Privacy

Privacy notice

Who this notice is about

This website is operated publicly under the name Anjali Singh-Mitter, Psychotherapist & Neurofeedback Practitioner (BA (Hons) · Dip. Hyp. · MSc, GHR & CNHC Registered) — that public branding does not change. Behind that trading name, the underlying business is Khilari Ltd, a UK limited company of which Anjali is a director. Where a private client engages Anjali for therapy or neurofeedback, that engagement — including invoicing and payment — is with Khilari Ltd, so Khilari Ltd is named here as the data controller for the website and for private client engagements, alongside Anjali’s public trading name.

Khilari Ltd — company number 13168773 — registered office: 1–4 London Road, Spalding, Lincolnshire, England, PE11 2TA.

ICO registration confirmed. Khilari Ltd is registered with the Information Commissioner’s Office under registration reference ZC234828. The ICO has confirmed payment of the data protection fee and states the registration will shortly appear on the public ICO register. (The ICO’s earlier application number was correctly never used as a stand-in for this — application numbers and confirmed registration references are not the same thing.)

Contact for anything in this notice: anjali@anjalismitter.com.

The enquiry form (/enquire)

When someone submits the enquiry form, the following is collected: name, email address, an optional telephone number, an enquiry type (e.g. Private Psychotherapy, Neurofeedback), and a free-text message. Submitting the form requires ticking a consent checkbox confirming the visitor is happy to be contacted about their enquiry.

This information is sent, once, as a single transactional email via Resend (a transactional email delivery service) directly to Anjali’s own mailbox (anjali@anjalismitter.com, hosted on Microsoft 365). Reply-to on that email is set to the visitor’s own address, so replying goes straight back to them.

The website itself does not store this information anywhere — there is no database table, log file or analytics record of enquiry submissions kept by the site. Once the email has been sent, the data exists only: (a) in Anjali’s own mailbox, under whatever retention practice she already applies to her email generally, and (b) transiently within Resend’s own systems, which — like most email delivery providers — briefly retain sending metadata (recipient, timestamp, delivery status) for deliverability and support purposes under their own privacy policy.

Resend is not yet configured or in use on this website — no enquiry has ever actually been sent through it, so this paragraph is prepared ahead of time for when it is switched on, based on Resend’s own current published policies (checked 30 August 2026): Resend’s privacy policy states Personal Data is transferred to and processed in the United States, and is “retained only for as long as is necessary” without a fixed published number of days for message-sending metadata specifically. A Data Processing Addendum is available, covering GDPR obligations, Standard Contractual Clauses for the international transfer, and data subject rights (access, correction, deletion) via support@resend.com.

Anonymous testimonials (/insights/testimonials)

Visitors can submit a testimonial about their experience of working with Anjali, anonymously, via a form that deliberately never asks for a name, email address, or any identifying detail — only free-text testimonial content and an optional general “context” category (e.g. “Private therapy”, “Parent / family”). Submitting requires ticking a box confirming the visitor is happy for it to be published anonymously.

Submitted testimonials are stored, with a status of “pending”, in a database hosted by Supabase. Nothing is ever published automatically: a human (Anjali) reviews pending testimonials and only a testimonial she has manually approved becomes visible on the public page. She can also reject or delete a testimonial. Aside from the testimonial text and the optional context category, no personal data is stored — no name, email, phone number, or raw IP address.

To prevent automated spam submissions, the system keeps a short-lived, anonymous record of how many submissions have recently come from the same visitor: a one-way cryptographic hash of the submitter’s IP address (not the IP address itself — it cannot be reversed back into an IP) and a timestamp, automatically deleted after up to 10 minutes once no longer needed. This exists purely to stop automated abuse of the form and is never linked to any testimonial content.

Retention: a testimonial awaiting review, or one Anjali has rejected, is automatically and permanently deleted 90 days after submission if it hasn’t been dealt with by then. An approved testimonial is not subject to this 90-day limit and remains published/stored until Anjali actively chooses to remove it. Anjali aims to review pending testimonials at least monthly; the 90-day automatic deletion above is a hard backstop regardless of review cadence.

Supabase (database hosting)

Supabase is the database platform behind the testimonials feature (see above). Anjali’s website communicates with it only from its own server-side code — a visitor’s browser never talks to Supabase directly, and no database key of any kind is ever exposed publicly.

