Legal

Privacy Policy

Last updated: 20 October 2026

1. Introduction, scope and controller

1.1 Summary. This summary is a short guide and does not replace the rest of this Privacy Policy.

(a) We collect the details that you give us, such as your name, email address and Order information, and some technical data that is collected automatically when you use the Website.

(b) We use Personal Data to provide the Products and Services that you ask for, to take payment and deliver Orders, to give support, to protect the Website and our Products, to send you messages and to meet our legal duties.

(d) We share Personal Data with the Payment Processor and with other service providers that help us run the Website and the Products, with professional advisers and with authorities where the law requires it.

(e) We keep Personal Data only for as long as we need it for the purposes described, and clause 13 sets out the periods.

(f) You can contact us at [email protected] to ask a question or to exercise your rights.

1.2 Who we are. Chapter Spire is the controller of the Personal Data described in this Privacy Policy. In some laws the controller is called the responsible party, and in this Privacy Policy “we”, “us” and “our” mean Chapter Spire. Our privacy contact is [email protected]. We have appointed a person responsible for data protection matters, who can be contacted at [email protected]. Where Applicable Data Protection Law requires us to appoint a representative in the European Economic Area or the United Kingdom, we will do so and publish the contact details here.

1.3 Who this Privacy Policy covers. This Privacy Policy applies to visitors to the Website, customers, learners, subscribers, clients, affiliates and anyone else who deals with us. It covers the Website at https://www.chapterspire.com, our Products and Services, and our online and offline dealings with you, such as emails, messages and live sessions.

1.4 What this Privacy Policy does not cover. This Privacy Policy does not cover the practices of third parties that we do not control, such as a Third-Party Platform that you reach through a link. It also does not cover Personal Data that you process through a Product about other people, which clause 23 explains.

1.5 Relationship to the Terms of Use. This Privacy Policy forms part of our Terms of Use at https://www.chapterspire.com/terms-of-use/. Capitalised terms that this Privacy Policy does not define have the meaning that they have in the Terms of Use.

1.6 Regional supplements. Some laws give extra rights or require extra information. Clause 27 and Schedules 3, 4 and 5 describe these for people in particular regions. For the people whom a supplement covers, the supplement prevails over the main body of this Privacy Policy if the two differ.

1.7 No deemed consent. Reading this Privacy Policy, or using the Website, does not mean that you have given consent to any Processing for which Applicable Data Protection Law requires your consent. Where we need your consent, we ask for it separately, in a clear way, and you can refuse it or withdraw it.

2. Definitions and interpretation

2.1 Definitions. In this Privacy Policy, the following words have the meanings given below.

Applicable Data Protection Law means every law that applies to our Processing of Personal Data, including the European Union General Data Protection Regulation (the “EU GDPR”); the United Kingdom General Data Protection Regulation and the Data Protection Act 2018 (together, the “UK GDPR”); the Swiss Federal Act on Data Protection; the privacy laws of the states of the United States, including the California Consumer Privacy Act as amended; the Nigeria Data Protection Act 2023; the Personal Information Protection and Electronic Documents Act and the provincial privacy laws of Canada; the Privacy Act 1988 of Australia; the Lei Geral de Proteção de Dados of Brazil; the Protection of Personal Information Act of South Africa; and any similar law.

Controller means the person that decides why and how Personal Data is Processed, and includes a “business”, a “responsible party” and any equivalent term in Applicable Data Protection Law.

Cookies means small text files that a website stores on your device, and includes pixels, web beacons, local storage, software development kits, device identifiers and similar technologies.

Data Subject means an identified or identifiable individual to whom Personal Data relates, and includes a “consumer” and any equivalent term in Applicable Data Protection Law.

Personal Data means any information that relates to an identified or identifiable individual, and includes “personal information” and any equivalent term in Applicable Data Protection Law.

Processing means any operation that is performed on Personal Data, such as collecting, recording, storing, using, sharing, transferring or deleting it, and “Process” has a matching meaning.

Processor means a person that Processes Personal Data on behalf of a Controller, and includes a “service provider”, a “contractor” and any equivalent term in Applicable Data Protection Law.

Regulator means a public authority that supervises compliance with Applicable Data Protection Law, such as a data protection authority, an information commissioner or an attorney general.

Sensitive Data means categories of Personal Data to which Applicable Data Protection Law gives extra protection, including government identifiers, precise geolocation, biometric data, health data and children’s data.

Third-Party Platform has the meaning given in the Terms of Use.

2.2 Terms defined in the Terms of Use. The words Account, Affiliate Partner, Coaching Services, Course, Ebook, Event, Order, Payment Processor, Product, Product Page, Service, Software, Subscription, Support Email and Website have the meanings given to them in the Terms of Use.

2.3 Interpretation. In this Privacy Policy, the word “including” means “including without limitation”; headings are for convenience only; a reference to a law includes that law as amended or replaced; words in the singular include the plural and the reverse; and a reference to a clause or a Schedule is to a clause of, or a Schedule to, this Privacy Policy.

3. Personal Data we collect

3.1 Data that you give us. Depending on how you deal with us, you may give us the following Personal Data:

(a) identity and contact details, such as your name, email address, country and any other details that you enter in a form;

(b) Account credentials, such as your username and password, which we store only in hashed form;

(c) Order and billing information. The Payment Processor holds your full payment card details, and we see only limited data, such as the card brand, the last four digits, your billing country and the value of your Order;

(d) learning inputs, such as assignments, quiz answers and the proof of effort that you submit with a refund claim for a Course;

(e) support messages and the content of your correspondence with us;

(f) survey answers and feedback that you choose to give;

(g) reviews, comments and testimonials that you submit;

(h) registration details for an Event;

(i) intake information that you give us when you book Coaching Services;

(j) application details and payout details if you apply to be an Affiliate Partner; and

(k) a photograph or likeness, but only if you choose to send it to us.

3.2 Data that is collected automatically. When you use the Website or a Product, we and our service providers collect the following data automatically:

(a) device and browser data, such as the type of device, the operating system, the browser, the language and the screen size;

(b) your IP address and your approximate location, which is inferred from the IP address;

(c) log and usage data, such as the pages that you view, the links that you click, the time and length of your visit and the website that referred you;

(d) Cookies and similar technologies, as clause 9 and Schedule 1 describe;

(e) licence, activation and download data, such as the date and time of a download or the activation of a licence key;

(f) video playback data, such as which videos you play and how far you watch; and

(g) email interaction data, such as whether you open an email and which links you click.

3.3 Data that we receive from others. We may receive Personal Data about you from:

(a) the Payment Processor, which tells us that an Order has been paid, refunded or disputed and gives us limited Order data;

(b) Third-Party Platforms that we use to deliver Products, to run Events or to send messages;

(d) public sources and service providers that we use for fraud checks and for screening against sanctions lists; and

(e) social media platforms, if you choose to connect your account on one of them to the Website.

3.4 Sensitive Data. We do not intend to collect Sensitive Data, and we ask you not to send it to us. If you volunteer it, for example in a message to our support team or during Coaching Services, we use it only to respond to you and for no other purpose. We do not name any special category of Personal Data as something that we collect.

3.5 Data that you give us about others. If you give us Personal Data about another person, you must have the authority or a lawful basis to do so. Clause 23 explains how this applies where a Product processes data that you provide about other people.

4. How we use Personal Data and our legal bases

4.1 The table. The table below sets out why we Process Personal Data and the legal basis on which we rely under Applicable Data Protection Law. Where a law does not use legal bases, the table describes the reason for the Processing.

