PRIVACY
POLICY.

We collect only what we need to deliver and protect the service:

• Account & identity: email address, and (for operator accounts) display name.
• Order & transaction data: products purchased, amount, currency, country, and a Stripe payment identifier. We never see or store your full card number — card data is collected directly by Stripe.
• Support & chat content: messages you send to our Ripley assistant or to support@aimachina.shop.
• Usage & device data: pages viewed, referrer, approximate region, browser/OS, and anonymized IP via Google Analytics 4 (IP anonymization enabled).
• Newsletter / signal opt-in: email address only, provided voluntarily.

We do not collect: government IDs, precise location (GPS), contacts, photos, microphone, camera, SMS, call logs, health data, or biometric identifiers.

• Contract — to deliver purchased playbooks and operate your account.
• Legal obligation — to retain tax/invoice records and respond to lawful requests.
• Legitimate interest — to secure the platform, prevent fraud, and improve the product through aggregated analytics.
• Consent — for the optional newsletter and any non-essential cookies. You can withdraw consent at any time.

• Provide, maintain, and improve the service
• Process payments and deliver digital products
• Send transactional emails (receipts, downloads, support)
• Detect abuse, fraud, and security incidents
• Comply with tax, accounting, and legal obligations

We do not use your data for advertising, profiling, or automated decisions with legal effect.

We rely on the following vetted processors. Each is bound by a Data Processing Agreement and processes data only on our instructions.

International transfers rely on the EU Standard Contractual Clauses (SCCs) and the EU–US Data Privacy Framework where applicable. We do not sell or "share" personal information for cross-context behavioral advertising as defined by the CCPA/CPRA.

• Account data: kept until you request deletion, then removed within 30 days.
• Order & invoice records: retained for 7 years to satisfy tax and accounting law.
• Support & chat logs: 24 months, then anonymized.
• Newsletter list: until you unsubscribe.
• Analytics (GA4): 14 months, aggregated.
• Server & security logs: 90 days.
• Backups: rolling 30-day window, then overwritten.

• TLS 1.3 in transit; AES-256 at rest
• Row-Level Security on every database table
• Role-based access; principle of least privilege
• Secrets stored in encrypted vaults, never in code
• Stripe handles all card data (PCI-DSS Level 1)
• Breach notification within 72 hours where required by law

You have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure ("right to be forgotten") — GDPR Art. 17 / CCPA §1798.105
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Object — to processing based on legitimate interest
• Withdraw consent — at any time, without penalty
• Opt out of "sale" or "sharing" — we do neither, but the right is honored
• Non-discrimination — we will not penalize you for exercising any right
• Lodge a complaint — with your local supervisory authority (e.g. your EU DPA, the UK ICO, or the California Privacy Protection Agency)

Submit a request through our data deletion request page, or email support@aimachina.shop. We respond within 30 days (GDPR) or 45 days (CCPA), and may extend once where permitted. Identity verification may be required.

The service is not directed to children under 16. We do not knowingly collect data from minors. If you believe a child has provided us data, contact support@aimachina.shop and we will delete it.

Privacy questions, rights requests, or DPA inquiries: support@aimachina.shop

EU/UK users may also contact their local data protection authority. California residents may contact the California Privacy Protection Agency at cppa.ca.gov.

We may update this policy periodically. Material changes will be announced on this page and, where appropriate, by email. Continued use of the service after the "Last updated" date constitutes acceptance of the revised policy.