Privacy Policy

1.1 Information You Provide: • Account information: name, email address, password • Payment information: processed by Stripe, Inc.; we receive only the last four digits of your card and transaction metadata. We do not store full card numbers. • Communications: content of messages you send through our contact form • User content: comments, questions, or assignments you submit within the Service

1.2 Information Collected Automatically: • Usage data: pages visited, time spent, course progress, device type, browser type, IP address • Cookies: we use cookies for authentication, session management, and remembering your language preference. See Section 6 below.

We use the information we collect to: • Provide, maintain, and improve the Service • Process payments and deliver purchased content • Send transactional emails (purchase confirmations, password resets, course updates) • Respond to your inquiries and provide customer support • Detect, prevent, and address fraud, abuse, and security issues • Comply with legal obligations

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases: • Contract: to deliver the Service you purchased • Legitimate interests: to improve our Service, prevent fraud, and operate our business • Consent: for marketing communications, where applicable • Legal obligation: to comply with applicable laws

We do not sell your personal information. We share information only with: • Service providers: Stripe (payment processing), our hosting provider, our email service provider, and our AI provider (see section 5) — each bound by confidentiality obligations • Legal requirements: when required by law, court order, or to protect our rights and the safety of users • Business transfers: in connection with a merger, acquisition, or sale of assets, with notice to affected users

The Service includes an AI study assistant ("Iris") that answers questions about the course material.

What Iris receives. When you send a message, we pass along: your message; your selected language; the name you asked to be called by; where you are in the course (module, step, and the tool open on screen); a short summary of your recent step activity; and the state of the course tools you have filled in — boxes ticked, patterns tagged, options selected.

What Iris does not receive. Your journal writing is not sent to the assistant. Diary entries, journal bodies, and notes written inside tracker exercises stay in your account; the assistant is told only that entries exist and when the last one was written, never their content. Iris also has no access to your email address, password, or payment details.

Where it goes. To produce an answer, your message and the context above are sent to our AI provider, OpenAI, which processes them on our behalf. Under their API terms, data submitted this way is not used to train their models. The course material used to ground answers is stored in our own vector database and contains no personal information.

Where it is stored. Conversations and tool state are stored in our own database, on our own servers, alongside the rest of your account. Traffic is encrypted in transit (TLS). At rest, data is protected by access controls on our infrastructure; we do not apply separate end-to-end encryption, and administrators can technically access it.

Crisis detection. If a message contains signals of immediate danger, Iris surfaces crisis resources. For safety review we keep a record that this happened, with names, email addresses, and phone numbers masked — the original text of your message is not stored in that record.

Deletion. You may ask us to delete your assistant conversations, your tool state, and your journal entries at any time — without closing your account — through the contact form at /contact. We action such requests within 30 days.

We retain your personal information for as long as your account is active or as needed to provide the Service. After account closure, we may retain certain information as required by law (for example, transaction records for tax purposes) or for legitimate business purposes (for example, fraud prevention).

We use only the cookies necessary to operate the Service: • Essential cookies: required for the Service to function (authentication and session management) • Functional cookies: remember your preferences, such as your selected language

We do not use analytics, advertising, or third-party tracking cookies. You can control cookies through your browser settings. Disabling essential cookies may prevent the Service from working properly.

8.1 Rights of All Users. You have the right to: • Access the personal information we hold about you • Correct inaccurate information • Request deletion of your information (subject to legal retention requirements) • Object to or restrict certain processing activities • Receive your data in a portable format

To exercise these rights, contact us through the contact form at /contact. We will respond within 30 days.

8.2 Additional Rights for EEA/UK Residents (GDPR). You have the right to lodge a complaint with your local data protection authority.

8.3 Additional Rights for California Residents (CCPA/CPRA). California residents have the right to: • Know what personal information we collect, use, and share • Request deletion of personal information • Opt out of the "sale" or "sharing" of personal information (we do not sell personal information) • Non-discrimination for exercising these rights

To submit a CCPA request, use the contact form at /contact.

Our Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer.

The Service is not directed to children under 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected information from a child under 18, we will delete it.

We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. We will post the updated version at this URL and update the "Last Updated" date. For material changes, we will provide additional notice (such as by email).

For questions, requests, or complaints regarding this Privacy Policy, use the contact form at /contact.

Golding Enterprise LLC — State of California, USA. (Registered-agent address on file with the California Secretary of State.)