[LEGAL ENTITY MUST BE SUPPLIED BEFORE LIVE LAUNCH] is the intended controller of personal information processed through tiltless.club. Contact privacy@tiltless.club or write to [REGISTERED/CONTACT ADDRESS MUST BE SUPPLIED BEFORE LIVE LAUNCH]. This policy must be localised after the operator confirms its legal entity, markets and jurisdiction.
1. Information collected
We process account data (email, password hash, verification, country if supplied and security state); Stripe checkout/customer data returned to us, including email and phone number; funnel and attribution data (visit UUID, squeeze variant, referrer, referral code/alias, UTM fields and events); training activity and progress; orders, refunds, entitlements and Stripe identifiers; affiliate relationships, clicks, commissions, ledger entries, payout instructions and withdrawals; communications and consent choices; and security data such as privacy-protected IP/user-agent hashes, login events and audit records.
2. Sources
Information comes from you, your browser, an affiliate link you intentionally follow, Stripe payment events, and service providers that operate infrastructure or communications for us. We do not receive or store full payment-card numbers from Stripe Checkout.
3. Why we use information
We use data to create and secure accounts; provide free and paid training; administer the six-week coaching programme; confirm purchases, refunds and access; attribute referrals; calculate and pay eligible affiliate commissions; prevent fraud and abuse; respond to support; maintain audit/accounting records; comply with law; and, where permitted, send optional marketing communications.
4. Legal bases and choices
Depending on jurisdiction, processing may rely on contract, legitimate interests, legal obligations or consent. Optional marketing and optional media/cookie choices are separate from processing necessary to supply the Service. You may withdraw consent where consent is the basis, without affecting earlier lawful processing.
5. Stripe and payment data
Stripe hosts Checkout and processes payment details under its own privacy terms. We require Stripe Checkout to collect an email address and phone number for these purchases. Our application stores relevant Stripe identifiers, the checkout email/phone returned to us, amount, product, price type, payment/refund/dispute state and other records needed to administer the transaction and coaching relationship.
6. Affiliate attribution
If you follow an affiliate link, we may store the referring affiliate identifier for the configured attribution window. When you create an account, the sponsor relationship is normally locked so later browsing does not silently replace it. Affiliates see privacy-reduced downstream information; administrators may access additional records where necessary for legitimate programme administration and fraud review.
7. Sharing
We may share data with processors and professional advisers where needed to operate the Service, including payment, hosting, email, analytics/security and professional-service providers. We may disclose data where required by law or to protect rights and security. We do not sell full payment-card data because we do not receive it.
8. Retention
Account, order, refund, affiliate, tax, fraud and audit records are retained for periods appropriate to legal, accounting, dispute and security needs. Shorter-lived attribution/session data may expire sooner. Retention schedules should be finalised for the operator’s launch jurisdictions.
9. International transfers
Providers may process information in other countries. Where required, the operator must use an appropriate transfer mechanism and disclose relevant safeguards for its launch markets.
10. Security
We use password hashing, CSRF protection, constrained sessions, server-side Stripe verification, encrypted payout details and administrative audit records. No system is perfectly secure; report suspected compromise promptly.
11. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, object, port or complain about processing. Rights can be limited by legal retention, fraud-prevention and accounting duties. Contact privacy@tiltless.club.
12. Children
The Service is intended for adults and is not knowingly directed to children.
13. Changes
We may update this policy as the Service or legal requirements change. Material changes will be notified where required.