Your Rights: You have full control over your data. You can access, update, or delete your information at any time through your account settings or by contacting us at [email protected]
1. Information We Collect
1.1 Information You Provide Directly
When you create an account or use our services, we collect:
| Data Type | Purpose | Required/Optional |
|---|---|---|
| Name and Email | Account creation, authentication, and communication | Required |
| Password | Secure account access (encrypted and hashed) | Required (unless using OAuth) |
| Lesson Progress Data | Track completed lessons and learning progress | Automatic |
| Practice Exercise Responses | Provide feedback and improve course content | When completing exercises |
| Payment Information | Process subscription payments via Stripe | For paid subscriptions |
| Support Communications | Provide customer support and assistance | When you contact us |
1.2 Information from Third-Party Authentication
If you sign up or log in using third-party services (Google OAuth or GitHub OAuth), we collect:
- Basic Profile Information: Name, email address, and profile picture (from the OAuth provider)
- OAuth Token: Used for authentication purposes only
- Provider ID: Unique identifier from the OAuth provider to link your account
Note: We do not store your OAuth provider's password. Authentication is handled securely through the OAuth provider.
1.3 Information We Collect Automatically
When you use our platform, we automatically collect:
- Usage Data: Lesson views, time spent on lessons, features accessed, audio playback completion
- Device Information: Browser type, device type, operating system, screen resolution
- Log Data: IP address, access times, pages visited, error logs, API requests
- Session Data: Authentication tokens, session duration, login/logout times
- Cookies and Local Storage: Authentication status, user preferences (see Cookie Policy below)
2. How We Use Your Information
We use your information for the following purposes:
- Provide Our Service: Account management, lesson delivery, progress tracking, authentication
- Process Payments: Handle subscription payments securely through Stripe (we do not store full credit card numbers)
- Personalize Experience: Display your progress, track completed lessons, provide personalized fortune teller results
- Communicate: Send course updates, account notifications, password resets, support responses
- Improve Our Platform: Analyze usage patterns to enhance lessons, fix bugs, and develop new features
- Ensure Security: Detect and prevent fraud, abuse, unauthorized access, and security threats
- Legal Compliance: Meet legal obligations, enforce our Terms of Service, respond to legal requests
3. Legal Basis for Processing (GDPR)
For users in the European Union and UK, we process your personal data based on the following legal grounds:
- Contractual Necessity: Processing necessary to provide our service and fulfill our contract with you (account creation, lesson delivery, payment processing)
- Legitimate Interests: Processing necessary for our legitimate business interests (improving our service, security, fraud prevention)
- Consent: For marketing communications and optional features (you can withdraw consent at any time)
- Legal Obligation: Compliance with legal requirements (tax, accounting, law enforcement requests)
4. Information Sharing and Disclosure
4.1 We DO NOT Sell Your Data
We never sell, rent, or trade your personal information to third parties for marketing purposes.
4.2 Third-Party Service Providers
We share your information with trusted third-party service providers who help us operate our platform:
| Service Provider | Purpose | Data Shared |
|---|---|---|
| Heroku (Salesforce) | Platform hosting and infrastructure | All account and course data |
| MongoDB Atlas | Database storage | All account and course data |
| Stripe | Payment processing | Payment information, email, name |
| Google OAuth | Third-party authentication | Email, name (if you use Google login) |
| GitHub OAuth | Third-party authentication | Email, name (if you use GitHub login) |
| Meta (Facebook) | Advertising conversion tracking and measurement | Hashed email, IP address, user behavior data (with your consent) |
All third-party providers are contractually obligated to protect your data and use it only for the specified purposes.
4.3 Legal Requirements
We may disclose your information if required by law or if we believe it's necessary to:
- Comply with legal obligations, court orders, or government requests
- Protect our rights, property, or safety, or that of our users
- Detect, prevent, or address fraud, security, or technical issues
- Enforce our Terms of Service
5. Data Retention
We retain your personal data for different periods depending on the type of data and purpose:
- Account Data: Retained while your account is active and for 30 days after account deletion (unless required by law to retain longer)
- Lesson Progress Data: Retained while your account is active
- Payment Records: Retained for 7 years for tax and accounting purposes
- Support Communications: Retained for 2 years for quality assurance
- Log Data: Retained for 90 days for security and troubleshooting
After the retention period, we securely delete or anonymize your data so it can no longer identify you.
6. Your Rights and Choices
GDPR Rights (EU/UK Users)
If you are in the European Union or United Kingdom, you have the following rights:
- Right to Access: Request a copy of all personal data we hold about you
- Right to Rectification: Correct inaccurate or incomplete data
- Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data
- Right to Restrict Processing: Limit how we use your data
- Right to Data Portability: Receive your data in a structured, machine-readable format
- Right to Object: Object to processing based on legitimate interests
- Right to Withdraw Consent: Withdraw consent at any time (for consent-based processing)
- Right to Lodge a Complaint: File a complaint with your local data protection authority
CCPA Rights (California Users)
If you are a California resident, you have the following rights under CCPA:
- Right to Know: Request disclosure of what personal information we collect, use, and share
- Right to Delete: Request deletion of your personal information
- Right to Opt-Out: Opt out of the sale of personal information (we do not sell data)
- Right to Non-Discrimination: Not be discriminated against for exercising your privacy rights
6.1 How to Exercise Your Rights
To exercise any of these rights, please contact us at:
- Email: [email protected]
- Subject Line: "Privacy Rights Request - [Your Request Type]"
- Include: Your name, email address, and specific request
We will respond to your request within 30 days (or as required by applicable law). We may ask you to verify your identity before processing your request.
