Privacy Policy
Last Updated: July 18, 2026
This Privacy Policy explains how Innovation Distributed OU ("we", "us", "our") collects, uses, and protects your information when you use our website at thefourlanguages.com and purchase our digital products and services.
Innovation Distributed OU is registered in Estonia (registry code 16434657), located at Ahtri tn 12, Kesklinna linnaosa, Tallinn 15551, Estonia.
1. What We Collect
When You Sign Up for a Free Resource or Event
| Data | Purpose |
|---|---|
| Email address | Deliver the resource and send event details |
| Name (if provided) | Personalize communication |
When You Purchase a Course or Service
| Data | Purpose |
|---|---|
| Email address | Create your course account and send access instructions |
| Payment information | Process your purchase (handled entirely by Stripe; we never see or store your card details) |
| Purchase tier and amount | Determine which content and features you can access |
| Subscription status (for Membership tier) | Manage recurring billing, module unlock progression, and access level |
When You Log In to the Course
| Data | Purpose |
|---|---|
| Email and password | Authenticate your identity and grant access to purchased content |
| Session data | Keep you logged in securely |
When You Sign Up for a Live Event
| Data | Purpose |
|---|---|
| Email address | Send event confirmation, calendar invite, and follow-up |
| Name (if provided) | Personalize the event experience |
When You Use One of Our AI Tools
The quiz, the 10-hour week, and the Life Scan ask you to write about your work and your life, send what you wrote to an AI model, and write you a reading back. The site assistant answers questions from our published pages. What each one keeps:
| Tool | Data | Purpose |
|---|---|---|
| The quiz and the 10-hour week | Your answers, the reading generated for you, your name and email, and your consent record | Generate and send your reading, and send the follow-up letters you agreed to |
| The Life Scan | The full conversation in your own words, your reading, your suggested practices, your three-month map, your name and email, and your consent record | Generate your reading and map, send the follow-up letters you agreed to, and prepare for coaching if you book it |
| The site assistant | Your question and its answer, tied to a random conversation id | Answer your question and let us see where the assistant is unhelpful. Nothing stored links a conversation to you |
| The Root Scan (in the course) | Your conversation, linked only to an anonymous session ID | Generate your root file. No name, email, or other personal identifier is collected |
A plain-language walkthrough of these four tools, including which AI company sees what, is on the AI and your words page.
Consent Logging
Every time you sign up, subscribe, unsubscribe, or request data deletion, we log the action, timestamp, and your IP address in an internal consent log. This record is required by GDPR and is never deleted.
What We Do NOT Collect
- Device identifiers or advertising IDs
- Location data
- Cross-site tracking, advertising profiles, or analytics that personally identify you (the analytics we do use is anonymous and aggregate: see Section 3)
- Health data (we never ask for it; where a tool invites you to write freely, whatever you choose to write is stored as ordinary personal data under the retention rules in Section 8)
- Contacts, photos, or any device data
2. How We Use Your Information
We use your information to:
- Deliver digital products you purchased
- Create and manage your course account
- Send transactional emails (purchase confirmations, password reset links, event details)
- Provide access to content based on your purchase tier
- Respond to your support requests
We do NOT:
- Sell your personal data to anyone
- Use your data for advertising
- Share your data with marketers or data brokers
- Send unsolicited marketing emails (you only receive emails related to what you signed up for)
3. Who Processes Your Data
We use the following third-party services to operate our website and deliver our products. Each processes data only for the specific purpose listed:
| Service | What They Do | Data Location | Their Privacy Policy |
|---|---|---|---|
| Supabase | User authentication, course access, consent logging, and data storage | EU (Frankfurt, Germany) | supabase.com/privacy |
| Stripe | Payment processing and tax calculation | US (with EU data protection) | stripe.com/privacy |
| Resend | Transactional emails (welcome emails, password reset links, event confirmations) | US | resend.com/legal/privacy-policy |
| Hostinger | Website hosting | EU | hostinger.com/privacy |
| Umami | Privacy-friendly, cookieless website analytics: aggregate page views, traffic sources, and button clicks. Sets no cookies, does no cross-site tracking, and collects no personal data. Visitors are counted anonymously. | EU | umami.is/privacy |
| Anthropic (Claude) | AI development tool used to build and operate our systems, the tool taught in the course, and the model behind every AI tool on this site: the quiz, the 10-hour week, the Life Scan, the site assistant, and the Root Scan. What you write in those tools is sent to Anthropic so a reading or an answer can be generated. We use the API, which runs on Anthropic's Commercial Terms; under those terms Anthropic may not train models on customer content. How Anthropic handles API data is documented in its privacy policy and Data Processing Addendum. | US | anthropic.com/privacy |
| AssemblyAI | Voice transcription used in the Root Scan tool. When you tap the microphone, your audio is sent to AssemblyAI to be transcribed into text and is not stored by us. How AssemblyAI handles audio is documented in its privacy policy. | US | assemblyai.com/legal/privacy-policy |
| Google (Gemini) | When you type a question into the site assistant, that question is sent to Google to be turned into a search vector, which is how the assistant finds the right published page. Your quiz answers, scan conversations, and readings are never sent to Google. Separately, our pages load their typeface from Google Fonts, which lets Google see your IP address and browser on any page you open. | US | policies.google.com/privacy |
| Krisp | Meeting transcription for live co-build and coaching sessions (with participant awareness) | US | krisp.ai/privacy-policy |
| Vimeo | Course video hosting | US | vimeo.com/privacy |
We do not transfer your data to any other parties beyond those listed above.
