Privacy Notice.

1. Who we are (data controller)

This Privacy Notice describes how Elevate Mindset Mastery LLC ("we", "us", "our") collects, uses, and shares your personal data when you visit elevatemindsetmastery.com or soundbathhaven.com, purchase a program, attend a session, or otherwise interact with our services. Soundbath Haven is a brand operated by Elevate Mindset Mastery LLC.

For the purposes of applicable data-protection law (including the GDPR for visitors in the UK/EEA and the CCPA/CPRA for residents of California), Elevate Mindset Mastery LLC is the data controller of personal data collected through this site and our services. Mailing address: 936 E Green St Suite 102, Pasadena CA 91106, United States. Contact: elevatemindsetmastery@gmail.com.

2. Categories of personal data we collect

• Identity and contact data, name, email address, phone number (if provided), city/country.
• Account credentials, login email and a hashed password if you create an account on the site.
• Purchase data, products and programs you've purchased, dates, and receipts. Card and billing details are collected and stored by our payment processor, Stripe, not by us.
• Intake and session data, information you choose to share in intake forms, check-ins, applications, or 1:1 / group sessions. This is treated as confidential.
• Support communications, emails and messages you send us.
• Usage and device data: IP address, browser type, pages viewed, referral source, approximate location derived from IP, and similar technical telemetry.
• Cookies, see Section 8.

3. Why we collect it (purposes & legal basis)

We use your personal data for the following purposes. Legal bases under the GDPR are noted in brackets where applicable.

• To provide the services, delivering programs, sessions, certifications, and content you've purchased. [contract performance]
• To create and manage your account, authentication, password reset, customer support. [contract performance]
• To process payments, through Stripe as our payment processor (see Section 4). [contract performance / legal obligation]
• To send transactional and program emails, receipts, schedule changes, content delivery. [contract performance]
• To send marketing emails, newsletters, new program announcements, only if you've opted in. You can unsubscribe at any time. [consent]
• Security and fraud prevention, detecting abuse, securing accounts, defending against attacks. [legitimate interests]
• Product improvement and analytics, understanding which pages and offerings work, in aggregate. [legitimate interests]
• Compliance with law, tax, accounting, responding to lawful requests. [legal obligation]

4. Who we share your data with

We do not sell your personal data. We share it only with the following categories of recipient:

• Payment processor: Stripe, Inc. and its affiliates. When you make a purchase, Stripe processes payment on our behalf and handles card processing, fraud protection, tax calculation, collection, filing, and remittance for buyers in supported jurisdictions, invoicing, refunds, and subscription billing. Stripe's privacy notice is at stripe.com/privacy.
• Service providers and subprocessors we use to operate the site and deliver services, including hosting providers (Lovable Cloud / Supabase), email delivery providers, customer-support tooling, video-conferencing tools used for live sessions, and analytics providers. Each subprocessor is bound by data-protection obligations.
• Professional advisers, lawyers, accountants, and auditors, where reasonably required.
• Authorities, where required by law (e.g. court order, lawful request from a regulator).
• A successor entity, in the event of a merger, acquisition, or sale of all or substantially all of our assets.

5. International transfers

We are based in the United States. If you are accessing the services from outside the United States, your personal data will be transferred to and processed in the United States. Where data is transferred from the UK or EEA to the United States, we rely on appropriate safeguards such as the Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms with our subprocessors.

6. Data retention

We retain personal data only as long as necessary for the purposes set out in this notice or as required by law. Typical retention periods:

• Account and purchase records, for as long as your account is active, plus up to 7 years thereafter for tax and accounting purposes.
• Session and intake notes, for the duration of your active engagement with us, plus up to 5 years thereafter for continuity of care, after which records are securely deleted unless a longer period is required by law.
• Marketing email list, until you unsubscribe.
• Site analytics, typically up to 26 months in aggregated form.

When data is no longer needed, it is deleted or anonymized.

7. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data (rectification).
• Request deletion of your data (right to be forgotten), subject to legal exceptions.
• Restrict or object to certain processing.
• Receive your data in a portable format (data portability).
• Withdraw consent at any time (where processing is based on consent).
• Lodge a complaint with a supervisory authority (UK/EEA users, your local Data Protection Authority; California users, the California Privacy Protection Agency).

To exercise any of these rights, email elevatemindsetmastery@gmail.com. We will respond within 30 days (or one month for UK/EEA requests).

8. Cookies

We use a small number of cookies and similar technologies:

• Essential cookies, required for the site to function (login session, checkout flow, security tokens). Cannot be disabled.
• Analytics cookies, help us understand how the site is used, in aggregate. You can disable these in your browser settings.
• Payment processor cookies, set by Stripe during checkout to process your transaction.

We do not use third-party advertising cookies or cross-site tracking pixels.

9. Security

We use appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS), encrypted storage, role-based access controls, and regular review of subprocessor security practices. No method of transmission over the internet or electronic storage is 100% secure; we cannot guarantee absolute security but we treat any incident seriously and notify affected users where required by law.

10. Children

Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this notice

We may update this Privacy Notice from time to time. The updated version will be posted on this page with a revised "Last updated" date. Material changes will be communicated by email to active users where practicable.

12. Contact

Privacy questions or to exercise your rights: elevatemindsetmastery@gmail.com
Mailing: Elevate Mindset Mastery LLC, 936 E Green St Suite 102, Pasadena CA 91106, United States.