Purpose	Main categories of Personal Data	Legal basis
To create and manage your Account and to identify you	Identity and contact; account; technical	Performance of a contract; legitimate interests (account security)
To process Orders, take payment, issue receipts and deliver Products	Identity and contact; order and billing; access and download	Performance of a contract; legal obligation (tax and accounting records)
To provide course delivery, track progress and issue certificates	Account; learning and progress; video playback	Performance of a contract; legitimate interests (delivering and improving the learning experience)
To manage licences, prevent piracy and unauthorised sharing and enforce our Terms of Use	Licence and security; access and download; IP address; watermark identifiers	Legitimate interests (protecting our intellectual property and revenue); performance of a contract
To provide customer support and respond to enquiries	Identity and contact; support and correspondence; order	Performance of a contract; legitimate interests (providing support and keeping records)
To assess and process refund, cancellation and chargeback claims	Order and billing; refund and dispute data; learning and progress; proof of effort	Performance of a contract; legitimate interests (verifying eligibility and preventing abuse); establishment, exercise or defence of legal claims
To send service messages (receipts, access, security, policy and renewal notices)	Identity and contact; order; account	Performance of a contract; legal obligation; legitimate interests
To send marketing communications about our Products and Services	Identity and contact; marketing; email interaction	Consent, or legitimate interests or another basis permitted by Applicable Data Protection Law in respect of existing customers, with a right to opt out at any time
To run analytics, measure performance and improve the Website, Products and Services	Technical; usage and log; Cookie data	Consent where required for non-essential Cookies; otherwise legitimate interests
To personalise content and offers and to measure and optimise advertising	Technical; usage; marketing; Cookie data	Consent where required; otherwise legitimate interests
To publish reviews, comments and testimonials	Identity; content you submit; photograph or likeness where you provide one	Consent; legitimate interests (moderation)
To run live sessions, coaching and events	Identity and contact; content; session data; recordings	Performance of a contract; consent (recordings); legitimate interests
To administer the affiliate programme and pay commissions	Affiliate data; referral attribution; payout and tax data	Performance of a contract; legal obligation
To detect, prevent and investigate fraud, abuse, security incidents and unlawful activity, and to screen against sanctions lists	Identity; order; technical; licence and security	Legitimate interests; legal obligation
To comply with legal obligations, respond to lawful requests and protect our rights	All categories as necessary	Legal obligation; legitimate interests; establishment, exercise or defence of legal claims
To conduct research, produce aggregated or anonymised statistics and develop new Products	Usage; learning and progress; feedback (aggregated or de-identified where practicable)	Legitimate interests; consent where required
For corporate transactions such as a merger, acquisition or sale of assets	As necessary	Legitimate interests

4.2 Consent and objection. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of Processing before withdrawal. Where we rely on legitimate interests, you may object as described in clause 15.

4.3 No incompatible purposes. We do not use Personal Data for a purpose that is incompatible with those in the table without first telling you and, where the law requires it, obtaining your consent. Where a law requires your consent for a purpose, we obtain it before we begin that Processing.

4.4 No solely automated decisions. We do not make decisions that have legal or similarly significant effects on you solely by automated means. Clause 17 explains how we use automated tools and how a person is involved in decisions about refunds and Accounts.

5. Payments, Orders and merchant of record

5.1 The Payment Processor’s role. The Payment Processor acts as the merchant of record for your Order. For payment, tax and fraud processing, it acts as an independent Controller of the Personal Data that it handles, which means that it decides for itself why and how that data is used.

5.2 Its privacy policy. The Payment Processor’s own privacy policy governs the payment data that it collects, and you should read it before you pay. We have no control over how the Payment Processor handles that data, except under the terms on which it provides its service to us.

5.3 What we receive. We receive only limited Order data from the Payment Processor, such as your name, your email address, your billing country, the Product that you bought, the price, the date and the status of the payment. This is the data that we need to deliver your Order and to give you support.

5.4 No card numbers. We do not store your full payment card number, and we do not see your full card details. The Payment Processor collects them directly from you through its own checkout.

5.5 International transfers. The Payment Processor may transfer Personal Data to other countries under its own arrangements, as clause 12 explains. Those arrangements are described in its own privacy policy.

5.6 Tax data and invoices. The Payment Processor collects the Personal Data that is needed to calculate and collect tax and to issue invoices and receipts, such as your billing country and, in some cases, a tax number that you give it. It may keep that data for the period that the law requires.

5.7 Refunds and chargebacks. If you ask for a refund or dispute a payment, the Payment Processor shares dispute data with us. To answer a dispute, we may share with the Payment Processor the Account data and, for a Course, the proof of effort and progress records that relate to your Order. We do so on the basis shown in the table in clause 4.

5.8 Fraud screening. The Payment Processor and we may use automated tools to screen Orders for fraud and abuse. If an Order is flagged, a person reviews it before we make a decision that has a significant effect on you, as clause 17 provides.

6. Accounts, product delivery and learning data

6.1 Account creation and login. To create an Account, we ask for your name, your email address and a password. We use that data to identify you, to let you log in, to link your Orders to your Account and to protect the Account against unauthorised use. We store your password in hashed form.

6.2 Delivery of Products. We deliver Products by a download link, by access to a learning platform or by a licence key. To do so, we use your contact details and Order data, and we record the access and download data that is needed to deliver the Product and to answer any query about it.

6.3 Course progress and results. Where you take a Course, we and the platform that delivers it record your progress, such as the lessons that you have completed, your quiz results, your completion status and any certificate that you earn. We use this data to provide the Course, to show you your progress and to improve the learning experience.

6.4 Video playback. The platform that hosts our video content records playback data, such as which videos you start and how much of each you watch. We use that data to deliver the video, to measure how the Course is used and to help verify your progress.

6.5 Refund verification. Under the Terms of Use, a refund of a Course depends on proof of completion and of effort. We therefore use progress records, and any proof that you submit, to assess whether you are eligible for a refund. We use that data for no other decision about you.

6.6 Limits on the use of learning data. We do not use learning data to make decisions about you beyond the delivery of the Service and the assessment of a refund request. We do not use it to profile you for any purpose that has a legal or similarly significant effect on you.

6.7 Platforms as Processors. The learning platforms and video platforms that we use act as Processors on our instructions, and each is bound by a contract that requires it to protect Personal Data. Where a platform keeps your own account with it, it may also act as an independent Controller of that account data, as the table in clause 10 shows.

6.8 Certificates. A certificate that we issue may show your name, the name of the Course and the date of completion. We keep a record that lets us confirm that the certificate is genuine, as clause 13 explains.

7. Licence, anti-piracy and security data

7.1 Purposes. We Process Personal Data to enforce licences, to detect unauthorised sharing of Products, to protect our Products and the Website, and to prevent fraud. These purposes protect our work and the people who pay for it, and they are explained in the Terms of Use.

7.2 The data involved. For these purposes we may Process your IP address, device identifiers, activation and download logs, login patterns and, where we use them, watermark identifiers that are embedded in files and that link a copy of an Ebook or another Product to an Account. We collect only the data that these purposes need.

7.3 Legal basis. We rely on our legitimate interests in protecting our intellectual property, our revenue and the security of the Website, and, where it applies, on the performance of a contract with you. We have weighed these interests against your rights and freedoms.

7.4 Our balance of interests. Our Processing is proportionate. We limit it to the data that is needed, we do not use it for unrelated purposes, we use measures that are no more intrusive than necessary, and we keep the data for no longer than clause 13 allows. You may object to this Processing as clause 15 describes.

7.5 Consequences of confirmed infringement. If we confirm that a Product has been shared or used in breach of the Terms of Use, we may suspend or end your access, take legal action, and share the relevant evidence, including Personal Data, with our legal advisers and with courts and other authorities. We will share only what is reasonably necessary for that purpose.

7.6 Retention. We keep licence, activation and download logs and watermark records for the period shown in clause 13, and for longer where they relate to a confirmed infringement.

8. Marketing and email communications

8.1 What we send. If you have signed up for them, or if the law otherwise allows us to do so, we send newsletters, offers and news about our Products and Services. These are marketing communications, and we send them only as this clause 8 and Applicable Data Protection Law allow.

8.2 Our legal basis. We send marketing messages on the basis of your consent or, where the law permits, under the rules that allow a business to write to its existing customers about similar products, sometimes called a soft opt-in. Where the law requires consent, we obtain it before we send marketing messages.

8.3 Unsubscribing. Every marketing email contains an unsubscribe link, and you can also ask us to stop by writing to [email protected]. We will act on your request promptly, and we will keep a short suppression record of your email address so that we do not contact you again, as clause 13 explains.

8.4 Service messages are different. Unsubscribing from marketing does not stop service messages that are necessary for your Orders and your Account, such as receipts, access details and security notices.

8.5 Email tracking. Our marketing emails may contain a small image or link that records whether you open the email and which links you click. We use that data to understand what is useful to you. You can block it by turning off the loading of images in your email program, or by using the settings in your email service.

8.6 Segmentation. We may sort our email contacts by what they have bought and by their interests, so that we send them messages that are relevant. This is a form of automated sorting, and clause 17 explains it.

8.7 Email service provider. We share your name, your email address and your preferences with the email service provider that sends our messages. It acts as a Processor on our instructions, and it may not use your data for its own marketing.

8.8 No sale of lists. We do not sell or rent our email lists to anyone.

8.9 Text messages and push notifications. Where we offer text messages or push notifications, we send them only if you have opted in to them, and you can opt out at any time by following the instructions in the message or in your device settings.

8.10 Marketing laws. We follow the rules for commercial email that apply to us and to the people whom we write to, including the CAN-SPAM Act in the United States, the anti-spam law of Canada, and the European Union and United Kingdom rules on electronic communications and privacy.

