PRIVACY POLICY

Effective Date: 9 November 2026

1. Introduction

This Privacy Policy explains how Do Not Monetize Me collects, uses, stores, and shares personal information when you visit our website, create an account, purchase access, or use our educational product.

The Service is owned and operated by Aleksandr Balin, trading as Do Not Monetize Me, a sole trader based in Scotland, United Kingdom.

For the purposes of applicable data protection laws, Aleksandr Balin is the data controller responsible for the personal information described in this Policy.

Business address: 6 McEwan Walk, Edinburgh, EH3 8FT, United Kingdom
Privacy contact: legal@donotmonetize.me

2. Personal Information We Collect

Account Information

When you create an account, we collect:

• Email address.
• Authentication information necessary to provide account access.
• Sign-in method, such as email and password, Google, or Apple.

We do not currently require additional personal information during registration.

Learning Information

When you use the course, we collect and store:

• Lessons completed.
• Exercise answers.
• Lesson ratings.
• Learning progress and related course activity.

This information is stored in our database and associated with your account so that we can provide course access and maintain your learning progress.

Your exercise answers do not determine which lessons or content you see. Users follow the same course sequence.

We do not send the text of your exercise answers to Google Analytics, PostHog, or Meta Pixel.

Purchase and Access Information

We receive and store information needed to manage your access, including:

• Purchased access plan.
• Access start and expiration dates.
• Subscription status.
• Payment and transaction references.
• Access entitlements.

Payment card details are handled by Stripe. We do not store card numbers or card security codes in our own database.

Billing addresses are not stored in our Lovable Cloud database. Stripe may collect billing or payment information directly through its checkout process.

Cookie Consent Information

We maintain records of your cookie and tracking preferences. These records may include:

• Date and time of your choice.
• Categories of technologies accepted or rejected.
• Changes to your preferences or withdrawal of consent.
• IP address associated with the consent record.

We retain cookie consent records and associated IP addresses for up to five years after the last change to your preferences, after which they are deleted or anonymized.

Technical Information

Our website, hosting provider, and third-party technologies may automatically collect technical information such as IP address, browser type, device information, timestamps, and technical logs.

The exact technical logs collected depend on the configuration of Lovable Cloud and the third-party services used. We will update this Policy if our actual collection practices materially differ from the description above.

3. How We Use Personal Information

We use personal information for the following purposes:

| Purpose | Examples | |---|---| | Account management | Registration, authentication, password reset, account updates | | Service delivery | Providing course access and displaying lessons | | Learning progress | Saving completed lessons, exercise answers, and ratings | | Payments and subscriptions | Managing access entitlements and subscription status | | Transaction administration | Matching purchases and transaction records | | Product analytics | Understanding aggregate product usage and improving the Service | | Advertising | Retargeting and measuring advertising performance | | Cookie management | Recording and applying your tracking preferences | | Legal compliance | Maintaining records and responding to valid legal requests |

We do not use personal information for direct email marketing.

We do not use personal information to train AI models and do not provide user information to third-party AI services for model training.

We do not use exercise answers to personalize course content.

4. Legal Bases for Processing

Where UK GDPR or EU GDPR applies, we rely on the following legal bases, as appropriate:

• Contract: to create and manage your account, provide course access, store your learning progress, and administer purchases.
• Legal obligation: to retain financial and other records where required by law.
• Consent: for optional cookies, analytics technologies, and advertising tracking where consent is required.
• Legitimate interests: to administer the Service, maintain account records, and manage essential business operations, where those interests are not overridden by your rights and freedoms.

You may withdraw consent at any time. Withdrawal does not affect processing that took place before withdrawal.

5. Service Providers and Other Recipients

We use third-party providers to operate the Service.

Lovable Cloud

We use Lovable Cloud for website hosting, database storage, and account authentication.

Our intended hosting region is Europe. The actual project region must be confirmed in the Lovable Cloud settings before this Policy is published.

Resend

We use Resend to send transactional account emails, including:

• Registration messages.
• Sign-in messages.
• Password reset messages.
• Other account-related service communications.

Stripe Managed Payments

We use Stripe Managed Payments for checkout, payments, recurring billing, receipts, transaction support, refunds, disputes, and applicable indirect tax handling.

Stripe sends purchase confirmations, receipts, payment notifications, and subscription renewal notices.

Stripe may process payment and billing information directly. Stripe also processes personal data under its own contractual and privacy terms.

Google Analytics

We use Google Analytics for product analytics. It helps us understand how visitors use the website and product.

Google Analytics events are not intentionally linked to individual user accounts. We do not send exercise answer text or lesson content to Google Analytics.

PostHog

We use PostHog for product analytics. It helps us understand product usage and improve the Service.

Before you sign in, PostHog events are not linked to an account. After you sign in, events are linked to your internal account ID so we can understand how the course is used. We do not send your email address to PostHog. We do not send exercise answer text or lesson content to PostHog.

