Privacy Policy

1. Introduction and who we are

This Privacy Policy explains how Christian McTighe, an individual trading as CWM Digital Technologies as a sole proprietorship (Einzelunternehmen) established in Germany (“we,” “us,” “our,” or the “Business”), collects, uses, shares, and protects your personal information when you use The Great Conversation and related services (the “Service”). We aim to collect as little as possible. Our full legal-identity details are in our Imprint.

We offer the Service to users around the world, and we act as the “controller” of your personal data under the EU/UK GDPR. Depending on where you live, other privacy laws may give you additional rights, which are described in Section 9. If you have any questions, contact us using the details in Section 14.

2. Information we collect

Information you provide to us:

• Account details — your email address, and a name if you choose to provide one, from signing in with a one-time email link.
• Purchase information — a record of your transaction and the access you bought. Payment is handled by Stripe, which acts as our payment processor and, through Stripe Managed Payments, as merchant of record. Stripe collects your payment details, and the billing name and address used to calculate tax, directly from you at checkout. We receive a confirmation, a customer reference, and limited transaction details (such as the amount, currency, and payment status); the billing name and address you enter are also recorded on the customer record in our Stripe account. We never see or store your full card details.
• Order and withdrawal records — the wording you agreed to at checkout (including your request for immediate access), when your access was activated, when we sent your order confirmation, and, if you use our withdrawal form, the details you submit (your name, contact email, order reference, and an optional reason).
• Communications — messages you send us, such as support requests or feedback.
• Friend invitations (optional) — if you choose to invite a friend, the email address you enter for them (see Section 11).

Information collected automatically when you use the Service:

• Usage data — such as your IP address, browser and device type, and which lessons you have marked complete, so we can show your progress.
• Sign-in security logs — to protect your account, we record sign-in attempts (successful and failed), including the time, IP address, browser/device, and — where this feature is enabled — an approximate location derived from the IP address. We use this to detect and investigate suspicious account activity.
• An essential cookie — to keep you signed in (see Section 6).
• Analytics data — if you consent to analytics cookies, we receive aggregated statistics about how the Service is used (see Section 6). We do not collect this unless you opt in.

Information from third parties: limited transaction, tax, and fraud-prevention information from Stripe.

3. How we use your information (and legal bases)

We use personal information to operate, secure, and improve the Service. Where the EU/UK GDPR applies, we rely on the legal bases noted below.

We do not sell your personal information. See Section 9 for how certain laws treat the “sale” or “sharing” of personal information and your related rights.

4. How we share information

We share personal information only as needed to run the Service, and never for others’ independent marketing. Our service providers are required to protect your information and to use it only to provide services to us — except Stripe in its separate role as merchant of record, which uses the data it collects at checkout for its own purposes (see below):

• Stripe — payment processing and fraud prevention; and, through Stripe Managed Payments, merchant of record for your purchase (see below).
• Resend — transactional email, such as your sign-in link, order confirmations, and any friend invitation you ask us to send.
• Google Cloud — hosting, database, and file storage.
• Google Analytics — optional website analytics, provided by Google, used only if you consent to analytics cookies.
• An IP-geolocation provider — where enabled, to approximate the location of a sign-in attempt for the security logs described in Section 2.

Stripe as merchant of record. Because purchases are made through Stripe Managed Payments, Stripe (including its Link service) is the merchant of record for your purchase. In that role it decides for itself how to use the payment and billing data it collects from you at checkout — for example to calculate, collect, and report tax, issue receipts and invoices, prevent fraud, handle payment disputes, and meet its legal obligations — and acts as a separate controller under its own privacy notice (stripe.com/privacy). If you create a Link account, that relationship is between you and Link. To exercise your privacy rights over data Stripe holds, contact Stripe or Link support directly. If Stripe deletes your data for a purchase at your request, it may also delete the related records in our Stripe account.

We may also disclose information to professional advisors, to authorities where required by law or to protect rights, safety, and security, and to a successor entity in connection with a merger, acquisition, or sale of assets.

5. International data transfers

We are based in Germany, in the European Union. Some of our service providers are located, or process data, outside the European Economic Area (“EEA”) — for example in the United States. Where personal data is transferred outside the EEA to a country not covered by a European Commission adequacy decision, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or, for providers certified under it, the EU–U.S. Data Privacy Framework. If you are located outside the EEA, your information will in any case be transferred to and processed in Germany. You can request more detail about the safeguards we use via the contact in Section 14.