9. Cookies and similar technologies

9.1 What Cookies are. Cookies are small text files that are stored on your device when you visit a website. Similar technologies include pixels, web beacons, local storage and device identifiers. We use Cookies to make the Website work, to remember your choices, to understand how the Website is used and, where you allow it, to measure and improve our advertising.

9.2 Categories of Cookies. The Cookies that we use fall into four categories. Strictly necessary Cookies are needed for the Website to work, for example to keep you logged in or to protect a form, and they do not need your consent. Functional Cookies remember your settings and choices. Analytics Cookies measure how the Website is used. Marketing Cookies help us to measure and optimise advertising and to attribute a sale to an Affiliate Partner.

9.3 Consent. Where Applicable Data Protection Law requires consent for non-essential Cookies, we ask for it through our cookie banner. We do not set Cookies in the functional, analytics or marketing categories before you have given that consent, where the law requires us to wait for it.

9.4 Changing your choice. You can change your choice at any time through the cookie settings link in the footer of the Website. Withdrawing your consent does not affect the lawfulness of anything that we did before you withdrew it.

9.5 Browser controls. You can also block or delete Cookies through the settings of your browser. The steps differ for each browser, so please check the help pages of the browser that you use. Blocking some Cookies may affect how the Website works.

9.6 Global Privacy Control. We treat the Global Privacy Control signal, where your browser sends it, as an opt-out of sale, sharing and targeted advertising, where Applicable Data Protection Law requires us to do so.

9.7 The full list. Schedule 1 is our cookie policy. It lists the types of Cookies that we use, who sets them, what they do, how long they last and whether they are first-party or third-party Cookies. Clause 24 explains our use of analytics and advertising tools.

10. Disclosure and sharing of Personal Data

10.1 Only as needed. We share Personal Data only to the extent that is necessary for the purposes described in this Privacy Policy. Where we share it with a Processor, the Processor acts on our instructions and under a contract that requires it to protect the Personal Data and to use it only for the services that it provides to us.

10.2 Categories of recipients. We share Personal Data with the following categories of recipients, only to the extent necessary for the purposes described in this Privacy Policy. We do not sell Personal Data for money. Advertising Cookies and pixels may count as “sharing” or “targeted advertising” under some laws, and clause 24 and Schedule 4 explain how you can opt out.

Category of recipient	Why we share Personal Data	Role of the recipient
Payment Processors, merchants of record and marketplaces	To take payment, deliver Orders, issue invoices, calculate tax, and handle refunds and disputes	Independent Controller (and, for some functions, Processor)
Hosting, database, storage and file-delivery providers	To host the Website and Products and deliver files securely	Processor
Course, learning-management and video-hosting platforms	To deliver Courses and video content and track progress	Processor, or independent Controller of its own account data
Email, messaging, customer-relationship and help-desk providers	To send communications, manage contacts and provide support	Processor
Analytics, advertising and measurement providers	To measure performance and, where permitted, to measure and optimise advertising	Processor or independent Controller, depending on the service
Scheduling, video-conferencing and recording providers	To run coaching sessions, webinars and live events	Processor
Affiliate platforms and payout providers	To track referrals and pay commissions	Processor or independent Controller
Code-hosting and software-delivery providers	To grant access to repositories, releases and updates	Independent Controller of its own account data
Artificial-intelligence service providers	To provide AI-assisted features, transcription, translation or support	Processor
Fraud-prevention, security and identity-verification providers	To detect fraud, abuse and sanctions risks	Processor or independent Controller
Professional advisers (lawyers, accountants, auditors, insurers)	To obtain advice, comply with law and manage risk	Independent Controller or Processor
Regulators, courts, law-enforcement and other authorities	To comply with law or lawful requests, or protect rights and safety	Independent Controller
A successor or counterparty in a corporate transaction	In connection with a merger, acquisition, financing or sale of assets	Independent Controller after the transaction

10.3 Legal disclosures. We may disclose Personal Data where we believe in good faith that the law requires it, for example in response to a court order or a lawful request from a law-enforcement authority, and where it is reasonably necessary to protect our rights, our property or the safety of any person. We will disclose only what is needed, and where the law allows we will tell you before we do so.

10.4 Corporate transactions. If we are involved in a merger, an acquisition, a financing or a sale of assets, or if control of our business changes, Personal Data may be transferred as part of that transaction. We will tell you of a change of control that affects your Personal Data, and the new owner will be required to continue to protect it in line with this Privacy Policy, or to give you notice of any change.

10.5 With your consent. We may also share Personal Data in other ways where you ask us to do so or give your consent, and you may withdraw that consent at any time.

10.6 Aggregated and de-identified data. We may share information that has been aggregated or de-identified, so that it no longer identifies you, with partners and advisers, for example statistics about how the Website is used. We do not try to re-identify that information.

10.7 No sale for money. We do not sell Personal Data for money.

10.8 Register of service providers. Schedule 2 lists the categories of providers that we use, with examples. We will give you the names of the providers that we currently use if you ask us at [email protected].

11. Third-party platforms and embedded content

11.1 Embedded content. Pages of the Website, and our Products, may contain content that is provided by a third party, such as video players, social media posts, maps, forms and payment buttons. When you view or use embedded content, the provider may set Cookies on your device and may receive data about you, such as your IP address and the page that you are viewing. We do not control that Processing, and the provider’s own privacy policy explains it.

11.2 Links to other websites. The Website may link to websites and services that we do not operate. This Privacy Policy does not apply to them, and we are not responsible for their content or their handling of Personal Data. We encourage you to read the privacy policy of any site that you visit.

11.3 Signing in with another account. If you choose to sign in to the Website, or to connect an account, using an account that you hold on a Third-Party Platform, that platform shares data with us as you authorise through its own settings. We receive only the data that you permit, and we use it as this Privacy Policy describes.

11.4 Fonts. Our Website loads fonts from Google Fonts, a service of Google. When you view a page, your browser requests the fonts from Google’s servers, which receive your IP address and device information. Google’s privacy policy explains how it handles this information.

11.5 Changes in providers. The providers that supply embedded content to the Website may change from time to time. Schedule 1 and Schedule 2 describe the types of Cookies and the categories of providers that we use at any time.

12. International transfers

12.1 Where we and our providers operate. We and our service providers operate in several countries, including countries that are outside the country where you live. When we share Personal Data with a provider in another country, that Personal Data may be transferred to, stored in and accessed from that country.

12.2 Lawful mechanisms. Where Applicable Data Protection Law restricts the transfer of Personal Data to another country, we make the transfer only by a lawful mechanism. Depending on the law that applies, these include:

(a) a decision by a public authority that the other country gives adequate protection, sometimes called an adequacy decision;

(b) standard contractual clauses that have been approved by the European Commission or by another competent authority;

(c) the International Data Transfer Agreement, or the Addendum to the European Commission’s standard contractual clauses, that applies in the United Kingdom;

(d) the addendum that applies to transfers from Switzerland;

(e) binding corporate rules;

(f) your explicit consent to the transfer, after you have been told of the risks; and

(g) the necessity of the transfer for the performance of a contract with you, or for the establishment, exercise or defence of legal claims.

12.3 Data privacy frameworks. Where a provider is certified under the data privacy framework between the European Union and the United States, the United Kingdom extension to it, or the framework between Switzerland and the United States, we may rely on that certification for transfers to that provider.

12.4 Copies of the safeguards. You may ask us for a copy of the safeguards that we use for a transfer, by writing to [email protected]. We may remove commercial or confidential information from the copy that we give you.

12.5 The Payment Processor. The Payment Processor transfers Personal Data under its own arrangements, which are described in its own privacy policy.

12.6 Other countries. The rules on transfers from Brazil, Nigeria and South Africa are described in Schedule 5, and they apply in addition to this clause 12 for people in those countries.

13. Data retention

13.1 We keep Personal Data only for as long as necessary for the purposes for which we collected it, including to satisfy legal, accounting or reporting requirements, to resolve disputes and to enforce our agreements. The table sets out our standard retention periods. We may keep Personal Data for longer where the law requires or permits it, for example where there is an ongoing dispute, claim or investigation.