AI-Specific Data Handling
We use Claude (by Anthropic) as a core operational tool. Important details about how your data interacts with this tool:
- We use the Anthropic API, not the consumer chat product. The API runs on Anthropic's Commercial Terms; how Anthropic handles API data is documented in its privacy policy and Data Processing Addendum.
- Under Anthropic's Commercial Terms, Anthropic may not train models on customer content.
- During live co-build sessions, AI tools may process information you share (your business name, goals, preferences) to help build your system in real time. This is a core feature of the service.
- Your course account data (email, purchase tier) may be accessed by AI tools during system operations (e.g., granting course access after purchase).
- Meeting transcripts from live co-build and coaching sessions (via Krisp) may be processed by AI tools to extract action items and update your records. You will be informed when sessions are being transcribed.
- Root Scan tool (voice and chat). The Root Scan tool on this website includes a guided AI conversation with optional voice input. When you tap the microphone, your audio is sent to AssemblyAI for transcription into text and is not stored by us. The transcribed text and any text you type is sent to the Anthropic Claude API to generate a response. Your conversation messages, diagnosis, and results are stored in our Supabase database (EU, Frankfurt) so you can return to your scan and see your results. If you take the scan without being logged in, your scan is linked only to an anonymous session ID; no name, email, or other personal identifier is collected. If you take it while logged in, the scan is linked to your account. Anthropic processes this under its Commercial Terms, which do not permit training on customer content; AssemblyAI processes audio under its own privacy policy, linked above. You can request deletion of your scan data at any time by emailing maaria@thefourlanguages.com.
4. Legal Basis for Processing (GDPR)
If you are in the European Economic Area (EEA), UK, or Switzerland, we process your data based on:
- Contract performance: When you purchase a product or sign up for a service, we process your data to fulfill that agreement (Article 6(1)(b) GDPR)
- Legitimate interest: To respond to support requests and maintain security of our systems (Article 6(1)(f) GDPR)
- Consent: For any optional communications beyond transactional emails. You can withdraw consent at any time (Article 6(1)(a) GDPR)
5. LGPD Compliance (Brazil)
If you are in Brazil, your data is protected under the Lei Geral de Protecao de Dados (LGPD). You have the right to:
- Confirm whether your data is being processed
- Access your data
- Correct incomplete or inaccurate data
- Request anonymization, blocking, or deletion of unnecessary data
- Request data portability
- Request deletion of data processed with your consent
- Know which entities your data has been shared with
- Be informed about the possibility of denying consent and its consequences
To exercise any of these rights, contact us at maaria@thefourlanguages.com.
6. Your Rights (All Users)
Regardless of where you are located, you have the right to:
- Access: Request a copy of the personal data we hold about you
- Correction: Update or correct your information
- Deletion: Request that we delete your account and all associated data
- Portability: Receive your data in a standard, machine-readable format
- Objection: Object to processing based on legitimate interest
- Withdraw consent: For any consent-based processing, at any time
How to exercise your rights: Email maaria@thefourlanguages.com with your request. We will respond within 30 days. You can also use the unsubscribe link in any email to withdraw marketing consent instantly.
7. Data Security
- All data transmitted between your browser and our servers is encrypted (TLS/SSL)
- Database is hosted in the EU (Frankfurt, Germany) and encrypted at rest
- Row Level Security ensures you can only access your own course content and data
- Payment data is handled entirely by Stripe (PCI DSS Level 1 compliant); we never store card numbers
- Passwords are hashed and never stored in plain text
- All unsubscribe links are cryptographically signed (HMAC) to prevent unauthorized changes
- Webhook signatures are verified using constant-time comparison to prevent timing attacks
8. Data Retention
- Course accounts: Your data is retained as long as your account is active. Course access is lifetime for the tier you purchased.
- Event signups: Retained for 12 months after the event, then deleted unless you have an active course account.
- Free resource signups: Retained for 12 months, then deleted unless you have an active course account.
- Purchase records: Financial records are retained for 7 years as required by EU accounting regulations. On deletion request, personal details are anonymized but the transaction record is preserved.
- Consent log: Retained permanently as required by GDPR for audit purposes. Cannot be deleted.
- Account deletion: When you request account deletion, all personal data is permanently removed within 30 days, except where retention is legally required (purchase records, consent log).
9. Cookies
Our website uses only essential cookies required for authentication (keeping you logged in to the course). We do not use:
- Analytics cookies
- Marketing or tracking cookies
- Third-party advertising cookies
No cookie consent banner is required because we only use strictly necessary cookies. For website analytics we use Umami, a privacy-friendly tool that measures aggregate traffic without cookies and without collecting personal data, so under GDPR it does not require consent.
10. International Data Transfers
Our primary data storage is in the EU (Supabase, Frankfurt, Germany). Some of our service providers (Stripe, Resend) are based in the United States. These transfers are protected by:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- The service providers' own data protection agreements
- Adequate security measures as described in Section 7
11. Children
Our products and services are not intended for anyone under 16. We do not knowingly collect personal data from anyone under 16.
12. Changes to This Policy
We may update this policy when our services or legal requirements change. We will notify you of significant changes by email. The "Last Updated" date at the top of this page shows when the policy was last revised.
13. Contact
If you have questions about this Privacy Policy, your data, or want to exercise any of your rights:
Innovation Distributed OU
Registry code: 16434657
Ahtri tn 12, Kesklinna linnaosa
Tallinn 15551, Estonia
Email: maaria@thefourlanguages.com
Website: thefourlanguages.com