Meta Pixel

We use Meta Pixel for advertising measurement, retargeting, and campaign optimization.

Meta Pixel may receive:

• Standard website and advertising events, such as page views, checkout initiation, and purchases.
• Transaction value.
• Transaction currency.
• A transaction ID.

We do not intentionally send the following information to Meta Pixel:

• Email addresses.
• Exercise answers.
• Lesson content.
• Learning progress.
• Purchased plan names.

Meta Pixel may collect technical and browser information through its own technology, including information such as IP address, browser identifiers, and cookie identifiers.

We do not currently use Meta Conversions API or Advanced Matching.

Future Advertising Tools

Google Ads Remarketing and Enhanced Conversions may be introduced in the future. Server-side advertising event transmission may also be introduced.

These tools are not described as currently active. If we introduce them, we will update this Policy and obtain any required consent before activating relevant tracking or data transfers.

6. Cookies and Similar Technologies

We use cookies and similar technologies for essential website functions, analytics, and advertising.

Our cookie consent interface provides the following choices:

• Accept all.
• Reject optional.
• Cookie settings.

Strictly necessary technologies may be used where required to provide the website and account functions you request.

Optional analytics and advertising technologies will remain disabled until you provide consent where required by applicable law.

You can change or withdraw your preferences at any time using the Cookie Settings link in the website footer.

We will respect Global Privacy Control (GPC) signals where required by applicable US privacy laws.

7. Advertising and Sharing

We do not sell personal information for money.

However, certain disclosures of browser or transaction information to advertising platforms, including Meta, may be treated as "sharing" or targeted advertising under some US state privacy laws.

Where applicable, you may opt out of such processing. We will honor valid Global Privacy Control signals where required.

8. International Data Transfers

Our business is based in the United Kingdom, and our intended hosting region for Lovable Cloud is Europe.

Our service providers may process personal information in other countries, including countries outside the UK or European Economic Area.

Where applicable law requires safeguards for international transfers, we will use an appropriate transfer mechanism, such as an adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another legally recognized safeguard.

The specific locations and transfer mechanisms depend on the providers' current infrastructure and contractual arrangements.

9. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, subject to legal obligations.

Our current retention approach is:

| Data | Retention | |---|---| | Active account and learning data | Until you delete your account | | Data in operational systems after account deletion | Deleted within 30 days | | Backup copies after account deletion | Deleted within 90 days | | Financial and tax records | Retained separately for the period required by law | | Cookie consent records and associated IP addresses | Up to five years after the last preference change | | Inactive accounts | Retained until you delete them; no automatic inactivity deletion |

We may retain limited information for longer where required by law, to resolve disputes, or to establish or defend legal claims.

10. Account Deletion

You can delete your account through the account settings.

After you confirm deletion:

• Account deletion begins immediately.
• Access to the account and course ends immediately.
• Any active recurring subscription is automatically cancelled.
• Future subscription charges stop.
• Operational account data is deleted within 30 days.
• Backup copies are deleted within 90 days.

Financial records may be retained separately where required by law.

Deleting your account does not automatically entitle you to a refund for unused access time. This does not affect mandatory statutory rights.

11. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

• Request access to your personal information.
• Request correction of inaccurate information.
• Request deletion of personal information.
• Request restriction of processing.
• Object to certain processing.
• Request portability of information.
• Withdraw consent where processing is based on consent.
• Opt out of certain advertising-related processing.
• Appeal certain privacy decisions where applicable law provides that right.

To exercise a privacy right, contact:

legal@donotmonetize.me

We may need to verify your identity before responding.

We will respond within the time required by applicable law. Where a request is complex or multiple requests are made, the law may allow an extension.

You may also complain to the relevant data protection regulator, including the UK data protection regulator or the supervisory authority in your country of residence.

12. US State Privacy Rights

Residents of certain US states may have additional rights under applicable state privacy laws.

These may include rights to access, correct, delete, obtain a copy of personal information, and opt out of certain targeted advertising or data-sharing activities.

The availability and scope of these rights depend on the relevant law and whether it applies to our business and processing activities.

We will honor applicable opt-out rights and valid Global Privacy Control signals.

13. Children

The Service is intended for adults aged 18 and older.

We do not knowingly offer the Service to anyone under 18. We do not currently perform separate age verification during registration or checkout.

If you believe a person under 18 has provided personal information to us, contact legal@donotmonetize.me.

14. Security

We use third-party infrastructure and reasonable technical and organizational measures designed to protect personal information.

No website, database, or electronic transmission can be guaranteed to be completely secure.

We do not currently offer separate two-factor authentication.

15. Changes to This Policy

We may update this Privacy Policy from time to time.

The updated version will be published on our website with a revised Effective Date. If a change materially affects how we process personal information, we will provide additional notice where required by law.

16. Contact

For privacy questions or requests, contact:

Aleksandr Balin trading as Do Not Monetize Me
6 McEwan Walk
Edinburgh, EH3 8FT
United Kingdom

Email: legal@donotmonetize.me