Category of Personal Data	Standard retention period	Reason
Account data	For the life of the Account and twelve (12) months after closure	Contract; security; handling of late queries
Order, transaction and invoice records	Six (6) years from the end of the financial year to which they relate, or any longer period that tax or accounting law applying to us requires	Legal obligation (tax and accounting)
Refund, cancellation and chargeback records, including proof of effort	Three (3) years from the date of the request, or longer where needed for a claim or a dispute with the Payment Processor	Legal claims; fraud and abuse prevention
Learning and progress data, certificates	For the life of the Account and twenty-four (24) months after closure; certificate verification records for as long as the certificate is valid	Contract; certification; refund verification
Licence, activation and download logs; watermark records	Two (2) years after the licence ends, or longer for confirmed infringements	Protection of intellectual property; legal claims
Support and correspondence about an Order, Account, refund or Product	Three (3) years from the last communication	Customer service; legal claims
Marketing list and preferences	Until you unsubscribe, plus a suppression record that is kept so that we do not contact you again; inactive subscribers are removed after twenty-four (24) months	Consent; legitimate interests
Consent records	For the life of the consent and six (6) years afterwards	Accountability
Reviews, comments and testimonials	While the content is published, subject to the clause on comments, reviews and testimonials	Consent; legitimate interests
Coaching notes and recordings	Twelve (12) months after the engagement ends, or as agreed with you in writing	Contract; quality; legal claims
Affiliate records and tax documents	Six (6) years after the end of the relationship	Legal obligation
Website logs and security logs	Thirteen (13) months	Security; legitimate interests
Analytics and cookie data	As stated in Schedule 1, and in any case no longer than twenty-five (25) months	Consent; legitimate interests
Backups	Up to ninety (90) days after deletion from live systems	Business continuity
General enquiries sent through the Website contact form	Twelve (12) months after the enquiry is closed; if the message concerns an Order, an Account or a refund, the periods for Order and refund records and for support correspondence apply instead	Customer service; handling of follow-up questions; legal claims

13.2 How we decide how long to keep Personal Data. Where the table gives no fixed period, or gives a range, we decide how long to keep Personal Data by considering the amount, the nature and the sensitivity of the data, the risk of harm from its unauthorised use or disclosure, the purposes for which we Process it, whether we can achieve those purposes by other means, and the legal requirements that apply to us. Where a period in the table depends on a legal requirement, the requirement that applies from time to time prevails.

13.3 Deletion requests and legal retention. If you ask us to delete your Personal Data or to close your Account, we delete or anonymise it within thirty (30) days, except for data that we are required or permitted to keep. This includes transaction, tax and accounting records, records that we need for legal claims, records that we need to prevent fraud and enforce licences, and a minimal suppression record of your marketing opt-out. We restrict the data that we keep to those purposes, and we delete it when the period ends. Closing an Account ends your access to Products, and it does not by itself entitle you to a refund.

13.4 Anonymised and aggregated data. Information that has been anonymised or aggregated, so that it no longer identifies you, is not Personal Data, and we may keep it without a time limit.

14. Security and Personal Data breaches

14.1 Reasonable measures. We use reasonable measures to protect Personal Data, such as encryption of data in transit, access controls that give each person only the access that their work needs, hashing of passwords, hosting with reputable providers, confidentiality duties for our staff and contractors, regular backups and regular review of our measures. We choose the measures with regard to the nature of the data and the risks of Processing it.

14.2 No guarantee. No method of transmission over the internet, and no method of storage, is completely secure. We therefore cannot promise that Personal Data will never be accessed, lost or disclosed without authority, and we do not claim that our measures meet any particular standard unless we say so in writing.

14.3 Your part. You help to protect your Personal Data by keeping your login details confidential, by choosing a password that others cannot easily guess, by not sharing your Account, and by telling us at [email protected] if you think that your Account has been used without your permission.

14.4 If a breach occurs. If we become aware of a breach that affects Personal Data, we will assess it, take steps to contain it and reduce its effects, and decide whether the law requires us to report it. Where Applicable Data Protection Law requires it, we will notify the Regulator and the people who are affected, within the time that the law requires. Under the GDPR, for example, that time can be as short as seventy-two (72) hours for a report to the Regulator.

14.5 What a notice will say. Where we notify you of a breach, we will tell you, in clear language, what happened, what Personal Data is involved, what we are doing about it, and what you can do to protect yourself. We will also tell you whom to contact for more information.

15. Your rights and how to exercise them

15.1 Your rights. Depending on where you live and on Applicable Data Protection Law, you may, as a Data Subject, have some or all of the following rights:

(a) to be informed about how we Process your Personal Data, which this Privacy Policy is intended to do;

(b) to access the Personal Data that we hold about you and to receive a copy of it;

(d) to have your Personal Data erased in certain cases;

(e) to restrict the Processing of your Personal Data in certain cases;

(f) to receive the Personal Data that you gave us in a structured, commonly used and machine-readable format, and to ask us to transmit it to another controller where that is possible;

(g) to object to Processing that is based on our legitimate interests, and to object at any time to Processing for direct marketing;

(h) to withdraw your consent at any time, where we rely on your consent;

(i) not to be subject to a decision based solely on automated Processing that has legal or similarly significant effects on you;

(j) to opt out of the sale of your Personal Data, of sharing it for cross-context behavioural advertising, of targeted advertising and of profiling;

(k) to limit our use of Sensitive Data that is described as sensitive in your local law;

(l) not to be treated unfairly because you exercise a right;

(m) to complain to a Regulator; and

(n) where your local law provides for it, to appeal our refusal of a request.

15.2 How to make a request. To exercise a right, write to us at [email protected] and tell us what you would like us to do. Please give enough information for us to find your Personal Data, such as the email address that is registered to your Account.

15.3 Verifying who you are. We may need to verify your identity before we act, and the checks that we make will be proportionate to the request and to the sensitivity of the data. We may ask you for further information for that purpose. We use that information only to verify your identity.

15.4 Authorised agents. You may ask another person to make a request on your behalf. We may ask for your written authority for that person to act, and we may ask you to confirm your identity directly with us.

15.5 When we will respond. We will respond to a request within one (1) month of receiving it. Where the law allows, we may extend that period if the request is complex or if we have received many requests, and we will tell you if we do so. If the law of your region sets a shorter or longer period, we will respond within that period.

15.6 No fee, in most cases. We do not charge a fee for dealing with a request. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, and we will explain why.

15.7 Limits on rights. A right is not absolute. We may not be able to act on a request in full where doing so would affect the rights of other people, where we need the data to establish, exercise or defend a legal claim, where the law requires us to keep it, or where it is a trade secret. We will tell you if that is the case, and why.

15.8 Retention and deletion. Clause 13 explains how long we keep Personal Data and what we may keep after a deletion request.

15.9 Consequences of withdrawing consent or deleting data. If you withdraw your consent or ask us to delete data that we need to provide a Product or a Service, you may lose access to it. Doing so does not automatically entitle you to a refund, and clause 11 of the Terms of Use continues to govern any request for one.

15.10 Complaints. If you are unhappy with how we have handled your Personal Data, please contact us first, so that we can try to put it right. You also have the right to complain to a Regulator. Schedules 3, 4 and 5 name the Regulators for the regions that they cover.

16. Children

16.1 18 and over. The Website and our Products are for people who are eighteen (18) years of age or over. We do not knowingly collect Personal Data from children, and we do not direct our marketing at them.

16.2 Products designed for children. Where a Product is designed for children, it is sold to a parent or legal guardian, who creates the Account and makes the purchase. We do not offer Accounts to children, and we collect only the minimum Personal Data that is needed to deliver the Product.

16.3 If we learn that we hold a child’s data. If we learn that we hold the Personal Data of a child without the authority of a parent or legal guardian, we will delete it as soon as is reasonably practicable. We may need to ask you for information in order to do so.

16.4 Parents and guardians. If you are a parent or guardian and you think that a child has given us Personal Data, or you want to ask about data that relates to your child, please contact us at [email protected]. We will respond in line with clause 15.

16.5 Children’s privacy laws. We respect the children’s privacy laws that apply to us, including the United States law that protects the online privacy of children under thirteen, and the United Kingdom code on age-appropriate design, where they apply.

17. Automated processing, profiling and artificial intelligence

17.1 Automated tools that we use. We use some automated tools to carry out routine tasks. These include tools that screen Orders for fraud, tools that personalise content and offers, tools that sort email contacts by their purchases and interests, and tools that monitor licences for signs of unauthorised sharing.

17.2 No solely automated significant decisions. We do not make a decision that has a legal or similarly significant effect on you solely by automated means without a person reviewing it. Decisions about refunds and about Accounts always involve a person.

17.3 Human review. You may ask us at [email protected] for a person to review a decision that an automated tool contributed to, and to explain how it was reached. We will respond in line with clause 15.

