Privacy Policy

This Privacy Policy explains how Ad Agency Blueprint ("we" or "us") collects, uses, shares, and protects personal information when you visit ad-agency-blueprint.vercel.app, create an account, purchase a membership, or use the Ad Agency Blueprint course (the "Service"). It also explains the choices you have.

We are the controller of the personal information described here. Our contact details are at the end of this policy.

Information you give us:

• Account details: your name, email address, and password (stored only as a secure hash). If you sign in with Google, we receive your name, email address, and Google account ID from Google.
• Payment details: your card or payment method is collected and stored by Stripe, our payment processor. We receive a Stripe customer ID, the last four digits and brand of your card, your billing address if you provide one, and your subscription status. We never see or store your full card number.
• Messages you send us, such as support emails, feedback, or testimonials.

Information collected automatically:

• Course activity: which lessons you have started and completed and your playback position, so the dashboard can show progress and resume where you left off.
• Video analytics: Mux, our video host, records playback events such as plays, pauses, buffering, and watch time, along with your approximate location, device type, and browser.
• Technical data: IP address, browser type, operating system, referring page, pages viewed, and timestamps, collected by our hosting provider and by standard server logs.
• Cookies: see the Cookies section below.

We do not knowingly collect sensitive information such as health, biometric, or precise geolocation data, and we ask that you do not send it to us.

We use personal information to:

• Create and secure your account and let you sign in.
• Process payments, manage your membership, handle renewals and cancellations, and send receipts.
• Deliver the course, remember your progress, and generate short-lived signed video URLs tied to your session.
• Respond to support requests and communicate about your account, such as payment failures, price changes, and updates to our terms.
• Send occasional emails about new modules or related offers. You can opt out of marketing emails at any time using the unsubscribe link; we will still send transactional emails about your account.
• Understand how the Service is used, fix problems, and improve content and performance.
• Prevent fraud, abuse, credential sharing, and unauthorized copying of content.
• Comply with legal obligations and enforce our Terms of Service.

Where the GDPR or UK GDPR applies, our legal bases are performance of our contract with you, our legitimate interests (running, securing, and improving the Service and marketing it to existing customers), your consent where we ask for it, and compliance with legal obligations.

We do not sell personal information, and we do not share it with third parties for their own marketing. We share information only with service providers who process it on our behalf under contracts that restrict their use of it:

• Supabase: authentication, database, and hosting of account and progress data.
• Stripe: payment processing, subscription billing, invoices, and the customer billing portal.
• Mux: video hosting, streaming, and playback analytics.
• Google: sign-in, if you choose "Continue with Google".
• Vercel: website hosting, content delivery, and server logs.
• Email delivery providers, for transactional and marketing email.

We may also disclose information if required by law, subpoena, or court order; to protect the rights, property, or safety of us, our users, or others; or as part of a merger, acquisition, financing, or sale of assets, in which case this policy will continue to apply to your information.

We use a small number of cookies, all of which are necessary for the Service to work:

• Authentication cookies that keep you signed in and refresh your session.
• A preference cookie that remembers settings such as a dismissed notice.
• Stripe sets cookies during checkout for fraud prevention.

We do not currently use third-party advertising cookies or cross-site tracking. If we add analytics or marketing cookies in the future, we will update this policy and, where required, ask for your consent first. You can block or delete cookies in your browser settings, but the Service will not work without the authentication cookie.

We keep your account and progress data for as long as your account exists. If you cancel, we keep the account so you can come back, unless you ask us to delete it.

We keep billing records, including Stripe transaction data, for seven years to meet tax and accounting requirements.

Server logs and video analytics are kept for up to 12 months. Support emails are kept for up to three years.

When you delete your account, we delete or anonymize your personal information within 30 days, except for records we must keep by law and backups, which are overwritten on a rolling basis within 90 days.

We protect information with measures appropriate to its sensitivity, including encryption in transit (TLS) and at rest, hashed passwords, row-level access controls in our database so that each member can only read their own records, signed and expiring video URLs, and limited staff access. Payment data is handled entirely by Stripe, a PCI DSS Level 1 certified provider.

No system is completely secure. If we learn of a breach affecting your personal information, we will notify you and any regulator as required by law. Please use a unique password and tell us right away if you suspect unauthorized access to your account.

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy in a portable format, restrict or object to certain processing, and withdraw consent where processing is based on consent. You can update your name and password from the Account page, manage billing through the Stripe portal, and unsubscribe from marketing emails using the link in any such email.

To exercise any other right, including deleting your account, email us at the address below. We will verify your identity, usually by confirming a request sent from the email on your account, and respond within 30 days (45 days where permitted by law). We will not discriminate against you for exercising your rights.

California residents: under the CCPA/CPRA you have the rights described above, including the right to know, delete, and correct, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined in California law, and we do not use sensitive personal information to infer characteristics about you.

EEA, UK, and Swiss residents: you also have the right to lodge a complaint with your local data protection authority. We transfer information to the United States, where our providers are located, relying on standard contractual clauses and other safeguards recognized by law.

The Service is for adults starting a business. It is not directed to anyone under 18, and we do not knowingly collect personal information from children under 13 (or under 16 where that is the applicable age). If you believe a child has provided us information, contact us and we will delete it.

The course references outside platforms such as Google Ads, Meta, and AI tools, and the Service links to third-party sites. Those services have their own privacy policies, which apply when you use them. We are not responsible for their practices.

We may update this policy as the Service or the law changes. If a change is material, we will notify you by email or by a notice in the Service before it takes effect. The "Effective" date at the top shows when the policy was last revised. Continuing to use the Service after that date means you accept the updated policy.

Privacy questions and requests: support@adagencyblueprint.com. Please put "Privacy request" in the subject line so we can route it quickly.