Privacy release status

Founder-internal preview · not an operative privacy notice

Public data collection is held. Lead capture, commerce, and support APIs remain disabled in this release candidate. The final controller identity, privacy contact, public address, retention schedule, and jurisdiction-specific notices still require founder approval and qualified legal review.

Governed data map

Contact and account: name, email, phone, and learner identifiers supplied for an approved purpose.
Purchase and entitlement: product, price, order/transaction reference, refund state, and access state.
Learning: course login, native progress, lesson activity, support, and human-verification state.
Diagnostic: the minimum result and attribution needed for the approved handoff; raw private answers are not placed in shared analytics.
Security and operations: timestamps, request IDs, suppression state, and sanitized failure evidence.

Intended uses

The released system is designed to provide requested content, reconcile a purchase, grant or remove course access, operate learner support, record progress and verification, prevent duplicates or abuse, and meet documented legal/accounting duties. Marketing email requires a separate recorded consent. SMS marketing, AI calls, and recording are outside the phased v1 release.

Service-provider boundary

The governed stack includes HighLevel for CRM, checkout, entitlement, learning, and workflow state; Stripe or the configured payment provider for payment processing; Vercel for the public website; and approved email, security, analytics, and media providers only when configured for the released purpose. The final notice must describe actual providers and data flows rather than making an unverified sale/share claim.

Retention and rights

The proposed schedule is 24 months after the last meaningful interaction for lead records, the accountant- or counsel-required period for transaction records, and 24 months after closure for routine support/security records unless a documented legal or security need requires longer. The final policy must state the approved schedule, backup treatment, applicable privacy rights, identity-verification process, appeal route where required, and a staffed request method.

Adults and minimization

The phased program is intended for adults 18 and older. Support must never request passwords, keys, complete card data, raw magic links, or private customer records. Collection is limited to the minimum information necessary for the approved purpose.

Release control

No public Privacy Policy is represented as approved by this page. Public capture and checkout must remain disabled until the final notice is versioned, linked, tested against the actual release, and approved.