17.4 AI features. Where we offer features that use artificial intelligence, the inputs that you give to the feature are sent to the AI service providers that supply it. Those providers act as Processors under a contract with us. We do not use your private inputs or outputs to train general-purpose models unless you agree to it.

17.5 Accuracy of output. AI output may be inaccurate or incomplete. You should review it before you rely on it, as the Terms of Use explain.

17.6 What you should not enter. You should not enter Sensitive Data, or the Personal Data of other people, into an AI feature unless you have a lawful basis to do so.

17.7 Our own use of AI. We may use AI-assisted tools to help us create content and to provide support. Our internal use of those tools does not involve the sale of Personal Data.

17.8 Advertising profiles. Building profiles for advertising is a separate matter, and clause 24 explains it.

17.9 Safeguards. Where we use an automated tool, we choose and review it with care, we limit the data that it uses to what the purpose needs, and we check from time to time that it works as intended and does not produce unfair results. If you believe that an automated tool has produced a wrong or unfair outcome, you may tell us at [email protected] and we will review it.

17.10 Your rights. You may object to profiling that is based on our legitimate interests, and you may opt out of profiling for advertising, as clause 15 explains. Where the law gives you a right not to be subject to a solely automated decision, we will respect it.

18. Reviews, comments and testimonials

18.1 Public content. Comments and reviews that you submit are public. Your name, your avatar and the text of what you write may be visible to anyone who visits the Website. You should think carefully about what you include.

18.2 What not to post. You must not post Sensitive Data, or the details of other people, in a review or a comment. We may remove content that contains them.

18.3 Testimonials. We use your name, your likeness and your testimonial in our marketing only if you have given your consent. You may withdraw that consent for future use at any time, by writing to [email protected]. Withdrawal does not affect use that took place before you withdrew.

18.4 Moderation. We may review, edit, hold or remove reviews and comments, as the Terms of Use explain. For moderation, we Process the content and the data that goes with it.

18.5 Retention. We keep a review, a comment or a testimonial for as long as it is published, as clause 13 sets out.

18.6 Removal and anonymisation. You may ask us to remove your review, comment or testimonial, or to anonymise it, by writing to [email protected]. We will act on the request in line with clause 13 and Applicable Data Protection Law.

18.7 Comment Cookies. If you choose to save your name, email address and website for your next comment, the Website sets a Cookie for that purpose, as Schedule 1 describes.

18.8 Spam filtering. A spam-filtering service may receive your comment, your IP address and related technical data, so that it can detect spam. It acts as a Processor on our instructions.

19. Coaching and consulting services

19.1 Application. Where we offer Coaching Services, this clause 19 describes the Personal Data that we Process for them, in addition to the rest of this Privacy Policy.

19.2 Data that we collect. When you book and take part in Coaching Services, we may collect the details that you give us on an intake form, the goals that you tell us about, the notes that we make about our sessions, scheduling data such as the dates and times of your sessions, and, where you have been told in advance, a recording of a session.

19.3 Purposes. We use that data to plan and deliver the sessions, to make sure that the guidance suits you, to keep a record of what we agreed, to keep our own quality standards, to manage bookings and payments and to deal with any query or claim that arises. The table in clause 4 gives the legal bases.

19.4 Confidentiality. We keep confidential what you share with us during Coaching Services, as the Terms of Use explain. We may disclose it only where the law requires it, where a court or public authority orders it, or where it is needed to protect a person from serious harm.

19.5 Recordings. We record a session only if we tell you before it begins. We keep recordings and session notes for the period shown in clause 13. You must not record a session yourself without our written permission.

19.6 Sensitive Data. You should not share Sensitive Data with us during Coaching Services unless it is necessary and you choose to do so. If you do, we use it only to give you the guidance that you asked for.

19.7 Providers. The scheduling and video-conferencing providers that we use for Coaching Services act as Processors on our instructions, and Schedule 2 lists the categories of those providers.

19.8 No professional relationship. Coaching Services do not create a lawyer–client, doctor–patient, therapist–client or similar relationship, as the Terms of Use explain. The confidentiality that we offer is a contractual commitment and not the professional privilege that those relationships carry.

20. Affiliate and referral programme

20.1 Application. Where we offer an affiliate programme, this clause 20 describes the Personal Data that we Process for it, in addition to the rest of this Privacy Policy.

20.2 Data about Affiliate Partners. We collect an Affiliate Partner’s name, contact details, tax details, payout details, referral links and performance data, such as the number of clicks and sales that the Affiliate Partner’s links produce.

20.3 Data about people who are referred. When you reach the Website through an affiliate link, a referral Cookie is set so that a purchase can be attributed to the person who referred you, as Schedule 1 describes. We receive information about the purchase, such as its date and value, so that commission can be calculated.

20.4 Purposes. We use that data to track referrals, to calculate and pay commission, to meet our tax duties and to detect fraud and abuse of the programme. The table in clause 4 gives the legal bases.

20.5 Providers. The affiliate platform and the payout providers that we use act as Processors or, in some cases, as independent Controllers, and Schedule 2 lists the categories of those providers.

20.6 Duties of Affiliate Partners. An Affiliate Partner must comply with privacy and marketing law when promoting us. An Affiliate Partner must not send us the Personal Data of any person unless it has a lawful basis to do so.

20.7 Retention. We keep affiliate records and tax documents for the period shown in clause 13.

21. Subscriptions and recurring billing

21.1 Application. Where we offer Subscriptions, this clause 21 describes the Personal Data that we Process for them, in addition to the rest of this Privacy Policy.

21.2 Renewal data. The Payment Processor holds the payment method that you use for a Subscription, usually as a token and not as a full card number, so that it can collect each renewal. We receive limited data, such as the status of each payment and the date of the next renewal.

21.3 Notices and reminders. We use your contact details to send you billing notices and renewal reminders, and to tell you about a change in the price, as the Terms of Use provide. These are service messages and not marketing.

21.4 Cancellations and failed payments. We keep a record of your cancellation, and of any failed payment, so that we can manage your access to the Product or Service and answer any query about your billing.

21.5 Retention. We keep Subscription records for the periods shown in clause 13 for Order and refund records.

22. Software, apps and telemetry

22.1 Application. Where we offer Software or apps, this clause 22 describes the Personal Data that we Process through them, in addition to the rest of this Privacy Policy.

22.2 Licence activation and checks. When you activate Software, and from time to time afterwards, the Software may send us your licence key, a device identifier and the date and time, so that we can check that your licence is valid and within the limits that the Product Page states.

22.3 Diagnostic and crash data. The Software may send us diagnostic data and crash reports, such as the version of the Software, the type of device and operating system, and technical details of an error. We use them to find and fix faults and to improve the Software.

22.4 Usage telemetry. The Software may send us usage data, such as which features are used and how often. We limit the telemetry that we collect to the categories that we describe here. Where Applicable Data Protection Law requires consent for it, we ask for your consent first.

22.5 Updates. We use version and device data to deliver updates and to tell you when an update is available.

22.6 No content of your files. We do not collect the content of your own files through the Software. If you send us a file or a log for support, we use it only to help you.

22.7 Turning telemetry off. Where the Software offers a setting to turn off telemetry, you can use it at any time, and it will then stop the collection of the usage data that the setting covers. Licence checks and data that is necessary for the Software to work may continue.

22.8 Retention. We keep licence, activation and diagnostic records for the periods shown in clause 13.

23. Users’ own data processed through Products

23.1 Application. Where Products process data that you provide about others, this clause 23 applies to that data, in addition to the rest of this Privacy Policy.

23.2 You are the Controller. You decide what data to enter into a Product. As between you and us, you are the Controller of the data that you enter about other people, and you are responsible for the choices that you make about it.

23.3 When we are a Processor. We act as a Processor only if a Product processes your customers’ data on your behalf. In that case, a data processing agreement applies, and we will give you a copy of it if you ask us at [email protected].

23.4 Your responsibilities. You are responsible for having a lawful basis to enter that data, and for telling the people concerned how you use it, as Applicable Data Protection Law requires. You must not enter Sensitive Data unless you have a lawful basis, and the Product is designed for it.

23.5 Our use of that data. We do not use that data for our own purposes, except to provide the Product to you and to keep it secure. We do not sell it, and we do not use it for advertising.

23.6 Deletion. When your use of the Product ends, we delete that data, subject to our backup cycle, as clause 13 explains. You are responsible for exporting any data that you want to keep before then.

24. Analytics, advertising and retargeting

24.1 Analytics. We use Cookies and similar tools to measure traffic to the Website, to understand which pages and Products interest visitors, and to improve the Website. Where the tool we use offers it, we truncate or anonymise IP addresses before the data is stored. The analytics providers that we use act as Processors or Controllers, as Schedule 2 shows.