6. Cookies

We use a strictly necessary cookie to keep you signed in and secure your session; because it is essential to operate the Service, it does not require consent. With your consent, we also use Google Analytics cookies to understand how the Service is used so we can improve it — these are set only after you opt in through our cookie banner, and you can change or withdraw your choice at any time. We do not use advertising or marketing cookies. For the full list and how to manage your choices, see our Cookie Policy.

7. Data retention

We keep personal information for as long as your account is active and for as long as needed to provide the Service, and then for a reasonable period afterward to comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Records of your purchase, your checkout consent, your order confirmation, and any withdrawal request are kept for as long as commercial and tax retention rules require or we need them to defend legal claims. Stripe keeps the data it collects as merchant of record for its own retention periods, under its own privacy notice. The sign-in security logs described in Section 2 are kept only for a limited retention period and are then automatically deleted. The email address of anyone you invite (Section 11) is deleted automatically 3 months after the invitation, or sooner if your account is deleted.

8. How we protect information

We use reasonable technical and organizational measures designed to protect personal information, such as encryption in transit, access controls, and the use of reputable service providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your privacy rights

Depending on where you live, you may have some or all of the rights below. We will not discriminate against you for exercising them. To make a request, contact us as described in Section 14; we may need to verify your identity before responding.

EEA, United Kingdom, and Switzerland (GDPR / UK GDPR / FADP). You have the rights to access your personal data; correct inaccurate data; request erasure; restrict or object to certain processing; data portability; and, where processing is based on consent, withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local data-protection supervisory authority, or with the German supervisory authority for the state (Land) in which we are based — the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

California (CCPA / CPRA) and other U.S. state laws. You have the rights to know what personal information we collect and how we use and disclose it; access, correct, and delete your information; and opt out of the “sale” or “sharing” of personal information and certain targeted advertising. We do not sell your personal information for money. To the extent our use of analytics cookies is treated as “sharing” for cross-context behavioral advertising under some U.S. state laws, you can opt out at any time by declining or withdrawing analytics consent through our cookie banner. Residents of other U.S. states with comprehensive privacy laws may have similar rights, which we honor where they apply to you.

Other regions. If you are in Canada, Brazil (LGPD), Australia, or another jurisdiction with applicable privacy laws, you may have rights to access, correct, and delete your personal information and to withdraw consent. Contact us and we will respond as required by the law that applies to you.

10. Marketing communications

We do not send marketing emails or newsletters. We email you only about your account and purchase: sign-in links, order confirmations, withdrawal and refund handling, replies to your support requests, and important notices about the Course. If that ever changes, we will ask for your consent first and update this policy.

11. Inviting a friend (optional)

Inviting a friend is entirely optional. Nothing in the Service depends on it, and inviting someone gives you no reward or advantage. If you choose to invite someone, this is what happens:

• What we process. The email address you enter for them, the date we sent the invitation, and a link to your account (so we can limit misuse and delete the record when your account is deleted).
• What we send. One short invitation email, sent by us at your request, that says you invited them (using your name, if you have given us one) and links to the Service. We do not add their address to any mailing list, send them marketing emails, or use the address for any other purpose.
• Who handles it. The email is delivered by our email provider, Resend (see Section 4).
• How long we keep it. Their email address is deleted automatically 3 months after the invitation, or sooner if your account is deleted.
• Limits. To prevent misuse, we limit how many invitations an account can send per day and do not allow repeat invitations to the same address within a short period.

Please invite only people you know personally and who would welcome the message. If you received an invitation and would like your email address deleted, contact us at info@cwm-digitaltech.com and we will delete it promptly. You also have the rights described in Section 9. You can share the Course without involving us at all: the share link on our home page opens a pre-filled message in your own email app, and in that case we neither see nor store the address.

12. Children’s privacy

The Service is intended for adults and is not directed to children. We do not knowingly collect personal information from children under the age set by applicable law (for example, under 16 in parts of the EEA, or under 13 in the United States under COPPA). If you believe a child has provided us with personal information, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after the changes take effect means you accept the updated policy.

14. How to contact us

For privacy questions or to exercise your rights, contact us at info@cwm-digitaltech.com. Our full contact details are in our Imprint.