Privacy Policy
Last Updated: March 21, 2026
This Privacy Policy explains how Innovation Distributed OU ("we", "us", "our") collects, uses, and protects your information when you use our website at thefourlanguages.com and purchase our digital products and services.
Innovation Distributed OU is registered in Estonia (registry code 16434657), located at Ahtri tn 12, Kesklinna linnaosa, Tallinn 15551, Estonia.
1. What We Collect
When You Sign Up for a Free Resource or Event
| Data | Purpose |
|---|---|
| Email address | Deliver the resource and send event details |
| Name (if provided) | Personalize communication |
When You Purchase a Course or Service
| Data | Purpose |
|---|---|
| Email address | Create your course account and send access instructions |
| Payment information | Process your purchase (handled entirely by Stripe; we never see or store your card details) |
| Purchase tier and amount | Determine which content and features you can access |
| Subscription status (for Membership and Human-in-the-Loop tiers) | Manage recurring billing, module unlock progression, and access level |
When You Log In to the Course
| Data | Purpose |
|---|---|
| Email and password | Authenticate your identity and grant access to purchased content |
| Session data | Keep you logged in securely |
When You Sign Up for a Live Event
| Data | Purpose |
|---|---|
| Email address | Send event confirmation, calendar invite, and follow-up |
| Name (if provided) | Personalize the event experience |
Consent Logging
Every time you sign up, subscribe, unsubscribe, or request data deletion, we log the action, timestamp, and your IP address in an internal consent log. This record is required by GDPR and is never deleted.
What We Do NOT Collect
- Device identifiers or advertising IDs
- Location data
- Browsing behavior or analytics tracking
- Health data
- Contacts, photos, or any device data
2. How We Use Your Information
We use your information to:
- Deliver digital products you purchased
- Create and manage your course account
- Send transactional emails (purchase confirmations, password reset links, event details)
- Provide access to content based on your purchase tier
- Respond to your support requests
We do NOT:
- Sell your personal data to anyone
- Use your data for advertising
- Share your data with marketers or data brokers
- Send unsolicited marketing emails (you only receive emails related to what you signed up for)
3. Who Processes Your Data
We use the following third-party services to operate our website and deliver our products. Each processes data only for the specific purpose listed:
| Service | What They Do | Data Location | Their Privacy Policy |
|---|---|---|---|
| Supabase | User authentication, course access, consent logging, and data storage | EU (Frankfurt, Germany) | supabase.com/privacy |
| Stripe | Payment processing and tax calculation | US (with EU data protection) | stripe.com/privacy |
| Resend | Transactional emails (welcome emails, password reset links, event confirmations) | US | resend.com/legal/privacy-policy |
| Hostinger | Website hosting | EU | hostinger.com/privacy |
| Anthropic (Claude) | AI development tool used to build and operate our systems, and the tool taught in the course. We use the API with 30-day data retention and have opted out of model training. | US (with data deletion after 30 days) | anthropic.com/privacy |
| Krisp | Meeting transcription for Sprint and coaching sessions (with participant awareness) | US | krisp.ai/privacy-policy |
| Vimeo | Course video hosting | US | vimeo.com/privacy |
We do not transfer your data to any other parties beyond those listed above.
AI-Specific Data Handling
We use Claude (by Anthropic) as a core operational tool. Important details about how your data interacts with this tool:
- We use the Anthropic API, not the consumer chat product. API inputs and outputs are retained by Anthropic for up to 30 days for trust and safety purposes, then permanently deleted.
- We have opted out of model training. Your data is never used to train AI models.
- During live Sprint sessions, AI tools may process information you share (your business name, goals, preferences) to help build your system in real time. This is a core feature of the service.
- Your course account data (email, purchase tier) may be accessed by AI tools during system operations (e.g., granting course access after purchase).
- Meeting transcripts from Sprint sessions (via Krisp) may be processed by AI tools to extract action items and update your records. You will be informed when sessions are being transcribed.
