Privacy Policy

1. Information We Collect

Information you provide

• Email address collected at the audit gate and during account creation
• Assessment responses your answers to audit questions (skills, background, goals, constraints)
• Subscription and billing information processed by Stripe; we do not store card numbers
• Account preferences tier selection, communication preferences

Information collected automatically

• Usage data (pages visited, features used, session duration)
• Device and browser type for compatibility purposes
• IP address for security and fraud prevention

2. How We Use Your Information

• To deliver the Service generating your analysis, maintaining your dashboard, tracking your progress
• To send transactional emails results delivery, billing confirmations, account notices
• To send the First Principled newsletter if you have opted in (unsubscribe anytime)
• To improve the Service aggregate, anonymized usage analysis only
• For fraud prevention and security

We do not use your data for advertising. We do not sell your data to third parties. Ever.

3. Your Data Belongs to You

You retain 100% ownership of your personal data and assessment history. At any time you may request to:

• Export your audit history and dashboard data
• Delete your account and all associated data
• Correct any stored information
• Unsubscribe from all marketing communications

To exercise any of these rights, submit a request through our data request form, or email support@firstprincipledlife.com. A real person reviews and completes each request; we aim to respond within a few business days.

4. Third-Party Processors

We work with the following service providers who process data on our behalf under strict data processing agreements:

• Stripe payment processing and subscription management. Stripe's privacy policy governs payment data.
• Beehiiv email newsletter platform. Your email address is shared with Beehiiv for newsletter delivery if you opt in.
• Anthropic (Claude API) AI analysis engine. Your assessment responses are sent to Anthropic's API to generate your analysis. Anthropic does not use API data to train its models per their enterprise data policy.
• Vercel application hosting and serverless functions.
• Supabase database infrastructure for storing your account data and history.

5. Data Security

• All data is encrypted in transit using TLS 1.3
• Database data is encrypted at rest using AES-256
• Access to production data is restricted to authorized personnel only
• Payment data never touches our servers, it is processed entirely by Stripe

6. Data Retention

We keep your account data while your account is open. When your account is deleted, we delete it right away rather than holding it.

Some things stay behind on purpose. If you asked us to stop emailing you, we keep that request so we don’t email you again. We keep totals and counts that name no one. Anything you typed into a conversation or a form stays in that text.

You can ask us for a copy of your data, or ask us to delete your account, from your account page.

7. Cookies and Measurement

We use cookies and similar technologies only where necessary to run the Service, process payments, and monitor for errors, never for advertising or behavioral tracking.

• Clerk (authentication) sets a session cookie so you stay signed in. Necessary; you cannot opt out without logging out of the Service.
• Stripe (payment processing) sets cookies during checkout for fraud prevention and to process your payment. Necessary if you make a purchase.
• Sentry (error monitoring) captures a sample of application errors so we can diagnose and fix bugs, and occasionally records a short session replay when an error occurs so we can see what happened. It is not used to track you across sessions for marketing or advertising purposes.

Analytics cookies are opt-in. We ask before we set them. If you accept, we use PostHog and Google Analytics. Both set cookies that recognize your browser when you come back, so we can see how people use the Service over time.

PostHog may record parts of what you do on screen. Sensitive information gets masked before it leaves your browser. That includes anything in your Business Profile and everything you say to Radix. We never capture it or store it. Recordings are deleted after 30 days.

If you decline, or never answer, none of that runs. No PostHog. No Google Analytics. No PostHog session recording. No cookie that recognizes your browser on a later visit.

We still count how people use the Service. This happens either way, and it works differently. We record anonymous events about how people move through pages and features. One example: someone started the Audit, and which question they stopped on. These use a temporary ID that lives only in the current browser tab and disappears when you close it. They aren't tied to your identity. We never share them with other sites. They can't recognize you later.

We don't use any of this for advertising. We don't sell it, and we don't share it with anyone for advertising.

8. Children's Privacy

The Service is not directed at individuals under 18. We do not knowingly collect data from minors. If we become aware of such collection, we will delete the data immediately.

9. Changes to This Policy

Material changes to this policy will be communicated via email to active subscribers 30 days before taking effect.

10. Contact

Privacy questions or data requests: support@firstprincipledlife.com

11. Your California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request its deletion, and to opt out of the “sale” or “sharing” of your personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. You may still record a formal opt-out below, or by emailing support@firstprincipledlife.com. We will not discriminate against you for exercising any of these rights.