24.2 Advertising and retargeting. We may use pixels and tags that allow advertising platforms to show our advertisements to people who have visited the Website, and to measure whether an advertisement led to a purchase. This can involve sharing hashed identifiers and data about events, such as a page view or a purchase, with the advertising platform.

24.3 Sale, sharing and targeted advertising. We do not sell Personal Data for money. Some laws, however, treat the use of advertising Cookies and pixels as the “sharing” of Personal Data for cross-context behavioural advertising, or as “targeted advertising”. Where the law does so, this clause 24 and Schedule 4 apply.

24.4 Consent and your choices. Where Applicable Data Protection Law requires consent for analytics or advertising Cookies, we ask for it through our cookie banner, and we do not set those Cookies before you agree. You can change your choice, or opt out, in any of the following ways:

(a) through the cookie settings link in the footer of the Website;

(b) by sending the Global Privacy Control signal from your browser, which we treat as an opt-out where the law requires;

(d) through the opt-out tools that industry bodies provide for online advertising.

24.5 Custom and lookalike audiences. We use customer lists, custom audiences and lookalike audiences for advertising only with the consent that the law requires. We do not upload your Personal Data to an advertising platform for those purposes without it.

24.6 Profiles for advertising. Advertising platforms may build profiles of their users from the data that they receive from many websites. We do not control how they do so, and their own privacy policies describe it. Our own use of automated tools is described in clause 17.

24.7 Retention. We keep analytics and advertising data for the periods shown in Schedule 1 and in clause 13, and in any case for no longer than twenty-five (25) months.

24.8 Changes. The tools that we use for analytics and advertising may change over time. Schedule 1 describes the types of Cookies that we use, and we will update it when they change in a way that matters to you.

25. Webinars and events

25.1 Application. Where we offer webinars, live sessions or Events, this clause 25 describes the Personal Data that we Process for them, in addition to the rest of this Privacy Policy.

25.2 Registration data. When you register, we collect your name and your email address, any question that you submit, your attendance and, for a paid Event, the details of your payment, which are handled by the Payment Processor.

25.3 Video-conferencing providers. The video-conferencing provider that we use to run an Event acts as a Processor on our instructions. It may collect technical data, such as your IP address and device details, when you join.

25.4 Recordings. We may record an Event. If you speak or appear on camera, you will appear in the recording. You can turn off your camera and your microphone to avoid this, and you can tell us before the Event that you do not consent.

25.5 Replays. Where we provide a replay, we store the recording on a platform that we use for that purpose, and we make it available as the event page describes.

25.6 Names of speakers and attendees. We publish the name of a speaker, and we publish the name of an attendee only if the attendee permits it.

25.7 Follow-up messages. We may send you follow-up emails about an Event that you attended. If a message is marketing, we send it only on the basis of your consent or another basis that clause 8 describes.

25.8 Retention. We keep registration and attendance records for the periods shown in clause 13.

26. Website contact form

26.1 What we collect through the form. When you use the contact form on the Website, we collect your name, your email address, the topic that you choose, your message and the tick box that shows that you have read this Privacy Policy. The form tool on the Website, and any spam protection that it uses, also record technical data when the form is sent, such as your IP address, the date and time, your browser information and spam signals.

26.2 Why we use it. We use that data to read and answer your message, to give you support, to keep a record of what was said and to protect the Website from spam and abuse.

26.3 Our legal basis. We rely on our legitimate interests in answering enquiries and in running the Website. Where your message concerns an Order, an Account or a request that you made before buying, we rely on the performance or preparation of a contract with you. Where the law requires your consent for a purpose, we rely on your consent, as clause 4 explains.

26.4 The tick box. The tick box confirms that you have read this Privacy Policy, and it is not a request for your consent. You are not obliged to use the form, and you may write to [email protected] instead.

26.5 Where your message goes. We store your message in the database of the Website and send it by email to our support mailbox. The hosting provider of the Website, the email provider and any spam-protection service act as Processors on our instructions, as clause 10 and Schedule 2 describe.

26.6 Retention. We keep a general enquiry for twelve (12) months after it is closed. We keep a message that concerns an Order, an Account or a refund for the longer periods that clause 13 sets out.

26.7 What not to send. Please do not send payment card details, passwords or Sensitive Data through the form. If you do, we use it only to respond to you.

26.8 Your rights. To access, correct or delete what you sent, write to [email protected], and clause 15 explains your rights.

27. Regional supplements

27.1 The supplements. Three Schedules add rights and information for people in particular regions: Schedule 3 for the European Economic Area, Switzerland and the United Kingdom; Schedule 4 for the United States; and Schedule 5 for Nigeria, Canada, Australia, Brazil and South Africa.

27.2 How they apply. A supplement applies to the extent that the relevant law applies to us. It adds to this Privacy Policy and does not remove any right that this Privacy Policy gives you.

27.3 Which prevails. For the people whom a supplement covers, the supplement prevails over the main body of this Privacy Policy if the two differ.

27.4 Other regions. If you live in a region that no Schedule names, you still have the rights that clause 15 describes and that your local law gives you. You may use the contact details in clause 29 to exercise them.

27.5 What each supplement contains. Each supplement describes the laws that it covers, the rights that those laws give, how to make a request, and the Regulator to which you may complain. If a supplement and clause 15 describe the same right in different words, the supplement governs for the people it covers, and clause 15 continues to apply to everyone else.

28. Changes to this Privacy Policy

28.1 Our right to update. We may update this Privacy Policy from time to time, for example to reflect a change in the law or in the way in which we Process Personal Data. We will post the updated version on the Website with a new “Last updated” date at the top.

28.2 Notice of material changes. If a change is material, we will tell you by email, or by a prominent notice on the Website, before the change takes effect. Where Applicable Data Protection Law requires it, we will ask for your consent to the change.

28.3 Earlier versions. You may ask for a copy of an earlier version of this Privacy Policy by writing to [email protected].

28.4 Reviewing it. Please review this Privacy Policy from time to time, so that you know how we handle Personal Data.

28.5 Effect of a change. A change applies to Personal Data that we collect after it takes effect. Where a change would allow us to use Personal Data that we already hold for a new purpose that is not compatible with the purpose for which we collected it, we will tell you and, where the law requires it, ask for your consent before we do so.

28.6 If you disagree. If you do not agree with a change, you may stop using the Website and the Products, you may ask us to delete your Personal Data under clause 15, and you may withdraw any consent that you have given.

29. Contact, privacy requests and complaints

29.1 To exercise your rights or ask a question, contact us at the Support Email, [email protected].

29.2 We give no postal address and no telephone number. Please write to us by email, and include enough detail for us to deal with your message, such as the email address that is registered to your Account.

29.3 Complaints. If you have a complaint about how we have handled your Personal Data, please contact us first, so that we can try to resolve it. You may also complain to the Regulator in your own country, and Schedules 3, 4 and 5 name the Regulators for the regions that they cover.

29.4 Response times. We respond to requests and complaints within the periods that clause 15 sets out.

29.5 What to include. To help us deal with your message quickly, please say whether you are making a request about your rights, asking a question or making a complaint, and describe what you would like us to do. Please do not include payment card details, passwords or Sensitive Data in your message.

29.6 If you are not satisfied. If you are not satisfied with our reply, you may complain to the Regulator in your country, or you may ask us to review our decision. Making a complaint to us does not limit your right to complain to a Regulator, and it does not affect your other legal rights.

29.7 Our Website is https://www.chapterspire.com. This Privacy Policy was last updated on 20 October 2026.

Schedule 1: Cookie policy

S1.1 This Schedule is our cookie policy. Cookies are small text files stored on your device; similar technologies include pixels, local storage and device identifiers. Strictly necessary cookies do not need your consent. For all other cookies we ask for your consent through our cookie banner, where Applicable Data Protection Law requires it, and you can change your choice at any time through the cookie settings link in the footer of the Website or through your browser. We honour the Global Privacy Control signal as an opt-out of sale, sharing and targeted advertising where Applicable Data Protection Law requires it. Blocking some cookies may affect how the Website works. The table lists the types of cookies we use; the exact cookies depend on the tools in use at the time.

