Privacy Policy

a) Account & Profile Information: Full name, email address, username, phone number, date of birth, gender, and avatar color preference. Passwords are hashed and never stored in readable form.

b) Payment & Subscription Information: Subscription status, membership plan, billing period dates, and payment status (e.g. past due). Payment card details are processed and stored by Stripe and are never stored on our servers.

c) User Activity & Content: Flows you build in the Flow Builder, flow folders, and transitions you mark as favorites.

d) Purchases: Records of digital products (such as e-books, guides, or courses) you purchase through the Platform, including purchases made without an account.

e) Consent & Legal Records: Your marketing email opt-in status, and the version and timestamp of the Terms of Service and Privacy Policy you accepted.

f) Communication Data: Content of help requests, studio inquiries, or other messages you send us.

g) Technical & Security Data: IP address, browser type, and device information — collected automatically for rate limiting, bot protection, and error monitoring.

We use your information to:

• Provide and operate the Platform
• Process payments and manage your subscription
• Fulfill and deliver digital product purchases
• Authenticate your identity and secure your account
• Send transactional emails (password resets, subscription confirmations, purchase receipts)
• Send marketing emails if you opted in
• Prevent fraud, abuse, and bot signups
• Respond to support requests
• Monitor and fix errors on the Platform
• Train and improve AI features using de-identified, aggregated data
• Comply with legal obligations

We share data with the following providers who process it on our behalf and are not permitted to use it for their own purposes:

• Stripe: Payment processing and billing (name, email, subscription and purchase details)
• Supabase: Database, authentication, and file storage (all account and content data)
• Mux: Video hosting and streaming (IP address, device info during playback)
• Resend: Transactional email delivery (email address, first name)
• Upstash Redis: Rate limiting (IP address, short-lived and not persisted)
• Cloudflare Turnstile: Bot detection on signup and forms (IP address, browser fingerprint)
• Sentry: Error monitoring and bug reports (user ID, email, browser and device info, error context, session replays of a small sample of visits — recordings of your screen within the Platform used solely to diagnose problems — and any details or screenshots you choose to include when submitting a bug report)
• Vercel: Platform hosting (all traffic passes through their servers)

We do not sell, rent, or trade your personal information.

We use session cookies to keep you logged in and local storage for authentication tokens. We do not use advertising or tracking cookies. You can block cookies in your browser settings, but this may prevent you from logging in.

We use HTTPS/TLS encryption in transit, hashed passwords (never stored in plaintext), server-side rate limiting, bot detection on all signup and form submissions, and signed expiring URLs for all video content. No internet transmission is 100% secure, and we cannot guarantee absolute security.

We keep your personal information for as long as your account exists. If you purchase a digital product without an account, we keep the associated purchase and payment records for as long as needed to provide the product and to meet legal, tax, and accounting requirements. After account deletion: personal data is deleted or anonymized within 30 days; records of your terms acceptance and required transaction records are kept for legal compliance. Trial data (email, IP) may be retained briefly to prevent abuse.

If we suspend or terminate an account for harassment, threats, abuse, or other violations of our Terms, we may retain a limited record — such as a hashed (irreversibly scrambled) email address or IP address — after deletion, solely to enforce the ban, prevent re-registration, and protect the safety of our owner, team, and users. This record is not used for any other purpose.

You can request account deletion by contacting lee@thetransitionvault.com. When processed:

• Your name, email, and profile data are permanently deleted
• Your private flows are deleted
• Any flows you published remain visible but are anonymized as “[Deleted Account]”
• Records of your terms acceptance and required transaction records are retained for legal compliance

Deletion is completed within 30 days. If you purchased a digital product without an account, you may request deletion of your data by email; we will delete it except for transaction records we are required to keep by law. Where an account was terminated for harassment or abuse, a hashed identifier may be retained to enforce the ban, as described in Section 6.

The Platform and its educational content are provided “as is.” Nothing on the Platform constitutes medical, health, or professional advice. Consult a qualified professional before beginning any physical practice. We rely on you to provide accurate account information and are not responsible for consequences arising from inaccurate information you provide.

We use de-identified, aggregated, or anonymized data — including functional elements of the flows and sequences you create — to analyze usage patterns, improve platform features, and develop and train AI tools and algorithms that enhance the experience for all users. This processing uses data that cannot identify you personally. We do not sell this data or use it to build profiles about you for advertising purposes.

EU/EEA/UK users: where applicable law requires it, we will obtain your consent before using personal data for AI training. You may contact us at lee@thetransitionvault.com to ask questions or object to this processing.

You may request access to, correction of, or deletion of your personal data at any time by emailing lee@thetransitionvault.com. This applies whether or not you have an account. You may also opt out of marketing emails via the unsubscribe link in any email.

U.S. residents (including California/CCPA): You have the right to know what data we hold, to delete it, and to correct it. We do not sell or share your personal information as defined under the CCPA. We respond within 45 days.

EU/EEA/UK residents (GDPR): Our lawful bases for processing are:

• Contract performance (Art. 6(1)(b)) — operating your account, delivering the service or a purchased product, processing your payment
• Consent (Art. 6(1)(a)) — marketing emails (you can withdraw at any time)
• Legitimate interests (Art. 6(1)(f)) — fraud prevention, rate limiting, error monitoring, platform security
• Legal obligation (Art. 6(1)(c)) — retaining records required by law

You have the right to withdraw consent, object to processing, request data portability, and lodge a complaint with your national supervisory authority.

Your data is processed in the United States and other countries where our service providers operate. For users in the EU/EEA/UK, transfers are covered by Standard Contractual Clauses (SCCs) adopted by our providers including Stripe, Supabase, and Vercel.

The Platform is not intended for anyone under 18. We do not knowingly collect information from minors. If we become aware of such data, we will delete it promptly.

If Xlee LLC is acquired, merged, or sells assets, your data may transfer to the successor entity, who will be bound by this policy.

We will notify you of material changes via email or a notice on the Platform. The version number and effective date above will be updated. Continued use after changes constitutes acceptance.

lee@thetransitionvault.com · Xlee LLC · thetransitionvault.com