Per Supabase’s own privacy policy (checked 30 August 2026): Supabase acts as a data processor for the content of a customer’s database, and states customers “have the option to select where you store your information” at project setup. A Data Processing Addendum is in place, and Supabase’s policy includes a dedicated GDPR section for EEA/UK/Switzerland with Standard Contractual Clauses for any international transfer.

Confirmed (checked in the Supabase dashboard, 31 August 2026): this project’s database is hosted in Supabase’s West EU (Ireland) — eu-west-1 region, and testimonial data is stored and primarily processed there. Supabase’s Data Processing Addendum and its international-transfer safeguards (Standard Contractual Clauses, the GDPR section referenced above) continue to apply wherever processing by Supabase or its authorised subprocessors takes place outside that region — for example, for support, infrastructure or other operational purposes Supabase itself carries out. This project doesn’t have visibility into every instance of that, so the notice describes Supabase’s general safeguards rather than asserting that no transfer of any kind ever occurs.

Calendly and Zoom (scheduling and calls)

The Enquire page links to a Calendly page (calendly.com/anjalismitter/introductory-call) for visitors who want to book a short, free 20-minute introductory call. Calendly is a separate, third-party website — clicking through and booking means giving Calendly whatever details its own booking form asks for (typically name and email, to confirm and remind about the booking), under Calendly’s own privacy policy, not this one. This website itself does not receive or store anything about who books, or what they book.

The introductory call itself then takes place over Zoom, as do some private therapy sessions, which are occasionally conducted remotely rather than in person. Booking and joining a Zoom call means giving Zoom your name and email and, at the time of the call, connecting via Zoom’s app or browser client — all under Zoom’s own privacy policy, separately from Calendly’s and from this one. Calls are not recorded — Anjali does not record introductory calls or remote therapy sessions on Zoom.

Hosting, technical/server logs (Vercel)

The website is hosted on Vercel. Like virtually all web hosting, Vercel’s infrastructure necessarily processes basic technical request data to serve pages at all — things like IP address, browser/device type, the page requested, and timestamps — in short-lived infrastructure logs used for reliability, security and abuse prevention. This website does not itself add any analytics, tracking pixels, or marketing cookies on top of that (there is currently no analytics of any kind installed), and it does not read any of Vercel’s own request logs for any purpose. No cookie banner currently exists because no non-essential cookie is set.

Per Vercel’s own privacy policy and Data Processing Addendum (checked 30 August 2026): Vercel logs request metadata including IP address, location derived from it, and system configuration information for reliability and abuse-prevention purposes; it commits to retaining information only “for the minimum necessary period to fulfil our legal and contractual obligations” without publishing a fixed number of days. Vercel participates in the EU-U.S., UK, and Swiss Data Privacy Frameworks and uses the UK International Data Transfer Addendum and EU Standard Contractual Clauses for transfers; its current subprocessor list (including their locations) is published at security.vercel.com. This site does not choose a specific hosting region itself — it deploys to Vercel’s standard infrastructure.

Links to other websites

The site links out to Instagram and LinkedIn (via icons in the footer/header) and to Shomit Mitter’s own website. Visiting any of these means leaving anjalismitter.com and becoming subject to that site’s own privacy practices, which this notice has no control over.

What this website does not do

For clarity: this website does not use advertising or marketing cookies, does not run any analytics or tracking software, does not sell or share personal information with third parties for their own marketing purposes, and does not use any information submitted through it for anything beyond the specific purpose it was submitted for (responding to an enquiry, or reviewing a testimonial for possible publication).

Your rights

Under UK GDPR, anyone whose personal information is processed has the right to ask to see it, have it corrected, have it deleted, restrict or object to its processing, and (where relevant) receive a copy in a portable format. Anyone who has emailed an enquiry can ask for that email to be deleted from Anjali’s mailbox at any time. Anyone also has the right to complain to the Information Commissioner’s Office (ico.org.uk) if they believe their information has been mishandled — though we’d always welcome the chance to put things right directly first, via anjali@anjalismitter.com.

Khilari Ltd’s ICO registration reference is ZC234828 (see “Who this notice is about” above).