Name or type	Provider and purpose	Category	Duration	First or third party
Session and login cookies	Our website platform or learning platform. Keep you logged in and identify your session	Strictly necessary	Session to 14 days	First party
Security and form-protection tokens	Our website platform. Protect forms and Accounts against forgery and abuse	Strictly necessary	Session	First party
Checkout and cart cookies	The Payment Processor. Support checkout and fraud prevention	Strictly necessary	Session to 12 months	Third party
Cookie consent record	Our consent tool. Remembers your cookie choices	Strictly necessary	Up to 12 months	First party
Preference cookies	Our website platform. Remember language, region and display settings	Functional	Up to 12 months	First party
Comment cookies	Our website platform. Remember your name, email address and website for your next comment, if you opt in	Functional	Up to 12 months	First party
Analytics cookies	Our analytics provider. Measure visits, pages viewed and traffic sources	Analytics	Up to 25 months	First or third party
Video player cookies	Our video host. Play and measure embedded video	Functional or analytics	Up to 12 months	Third party
Advertising pixels and cookies	Our advertising platforms. Measure conversions and enable retargeting	Marketing	Up to 12 months	Third party
Affiliate referral cookie	Our affiliate platform or Payment Processor. Attributes a purchase to the referring Affiliate Partner	Marketing	Up to 90 days	First or third party
Email tracking pixels	Our email service provider. Record whether an email was opened and which links were clicked	Analytics or marketing	Not applicable	Third party

S1.2 Managing cookies. You can manage cookies in three ways. First, our cookie banner lets you accept or refuse the cookies that are not strictly necessary when you first visit the Website. Second, you can change your choice at any time through the cookie settings link in the footer of the Website, which reopens the banner. Third, you can use the settings of your browser to block or delete cookies. The instructions differ for each browser, so please check the help pages of the browser that you use. If you block all cookies, some parts of the Website may not work, and you may be unable to log in or to complete an Order.

S1.3 Do Not Track. Some browsers send a “Do Not Track” signal. Not all browsers and websites support it, and there is no common standard for how to respond to it, so we do not treat it as a choice about cookies. We do, however, treat the Global Privacy Control signal as an opt-out of sale, sharing and targeted advertising, where Applicable Data Protection Law requires us to do so.

S1.4 Local storage and device identifiers. Some of our tools, and any apps that we offer, may store information on your device by means other than cookies, such as local storage and device identifiers. We use them for the same purposes as the cookies in the table, such as keeping you logged in, remembering your settings and measuring how a tool is used. This Schedule applies to them in the same way, and you can usually remove them through the settings of your browser or your device.

S1.5 Changes to the cookie list. The tools that we use change from time to time, and so do the cookies that they set. We will update this Schedule when a change is likely to matter to you, and we will show the date of the update at the top of this Privacy Policy. Where the law requires us to ask for your consent again, for example because we have added a new category of cookie, we will do so through the cookie banner.

S1.6 More information. Clause 9 of this Privacy Policy explains our use of cookies in general. Clause 24 explains our use of analytics, advertising and retargeting, and how you can opt out of them. Clause 11 explains how embedded content and fonts may involve a third party.

S1.7 Fonts. The fonts that the Website uses are described in clause 11. Where fonts are loaded from a third party, the provider receives your IP address and device information when your browser requests them, as that clause explains.

Schedule 2: Register of main service providers

S2.1 The table lists the categories of providers we use, with examples of well-known providers in each category. The examples show the kind of provider; the providers we actually use at any time may differ, and we will give you the names of the current providers on request to [email protected].

Provider category	Examples	Role	Personal Data shared	Typical location	Transfer safeguard
Payment and merchant of record	for example Paddle, Lemon Squeezy, FastSpring	Independent Controller or Processor	Identity, contact, order, billing country, transaction data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Website hosting and database	for example WP Engine, Kinsta, SiteGround	Processor	Account, order, usage and log data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
File storage and delivery	for example Amazon Web Services, Cloudflare, Bunny	Processor	Product files, access and download data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Course or learning platform	for example Teachable, Thinkific, Kajabi	Processor or Controller	Account, enrolment, progress and video data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Email marketing and customer relationship management	for example Mailchimp, MailerLite, Kit	Processor	Name, email, preferences, email interaction data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Help desk and customer support	for example Zendesk, Freshdesk, Help Scout	Processor	Contact data, support messages	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Analytics	for example Google Analytics, Plausible, Matomo	Processor or Controller	Device, usage and cookie data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Advertising and measurement	for example Meta, Google Ads, TikTok	Controller or joint Controller	Device, usage, hashed identifiers, conversion events	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Video hosting and streaming	for example Vimeo, Wistia, Bunny Stream	Processor or Controller	Playback and device data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Scheduling and video conferencing	for example Calendly, Zoom, Google Meet	Processor	Name, email, session data, recordings	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Affiliate platform and payouts	for example Rewardful, FirstPromoter	Processor or Controller	Affiliate and payout data, referral attribution	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Code repository and software delivery	for example GitHub, GitLab	Independent Controller	Username, email, access status	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Artificial-intelligence services	for example OpenAI, Anthropic, Google	Processor	Prompts, inputs and transcripts as submitted by users	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Fraud prevention and identity verification	for example the Payment Processor’s own tools	Processor or Controller	Identity, device, IP, order data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Accounting and tax	for example Xero, QuickBooks, FreshBooks	Processor or Controller	Transaction and invoice data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Fonts and content delivery	for example Google Fonts	Processor or Controller	IP address and device information (only if fonts are loaded from a third party; see clause 11)	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable

Schedule 3: Regional supplement A: European Economic Area, Switzerland and the United Kingdom

S3.1 Application. This Schedule applies to you if you are in the European Economic Area, Switzerland or the United Kingdom, to the extent that the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection or another law of those regions applies to our Processing of your Personal Data. It adds to the main body of this Privacy Policy, and where the two differ, this Schedule prevails for you, as clause 27 provides.

S3.2 Controller and representative. Chapter Spire is the Controller of your Personal Data. We have appointed a person responsible for data protection matters, who can be contacted at [email protected]. Where Applicable Data Protection Law requires us to appoint a representative in the European Economic Area or the United Kingdom, we will do so and publish the contact details here.

S3.3 Legal bases. The table in clause 4 sets out the legal bases on which we rely. Where we rely on our legitimate interests, we have assessed whether those interests are outweighed by your rights and freedoms, and we will give you a summary of that assessment if you ask us at [email protected].

S3.4 Your rights. Under the EU GDPR, the UK GDPR and Swiss law, you have the right to access your Personal Data, to have it corrected, to have it erased, to restrict its Processing, to receive it in a portable form, to object to its Processing, to withdraw your consent where we rely on it, and not to be subject to a decision based solely on automated Processing that has legal or similarly significant effects on you. Clause 15 explains how to exercise them. We respond within one (1) month, and we may extend that period by up to two (2) further months where a request is complex or where we have received a large number of requests. If we do so, we will tell you within the first month and explain why.

S3.5 Marketing and Cookies. Under the European Union and United Kingdom rules on electronic communications and privacy, including the Privacy and Electronic Communications Regulations in the United Kingdom, we ask for your consent before we set Cookies that are not strictly necessary, and we ask for your consent before we send marketing email, except where the law allows us to write to an existing customer about similar products, which is sometimes called a soft opt-in. You can refuse or withdraw consent at any time, as clause 9 and Schedule 1 describe.

S3.6 International transfers. When we transfer Personal Data outside the European Economic Area, Switzerland or the United Kingdom, we use the mechanisms that clause 12 describes. These include adequacy decisions, the standard contractual clauses approved by the European Commission, the International Data Transfer Agreement or the Addendum that applies in the United Kingdom, and the addendum that applies to transfers from Switzerland. You may ask for a copy of the safeguards at [email protected].

S3.7 Complaints. You have the right to complain to the supervisory authority in the country where you live, where you work or where the alleged infringement took place. In the United Kingdom, that authority is the Information Commissioner’s Office. In Switzerland, it is the Federal Data Protection and Information Commissioner. We would be grateful if you would contact us first, so that we can try to resolve your concern, but you are not required to do so.

S3.8 Children. The Website and our Products are for people who are eighteen (18) years of age or over. The different ages of digital consent that apply in some countries therefore do not apply to our Processing, because we do not offer the Website to children.

S3.9 Retention. We keep Personal Data for the periods in clause 13. Where the national law of a country requires us to keep records for longer, for example for tax or accounting purposes, that longer period applies to those records.

Schedule 4: Regional supplement B: United States

S4.1 Application. This Schedule applies to you if you live in the United States, including California, Colorado, Connecticut, Virginia, Utah, Texas and Oregon, and other states with comprehensive privacy laws, and similar state laws, to the extent that those laws apply to us. It adds to the main body of this Privacy Policy, and where the two differ, this Schedule prevails for you.

S4.2 Categories of Personal Data. The table below describes the categories of Personal Data that we have collected in the last twelve (12) months, using the categories that United States privacy laws use, and whether we have disclosed them for a business purpose or shared them.

