date at the top. If a change materially affects how we use your information, we will tell you directly rather than leaving you to notice.
Contact us
Privacy matters and data rights requests: privacy@cpindex.co.uk
Complaints: complaints@cpindex.co.uk
Anything else: hello@cpindex.co.uk
Post: CPIndex Ltd, 18 Wycliffe Road, Bournemouth, England, BH9 1JS