Privacy Policy

• Account data — email address, name, password (stored as a salted hash by our authentication provider), and your chosen avatar (a preset, or a photo you upload).
• Free-course signup data — when you unlock Foundations: your explicit marketing consent (with a timestamp) and, optionally, a phone number if you choose to provide one.
• Course work — your worksheet answers, module progress, and the Assessment assembled from them. This is your content; it is private to your account.
• Payment data — purchases are processed by Stripe. We receive and store transaction records (amount, product, status, Stripe identifiers) but never your card number.
• The Signal — if you use the free interactive reading: your conversation answers, the generated report, and — if you choose to have the report emailed — your email address and consent. Every Signal email includes a personal deletion reference you can use to erase that data (see Section 6).
• Support & feedback — messages you send through the contact, question, or feedback forms.
• Usage events— basic product analytics we generate ourselves (for example, “module completed,” “course claimed”) tied to your account, used to operate the product and understand the funnel. We do not use third-party advertising or cross-site analytics trackers.

• providing the Service: accounts, course access, saved work, the Assessment;
• processing purchases and maintaining billing records;
• sending transactional email (receipts, account messages) and — only with your consent — promotional email about Telos products and tools;
• responding to support requests and feedback;
• keeping the Service secure and preventing abuse;
• complying with legal obligations (tax, accounting, lawful requests).

We do not sell or rent personal information, and we do not share it with third parties for their own advertising. We do not train machine-learning models on your course work.

Foundations is free in exchange for permission to stay in touch. You can withdraw that consent at any time — every promotional email has an unsubscribe link, or you can email us. Withdrawing consent stops marketing; it does not affect transactional email or access you already have.

We use a small set of infrastructure providers, each processing data only to provide their service to us:

• Supabase — authentication, database, and file storage;
• Vercel — website hosting and delivery;
• Stripe — payment processing;
• Resend — email delivery;
• Anthropic — only if and when AI-powered Signal readings are enabled, conversation text is processed to generate questions and the report.

Data is processed and stored in the United States. If you use the Service from elsewhere, you understand your data is transferred to the U.S.

We use essential cookies only: authentication session cookies that keep you signed in. We do not set advertising, social-media, or cross-site tracking cookies, which is why the site has no cookie banner — there is nothing optional to consent to.

You can, at any time:

• access and update your profile from your account page;
• unsubscribe from marketing (link in every email);
• delete Signal datausing the deletion reference included in your Signal report email — reply with “delete” and the reference, and the lead and its sessions are erased;
• request deletion of your account and associated personal data by emailing us from your account email. We will action verified requests within 30 days, keeping only what the law requires us to keep (for example, records of completed payments).

Depending on where you live (for example, California under the CCPA/CPRA, or the EEA/UK under the GDPR), you may have additional rights — access, portability, correction, deletion, and non-discrimination for exercising them. We honor these requests regardless of where you live. California residents: we do not “sell” or “share” personal information as those terms are defined in the CPRA.

We keep personal data while your account is active and as needed for the purposes above, then delete or anonymize it. Payment records are retained as required for tax and accounting. Access to production data is restricted, transport is encrypted (TLS), and member data is protected by row-level security so accounts can only read their own rows. No system is perfectly secure; if a breach affects your personal data we will notify you as required by law.

The Service is for adults. We do not knowingly collect personal information from anyone under 18; if we learn we have, we will delete it. If you believe a minor has provided us data, contact us.

If we materially change this policy, we will notify you (email or in-product notice) before the change takes effect. The date at the top always reflects the current version. See also our Terms of Service.