Category	Examples	Collected	Disclosed for a business purpose	Sold or shared
Identifiers	Name, email address, IP address, online identifiers, advertising identifiers	Yes	Yes	Shared for cross-context behavioural advertising only if you accept advertising cookies
Customer records and commercial information	Name, billing country, Order history, Products purchased	Yes	Yes	No
Internet or network activity	Pages viewed, links clicked, interaction with the Website, Cookie data	Yes	Yes	Shared for cross-context behavioural advertising only if you accept advertising cookies
Geolocation (approximate, from IP address)	Country, region or city inferred from your IP address	Yes	Yes	Shared for cross-context behavioural advertising only if you accept advertising cookies
Audio, visual or similar information	Recordings of live sessions, photographs that you supply for a testimonial	Yes, where you take part	Yes	No
Professional or employment information	Job title or business details, where you give them	Yes, where you provide it	Yes	No
Education information	Enrolment, progress and completion of Courses	Yes	Yes	No
Inferences	Segments and interests drawn from your purchases and activity	Yes	Yes	Shared for cross-context behavioural advertising only if you accept advertising cookies
Sensitive personal information	Account login credentials, which we hold in hashed form	Yes	Yes	No

S4.3 No sale for money; sharing and targeted advertising. We do not sell Personal Data for money. The advertising Cookies and pixels that we use may count as “sharing” for cross-context behavioural advertising, or as “targeted advertising”, under some state laws. You can opt out through the cookie settings link in the footer of the Website, by sending the Global Privacy Control signal from your browser, or by emailing [email protected].

S4.4 Your rights. Depending on the state in which you live, you may have the right to know and to access the Personal Data that we hold about you; to ask us to delete it; to ask us to correct it; to receive a copy in a portable format; to opt out of the sale of Personal Data, of sharing for cross-context behavioural advertising, of targeted advertising and of profiling; to limit our use of sensitive personal information; and not to be treated unfairly because you use a right. If we refuse a request, you may appeal within a reasonable time, and where your state law provides for an appeal, we will respond to it within sixty (60) days.

S4.5 How to make a request. Email [email protected] and tell us what you would like us to do. We will verify your identity by matching the details that you give us with the details that we hold. You may use an authorised agent, and we may ask for your written permission for that person to act for you. We respond within forty-five (45) days of receiving a request, and we may extend that period by a further forty-five (45) days where we need more time and we tell you why.

S4.6 Shine the Light. If you are a California resident, you may ask us once a year for details of the Personal Data that we have disclosed to third parties for their own direct marketing purposes. We do not disclose Personal Data to third parties for their own direct marketing.

S4.7 Do Not Track. We do not respond to the Do Not Track signals that browsers send, but we do respond to the Global Privacy Control signal, as Schedule 1 describes.

S4.8 Financial incentives. We do not offer financial incentives in exchange for Personal Data, unless we offer one with a separate notice that explains its terms.

S4.9 Minors. The Website is not directed to anyone under eighteen (18) years of age. We do not knowingly sell or share the Personal Data of anyone under sixteen (16) years of age.

S4.10 Retention. We keep each category of Personal Data for the periods that clause 13 sets out.

S4.11 Notice at collection. This Privacy Policy and Schedule 1 are our notice at collection. They tell you which categories of Personal Data we collect, why we collect them, how long we keep them and how you can opt out of sale and sharing.

Schedule 5: Regional supplement C: Nigeria, Canada, Australia, Brazil and South Africa

S5.1 Application. This Schedule applies to you if you live in Nigeria, Canada, Australia, Brazil or South Africa, to the extent that the law of your country applies to us. It adds to the main body of this Privacy Policy, and where the two differ, this Schedule prevails for you, as clause 27 provides.

Nigeria

S5.2 Law that applies. The Nigeria Data Protection Act 2023 governs the Processing of Personal Data of people in Nigeria. We Process your Personal Data on the lawful bases that clause 4 describes.

S5.3 Your rights. Under that Act, you have the right to be informed about our Processing, to access your Personal Data, to have it corrected, to have it erased, to restrict its Processing, to object to its Processing, to receive it in a portable form, to withdraw your consent, and not to be subject to a decision based solely on automated Processing that has legal or similarly significant effects on you. Clause 15 explains how to exercise these rights.

S5.4 Transfers outside Nigeria. We transfer Personal Data out of Nigeria only where the country or the recipient gives adequate protection, or where we use another safeguard that the law allows, such as a contract that requires the recipient to protect the data.

S5.5 Breaches. Where the law requires it, we will notify the Nigeria Data Protection Commission of a breach that is likely to put your rights and freedoms at risk, within seventy-two (72) hours of becoming aware of it, and we will notify you where the law requires.

S5.6 Complaints. You may complain to the Nigeria Data Protection Commission. We would be grateful if you would contact us first at [email protected].

Canada

S5.7 Law that applies. The Personal Information Protection and Electronic Documents Act, and the privacy laws of the provinces, including Quebec’s Law 25, govern the Processing of Personal Data of people in Canada. We collect, use and disclose Personal Data only for the purposes that this Privacy Policy describes and, where the law requires it, with your consent.

S5.8 Your rights. You may ask for access to your Personal Data and for it to be corrected, and you may withdraw your consent, subject to legal and contractual limits and reasonable notice. Withdrawing your consent may mean that we can no longer provide a Product or a Service.

S5.9 Quebec. If you live in Quebec, our privacy contact is [email protected]. We assess the privacy risks of a transfer of Personal Data outside Quebec before we make it. Where the law provides for them, you have the right to data portability and the right to ask for the de-indexing of Personal Data.

S5.10 Complaints. You may complain to the Office of the Privacy Commissioner of Canada or to the privacy authority of your province.

S5.11 Commercial email. We send commercial electronic messages to people in Canada only with the consent that Canada’s anti-spam law requires, and every message identifies us and contains a way to unsubscribe.

Australia

S5.12 Law that applies. The Privacy Act 1988 and the Australian Privacy Principles govern the Processing of Personal Data of people in Australia.

S5.13 Access and correction. You may ask for access to your Personal Data and for it to be corrected, by writing to [email protected]. We will respond as the law requires.

S5.14 Overseas disclosure. We may disclose Personal Data to recipients outside Australia, as clause 12 describes. Before we do so, we take reasonable steps, as Australian Privacy Principle 8 requires, to make sure that the recipient does not breach the Australian Privacy Principles in relation to that data.

S5.15 Complaints. If you have a complaint, please contact us first, and we will respond within a reasonable time. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner.

S5.16 Commercial email. We send commercial electronic messages to people in Australia only as the Spam Act 2003 allows, which means with consent, with clear identification of us and with a working way to unsubscribe.

Brazil

S5.17 Law that applies. The Lei Geral de Proteção de Dados governs the Processing of Personal Data of people in Brazil. We Process your Personal Data on the legal bases which that law recognises, including your consent, the performance of a contract, compliance with a legal obligation and our legitimate interest, as clause 4 describes.

S5.18 Your rights. Under article 18 of that law, you have the right to confirmation that we Process your Personal Data; to access it; to have it corrected; to have it anonymised, blocked or deleted where it is unnecessary or excessive; to portability; to information about the entities with which we have shared it; to information about the possibility of refusing consent and its consequences; to withdraw your consent; and to ask for review of decisions that are made solely by automated Processing.

S5.19 Person responsible for data protection. Our person responsible for data protection, called the “encarregado” in Brazil, can be reached at [email protected].

S5.20 International transfers. We transfer Personal Data out of Brazil only by the mechanisms that the law allows, such as a decision of adequacy, standard contractual clauses, or your specific consent, as clause 12 describes.

S5.21 Response time and complaints. Where the law sets a period of fifteen (15) days for a complete declaration, we respond within it. You may complain to the Autoridade Nacional de Proteção de Dados.

South Africa

S5.22 Law that applies. The Protection of Personal Information Act governs the Processing of Personal Data of people in South Africa. We are the responsible party, and we Process Personal Data in line with the conditions for lawful Processing that the Act sets out.

S5.23 Your rights. You have the right to ask for access to your Personal Data, to ask us to correct or delete it, to object to its Processing, to withdraw your consent, and to object to the use of your Personal Data for direct marketing.

S5.24 Transfers outside South Africa. We transfer Personal Data out of South Africa only where the law allows it, for example where the recipient is subject to a law or a contract that gives similar protection, or where you consent.

S5.25 Complaints and our information officer. You may complain to the Information Regulator. Our information officer can be contacted at [email protected], and we would be grateful if you would contact us first.