Privacy Policy

Exegena — Contemplative Writing for the Spiritual Life  ·  Last updated: April 2026

1. Who we are

This website is operated by Exegena, a digital ministry platform run by Malcolm Dragon, based in South Yorkshire, United Kingdom. Exegena produces contemplative writing resources, digital tools including The Promise Box app, and Practical Faith Guides. References to “we”, “us”, or “our” throughout this policy refer to Exegena and its operator.

You can contact us at: hello@exegena.com

2. What information we collect

We collect personal information only where necessary to provide our resources and services. The information we may collect includes:

• Name and email address, when you submit a contact or enquiry form on this website or via The Promise Box app
• Any message content you voluntarily submit through a contact form
• Technical data such as browser type, device type, and approximate geographic region, collected automatically by our website platform (Squarespace) and analytics tools
• Payment-related information if you choose to support Exegena via Buy Me a Coffee — this is handled entirely by Buy Me a Coffee and we do not receive or store your payment details

We do not collect sensitive personal data (such as health, religious belief, or financial information) through this website.

3. How we use your information

We use the information we collect for the following purposes:

• To respond to your enquiries and provide pastoral or ministry support where requested
• To deliver digital resources you have requested
• To improve and maintain this website and our digital tools
• To understand how visitors use our resources, in order to develop them further

We will never sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal basis for processing (UK GDPR)

Under the UK General Data Protection Regulation (UK GDPR), we process your personal data on the following lawful bases:

• Consent — where you have actively submitted a form or opted in to receive resources
• Legitimate interests — for website analytics and security, where these do not override your rights
• Contract performance — where you have requested a specific resource or service from us

5. Cookies and analytics

This website is hosted on Squarespace, which uses cookies to operate the site and collect anonymised analytics data. Squarespace may set cookies for functionality and analytics purposes. You can manage cookie preferences through your browser settings.

We do not use third-party advertising cookies or tracking pixels.

6. Third-party services

Exegena uses the following third-party services, each of which operates under its own privacy policy:

• Squarespace — website hosting and analytics (squarespace.com/privacy)
• Netlify — hosting and form processing for The Promise Box app at promisebox.netlify.app (netlify.com/privacy)
• Buy Me a Coffee — voluntary supporter contributions, under the handle “brothermalcolm” (buymeacoffee.com/privacy-policy)

We have no control over the data practices of these third parties and encourage you to review their respective policies.

7. Data retention

We retain contact form submissions for no longer than 12 months, or for as long as necessary to respond to and fulfil the relevant request. We do not maintain ongoing marketing lists or subscriber databases without your explicit consent.

8. Your rights under UK GDPR

As a resident of the United Kingdom or European Economic Area, you have the following rights regarding your personal data:

• The right to access the personal data we hold about you
• The right to request correction of inaccurate data
• The right to request erasure of your data (“the right to be forgotten”)
• The right to restrict or object to our processing of your data
• The right to data portability
• The right to withdraw consent at any time, where processing is based on consent

To exercise any of these rights, please contact us at hello@exegena.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

9. Data security

We take reasonable precautions to protect your personal data. Our website is served over HTTPS, and we use reputable third-party platforms with their own security practices. However, no method of data transmission over the internet is entirely secure, and we cannot guarantee absolute security.

10. Children’s privacy

Our website and resources are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has submitted personal data to us, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised “last updated” date. Continued use of this website following any changes constitutes acceptance of the updated policy.

12. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please get in touch: