Your rights — start here
- Access: see all data we hold about you · 30-day SLA
- Correct: edit any data that's wrong · same day in your account · 7 days for fields you can't self-edit
- Export: download your data in JSON or CSV · 30-day SLA
- Delete: remove your account and data · 30-day grace then permanent
- Restrict / object: stop specific processing without deleting your account · 7-day SLA
- Opt out: marketing emails — every email has unsubscribe · effective immediately
- Don't sell my info: we don't sell. CCPA opt-out at /account/privacy
Use the privacy controls in your account at /account/privacy · or email privacy@valuetovictory.com.
What we collect
You give us
- Email address (account)
- Password (stored hashed with bcrypt or argon2id · we never see your plaintext password)
- Optional: name, photo, preferences you set
- Content you create (notes, comments, course progress)
- Payment info you enter on Stripe-hosted checkout (we never see card numbers — Stripe processes them and gives us a token)
We observe
- IP address (for security · log retention 90d)
- Browser/device user-agent (for support)
- Usage patterns (which pages, when — for service improvement)
- Errors that occur during your session (to fix bugs)
From third parties
- Stripe sends us payment status (paid · failed · canceled)
- Email provider sends bounce / complaint signals
- Identity-verification service (only if explicitly required for specific service)
Why we collect it
| Purpose | Lawful basis |
|---|---|
| Provide the service | Contract with you |
| Process payments | Contract |
| Send transactional emails (receipts, password reset) | Contract |
| Send marketing emails | Your opt-in consent (unsubscribe anytime) |
| Operate the service securely · prevent fraud | Legitimate interest |
| Recordkeeping (financial · audit) | Legal obligation |
| Improve the service | Legitimate interest (with privacy-respecting analytics) |
Who else sees your data
We share data only with vendors who help us run the service. Each one has a Data Processing Agreement and is bound by confidentiality. Our full list is at /subprocessors. Material additions come with 30 days advance notice.
We never sell your data. Not to advertisers, not to data brokers, not to anyone.
Categories of recipients:
- Hosting (Vercel, Neon, IONOS) — to run the application
- Payment processor (Stripe) — to process payments
- Email service (Postmark/Resend) — to send transactional and (with consent) marketing email
- Customer relationship (HubSpot) — to manage business contacts
- Analytics (privacy-respecting tools only) — aggregate metrics, no per-user fingerprinting
- Legal/compliance (when required) — only with valid legal process · we'll notify you unless prohibited
How long we keep it
| Data | Retention |
|---|---|
| Active account | While account is active |
| Account after cancellation | 30 days then permanent delete |
| Account after user-initiated delete | 30 days grace then permanent delete |
| Receipts (financial records) | 7 years (US tax law) |
| Marketing opt-in records | 3 years past unsubscribe |
| Web access logs | 90 days |
| Authentication audit logs | 1 year |
| Backups | Hourly 30 days · daily 1 year |
How we protect it
Full details on our security page. Highlights:
- TLS 1.2+ in transit · AES-256 for sensitive data at rest
- MFA required for all admin/operator accounts
- Append-only audit log of authentication events and sensitive reads
- Quarterly access reviews and disaster-recovery drills
- Annual security training acknowledged by every operator
International transfers
Our primary infrastructure is in the United States. If you're in the EU/UK and your data is transferred to the US, we rely on Standard Contractual Clauses (SCCs) and have completed transfer impact assessments where applicable. EU customers can request EU-only data residency under our DPA.
Children's data
Our service is not directed to children under 13 (US) or 16 (EU). We don't knowingly collect data from children. If you believe a child has signed up, contact privacy@valuetovictory.com and we'll delete the account promptly.
Changes to this notice
If we change material things in this notice, we'll email registered users at least 30 days before the change takes effect, and we'll update the "Last updated" date at the top.
Contact
Privacy questions: privacy@valuetovictory.com
General: hello@valuetovictory.com
Data Protection Officer (EU representative): TBD as we onboard EU customers