How we handle your data.

League of One provides executive positioning services: the free Hidden Market Diagnostic and the 1:1 Executive Positioning Programme with its private client workspace. League of One is the data controller for the personal data described here. Contact: liv@leagueof.one.

• If you take the diagnostic: your name, email, role title and your answers, plus the scores we calculate from them. We use these to generate your results, email them to you, and follow up about working together. Lawful basis: our legitimate interest in responding to your request, and consent for any follow-up marketing (unsubscribe any time).
• If you become a client: the material the programme needs: your goals, career history, CV, LinkedIn details, questionnaire answers, session recordings and transcripts, weekly LinkedIn metrics you enter, and the documents we produce together. Lawful basis: performing our contract with you.
• If you connect LinkedIn: your LinkedIn member identifier, display name and the date you connected.We use this to link the account you choose and to publish an approved post only when you review the exact copy and press the final publish button. We store the short-lived access token in encrypted form, its expiry and approved permissions, plus a receipt for each publishing attempt. We do not receive your feed, connections, messages or post analytics, and we do not store a refresh token. Lawful basis: your consent when you connect and your explicit instruction for each post.
• Operational records: programme notes, activity and audit logs that keep your workspace secure and your programme on track. Lawful basis: legitimate interest in running the service properly.

We never ask for special-category data. Please do not enter card or banking details anywhere in the workspace. We do not process payments through it.

Connecting LinkedIn is optional and does not replace your League of One sign-in. You can disconnect it at any time in Network capital. Disconnecting removes the LinkedIn identifier, display name, encrypted access token and permissions from the active connection record while keeping a dated receipt that a connection was removed. Published-post receipts remain with your programme record so the workspace can show what was sent and avoid accidental duplicates. This removes the active link inside League of One. You can separately remove League of One from LinkedIn's permitted services in your LinkedIn settings.

Clients can log business contact details of recruiters and search partners they engage with (name, firm, focus, contact dates). These records are private to your workspace, are meant for business-contact information only, and should not contain notes about anyone's private life.

Your data is stored and processed by a small set of providers under contract: Vercel (hosting), Supabase (database and file storage, held in London, UK), Resend (email delivery), respond.io (the support chat in your workspace), video platforms such as Loom when a session recording or walkthrough is embedded, and an AI provider used to help draft materials. Drafts are always reviewed by a human before anything reaches you, and we minimise the personal detail shared with it. We never sell your data, and access is limited to the League of One team and the providers named here.

If you choose to connect LinkedIn, LinkedIn handles its own sign-in and consent screen under its privacy terms before returning the approved profile details to us. LinkedIn receives the approved post text only when you press the final publish button.

• Diagnostic leads: up to 24 months, then deleted.
• Client workspaces: for your programme plus 12 months, so you can revisit your materials, deleted earlier on request.

You can ask for a copy of everything we hold about you, ask us to correct or delete it, object to processing, or withdraw consent: email liv@leagueof.one and we will respond within 30 days. You can also complain to the UK Information Commissioner's Office (ico.org.uk) if you are unhappy with how we have handled your data.

We set only essential cookies of our own: they keep you signed in to your private workspace or the admin panel and remember your cookie choice. No advertising or cross-site tracking cookies, and no third-party analytics. The support chat and embedded video players in the client workspace may set their own cookies; the Cookie Policy has the full picture.

Everything is served over HTTPS. Client workspaces are invite-only and isolated from each other; files are stored privately and served through expiring signed links; access to operational data is restricted and logged. If we ever became aware of a breach affecting your data, we would tell you and the ICO as the law requires.