7. Cookies and Tracking Technologies
7.1 What Cookies We Use
We use the following types of cookies and similar technologies:
- Essential Cookies: Required for authentication, session management, and basic functionality (cannot be disabled)
- Authentication Tokens: Stored in localStorage to keep you logged in (authToken)
- Preference Cookies: Remember your settings and preferences
- Analytics Cookies: Google Analytics cookies to understand how visitors use our website (requires your consent)
- Marketing Cookies: Meta Pixel (Facebook) cookies to measure advertising effectiveness and optimize ad campaigns (requires your consent)
7.2 Third-Party Cookies
We may use cookies from third-party services:
- Google OAuth: For third-party authentication
- GitHub OAuth: For third-party authentication
- Stripe: For payment processing
- Meta Pixel (Facebook): For tracking ad conversions and measuring advertising effectiveness (requires your consent)
7.3 Managing Cookies
You can control cookies through your browser settings. However, disabling essential cookies may prevent you from using certain features of our platform.
8. Marketing Communications
8.1 Opt-In Requirement
We only send marketing communications to users who have explicitly opted in during registration or through their account settings. Marketing consent is completely optional and separate from your acceptance of our Terms of Service.
8.2 What Marketing Communications Include
If you opt in to receive marketing communications, you may receive:
- New course announcements and updates
- Exclusive AI prompting tips and techniques
- Special offers and discounts
- Industry insights and best practices
- Updates about Brainsful products and services
8.3 Unsubscribing
You can unsubscribe from marketing communications at any time by:
- Clicking the "Unsubscribe" link at the bottom of any marketing email
- Updating your email preferences in your account settings
- Contacting us at [email protected]
Important: Unsubscribing from marketing emails will not affect transactional emails (such as order confirmations, password resets, account notifications, or important service updates).
8.4 Data Used for Marketing
When you opt in to marketing communications, we may use:
- Your email address (to send communications)
- Your name (for personalization)
- Your course progress and interests (to send relevant content)
- Your engagement with previous emails (to improve future communications)
We never sell, share, or rent your email address to third parties for their marketing purposes.
9. Data Security
We implement industry-standard security measures to protect your personal data:
- Encryption: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS
- Password Security: Passwords are hashed using bcrypt before storage (never stored in plain text)
- Access Controls: Limited employee access to personal data on a need-to-know basis
- Secure Infrastructure: Hosting on Heroku with enterprise-grade security
- Database Security: MongoDB Atlas with encryption at rest and in transit
- Regular Security Audits: Monitoring for vulnerabilities and security threats
Important: While we take extensive security measures, no internet transmission or electronic storage is 100% secure. You are responsible for maintaining the confidentiality of your account password.
10. International Data Transfers
Our servers and service providers may be located in different countries. If you are accessing our service from outside the United States, your data may be transferred to and processed in the United States or other countries.
10.1 EU/UK Data Transfers
For users in the European Union and United Kingdom, we ensure that international data transfers comply with GDPR and UK GDPR through:
- Standard Contractual Clauses (SCCs) with our service providers
- Adequate safeguards to protect your data during transfer
- Compliance with EU and UK data protection regulations
11. Children's Privacy
Our service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete that information promptly.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected]
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. When we make changes:
- We will update the "Last Updated" date at the top of this page
- We will notify you of material changes via email (to your registered address) or through the platform
- For significant changes that affect your rights, we will provide at least 30 days' notice
Important: You are responsible for regularly reviewing this Privacy Policy, our Terms of Service, and Data Processing Agreement during your subscription period. We recommend checking for updates at least once per month or whenever you log in to your account.
Your continued use of our service after changes become effective constitutes acceptance of the updated Privacy Policy.
13. Third-Party Links
Our platform may contain links to third-party websites or services (such as OpenAI's ChatGPT documentation). We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.
14. Your California Privacy Rights
California residents have specific rights under the California Consumer Privacy Act (CCPA) and California's "Shine the Light" law:
- Information Disclosure: Request information about categories of personal information collected and shared
- Opt-Out of Sale: We do not sell personal information, so no opt-out is necessary
- Non-Discrimination: We will not discriminate against you for exercising your privacy rights
15. Do Not Track Signals
Some browsers support "Do Not Track" (DNT) signals. Currently, there is no industry standard for responding to DNT signals. We do not currently respond to DNT browser signals, but we respect your privacy choices and limit tracking as described in this policy.
Contact Us About Privacy
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
- Privacy & Data Protection: [email protected]
- General Support: [email protected]
Response Time: We aim to respond to all privacy inquiries within 2 business days (48 hours).
Data Protection Authority: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.
Note: This Privacy Policy is provided in English. If translated into other languages, the English version shall prevail in case of any conflicts or discrepancies.