Privacy Policy

_Version 2026-08-07.pre-counsel.1. This policy is published ahead of legal review; the version you accepted is stored with your account and shown here._

What we collect

• Account: email, name, timezone, locale, password (stored hashed) and,

if you enable it, a second factor.

• Purchase records: what you bought, when, for how much, and the payment

method. We never see or store card numbers — the payment provider holds those.

• Programme activity: lessons watched, resources downloaded, calls booked

and attended, milestones you record, goals, action items, habits and check-ins you create. This record is what lets us support you and prove service delivery.

• Community content: what you post, comment and like, shown to other

members as described in the product.

• Call recordings and transcripts — only for calls where every

participant agreed, kept at most 400 days.

• Connected accounts (optional): if you connect a shop or ad account,

the token you provide is stored encrypted such that the web application cannot read it back; only the background worker can use it, solely to fetch the metrics the feature shows you.

What we use it for

Delivering the programme, supporting you, processing payments, keeping the community usable, and — where you agreed — processing recordings, transcripts and your progress with AI to produce summaries, suggested action items and answers to your questions. AI outputs are drafts reviewed by your coach, not decisions made about you. We do not sell personal data, and we do not use your data to train AI models.

Who else touches it

Service providers acting for us: hosting, video delivery, meeting infrastructure (calls run on Zoom), payment providers, and email delivery. Each receives what its role needs and no more. Some providers process data outside your country; where EU/UK data is involved we rely on standard contractual clauses. [REVIEW: transfer mechanism]

How long we keep it

Purchase and invoice records: as long as tax law requires (up to ten years, depending on jurisdiction). Recordings: at most 400 days. Everything else: while your account exists.

Your rights

From your settings, or by writing to support@exposcale.io: export everything we hold about you as one file; correct your details; delete your account. Deletion anonymises rather than erases the purchase records the law requires us to keep — your identity is severed from them irreversibly, your content is redacted, and your credentials are destroyed. Consent records are kept in anonymised form because they are the proof that past processing was lawful. You may also withdraw any optional consent (recording, WhatsApp, benchmarks) at any time with effect for the future.

Cookies

One session cookie to keep you signed in, and a theme preference. No third-party advertising or analytics cookies inside the member area.

Questions: support@exposcale.io.