4. Legal Basis for Processing (GDPR)
If you are in the European Economic Area (EEA), UK, or Switzerland, we process your data based on:
- Contract performance: When you purchase a product or sign up for a service, we process your data to fulfill that agreement (Article 6(1)(b) GDPR)
- Legitimate interest: To respond to support requests and maintain security of our systems (Article 6(1)(f) GDPR)
- Consent: For any optional communications beyond transactional emails. You can withdraw consent at any time (Article 6(1)(a) GDPR)
5. LGPD Compliance (Brazil)
If you are in Brazil, your data is protected under the Lei Geral de Protecao de Dados (LGPD). You have the right to:
- Confirm whether your data is being processed
- Access your data
- Correct incomplete or inaccurate data
- Request anonymization, blocking, or deletion of unnecessary data
- Request data portability
- Request deletion of data processed with your consent
- Know which entities your data has been shared with
- Be informed about the possibility of denying consent and its consequences
To exercise any of these rights, contact us at maaria@thefourlanguages.com.
6. Your Rights (All Users)
Regardless of where you are located, you have the right to:
- Access: Request a copy of the personal data we hold about you
- Correction: Update or correct your information
- Deletion: Request that we delete your account and all associated data
- Portability: Receive your data in a standard, machine-readable format
- Objection: Object to processing based on legitimate interest
- Withdraw consent: For any consent-based processing, at any time
How to exercise your rights: Email maaria@thefourlanguages.com with your request. We will respond within 30 days. You can also use the unsubscribe link in any email to withdraw marketing consent instantly.
7. Data Security
- All data transmitted between your browser and our servers is encrypted (TLS/SSL)
- Database is hosted in the EU (Frankfurt, Germany) and encrypted at rest
- Row Level Security ensures you can only access your own course content and data
- Payment data is handled entirely by Stripe (PCI DSS Level 1 compliant); we never store card numbers
- Passwords are hashed and never stored in plain text
- All unsubscribe links are cryptographically signed (HMAC) to prevent unauthorized changes
- Webhook signatures are verified using constant-time comparison to prevent timing attacks
8. Data Retention
- Course accounts: Your data is retained as long as your account is active. Course access is lifetime for the tier you purchased.
- Event signups: Retained for 12 months after the event, then deleted unless you have an active course account.
- Free resource signups: Retained for 12 months, then deleted unless you have an active course account.
- Purchase records: Financial records are retained for 7 years as required by EU accounting regulations. On deletion request, personal details are anonymized but the transaction record is preserved.
- Consent log: Retained permanently as required by GDPR for audit purposes. Cannot be deleted.
- Account deletion: When you request account deletion, all personal data is permanently removed within 30 days, except where retention is legally required (purchase records, consent log).
9. Cookies
Our website uses only essential cookies required for authentication (keeping you logged in to the course). We do not use:
- Analytics cookies
- Marketing or tracking cookies
- Third-party advertising cookies
No cookie consent banner is required because we only use strictly necessary cookies.
10. International Data Transfers
Our primary data storage is in the EU (Supabase, Frankfurt, Germany). Some of our service providers (Stripe, Resend) are based in the United States. These transfers are protected by:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- The service providers' own data protection agreements
- Adequate security measures as described in Section 7
11. Children
Our products and services are not intended for anyone under 16. We do not knowingly collect personal data from anyone under 16.
12. Changes to This Policy
We may update this policy when our services or legal requirements change. We will notify you of significant changes by email. The "Last Updated" date at the top of this page shows when the policy was last revised.
13. Contact
If you have questions about this Privacy Policy, your data, or want to exercise any of your rights:
Innovation Distributed OU
Registry code: 16434657
Ahtri tn 12, Kesklinna linnaosa
Tallinn 15551, Estonia
Email: maaria@thefourlanguages.com
Website: thefourlanguages.com