Privacy Policy

1. Information We Collect

• Account information. When you create an account, we collect your name, email address, and password (hashed).
• Payment information. Payments are processed by Stripe. We do not store your full card number or CVV. We receive and retain a payment record including billing name, last 4 digits of the card, transaction ID, and subscription status from Stripe.
• Usage data. We collect information about how you use the Service, including lessons viewed, progress milestones, session timestamps, and feature interactions.
• Device and technical data. We automatically collect your IP address, browser type, operating system, and referring URLs when you visit the Service.
• Advertising and analytics identifiers. If you consent to analytics or marketing cookies, we and our advertising partners may set cookies and similar identifiers (such as the Meta Pixel and Google tags) to measure site usage and the performance of our ads. We do not set these until you have given consent.
• Communications. If you contact support or submit feedback, we retain those communications.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account.
• Process your subscription payments.
• Deliver and improve the Service and course content.
• Send transactional emails (receipts, password resets, account notices).
• Send marketing emails if you have opted in (you can opt out at any time).
• Measure and improve our advertising, where you have consented to marketing or analytics cookies.
• Detect and prevent fraud and abuse.
• Comply with legal obligations.

3. Legal Basis for Processing (EU/EEA/UK visitors)

For visitors in the European Economic Area (EEA) or United Kingdom (UK), applicable data-protection law requires us to state a legal basis for each processing activity. The relevant bases are:

Processing activity

Creating and managing your account

Legal basis

Performance of contract -- Art. 6(1)(b) GDPR

Processing activity

Processing subscription payments

Legal basis

Performance of contract -- Art. 6(1)(b) GDPR

Processing activity

Sending transactional emails (receipts, resets, notices)

Legal basis

Performance of contract -- Art. 6(1)(b) GDPR

Processing activity

Delivering and improving the Service and course content

Legal basis

Legitimate interests -- Art. 6(1)(f) GDPR (our interest in providing a working, improving product)

Processing activity

Analytics cookies (e.g. Google Analytics 4)

Legal basis

Your consent -- Art. 6(1)(a) GDPR

Processing activity

Marketing / advertising cookies and CAPI (Meta, Google Ads)

Legal basis

Your consent -- Art. 6(1)(a) GDPR

Processing activity

Hashed-PII sharing with Meta / Google for ad measurement

Legal basis

Your consent -- Art. 6(1)(a) GDPR

Processing activity

Sending marketing emails

Legal basis

Your consent -- Art. 6(1)(a) GDPR

Processing activity

Fraud prevention and security

Legal basis

Legitimate interests -- Art. 6(1)(f) GDPR (our interest in protecting the Service and users)

Processing activity

Complying with legal obligations

Legal basis

Legal obligation -- Art. 6(1)(c) GDPR

Where we rely on legitimate interests, you have the right to object to that processing (see Your Rights).

4. International Data Transfers (EU/EEA/UK visitors)

Ivy & Rill Consulting Inc. is operated in the United States. When you use the Service, your personal data may be transferred to and processed in the United States.

We share certain data with the following US-based third parties and rely on the following transfer mechanisms for transfers from the EEA or UK:

Recipient

Meta Platforms, Inc.

Transfer mechanism

EU-US Data Privacy Framework (adequacy decision -- Commission Implementing Decision 2023/1795); UK Extension to the DPF

Recipient

Google LLC

Transfer mechanism

EU-US Data Privacy Framework (adequacy decision -- Commission Implementing Decision 2023/1795); UK Extension to the DPF

Recipient

Stripe, Inc.

Transfer mechanism

Standard Contractual Clauses (SCCs) / EU-US DPF -- see stripe.com/legal/dpa

Recipient

Supabase

Transfer mechanism

Standard Contractual Clauses (SCCs) -- see supabase.com/privacy

Recipient

Anthropic PBC

Transfer mechanism

Standard Contractual Clauses (SCCs) -- see anthropic.com/legal/dpa

Recipient

Resend, Inc.

Transfer mechanism

Standard Contractual Clauses (SCCs) -- see resend.com/dpa

Recipient

Klaviyo, Inc.

Transfer mechanism

EU-US Data Privacy Framework (adequacy decision -- Commission Implementing Decision 2023/1795); UK Extension to the DPF; Standard Contractual Clauses (SCCs) -- see klaviyo.com/legal/dpa

Recipient

Rewardful (if affiliate programme active)

Transfer mechanism

Standard Contractual Clauses (SCCs) -- see rewardful.com/privacy

You may request a copy of the relevant transfer safeguards by contacting us at hello@timberline.coffee.

5. Information We Share

We do not sell your personal information. We share it only as follows:

• Stripe-- to process and manage subscription payments. Stripe’s privacy policy is at stripe.com/privacy.
• Supabase -- our cloud database and authentication provider stores your account and usage data on our behalf.
• Anthropic PBC— our AI inference provider. When you use AI-powered features on the Service (such as personalized recommendations or interactive tools), the text of your query is sent to Anthropic’s API for processing. We do not send your name, email address, or payment information to Anthropic. Anthropic’s privacy policy is at anthropic.com/privacy.
• Resend, Inc.— our transactional email delivery provider. Resend receives your email address and the content of transactional messages (account confirmations, receipts, password resets) in order to deliver them on our behalf. Resend’s privacy policy is at resend.com/legal/privacy-policy.
• Klaviyo, Inc.— our marketing email platform. If you have opted in to marketing communications, Klaviyo receives your email address and consent status in order to send, track, and manage marketing and onboarding emails on our behalf. You can opt out at any time via the unsubscribe link in any marketing email. Klaviyo’s privacy policy is at klaviyo.com/legal/privacy.
• Rewardful— our affiliate-tracking platform (not yet active). If we launch an affiliate referral programme, Rewardful will receive referral attribution data (cookies and anonymised conversion identifiers) in order to track and pay commissions. If you sign up as an affiliate, your email address will also be shared with Rewardful. Rewardful’s privacy policy is at rewardful.com/privacy.
• Meta (Facebook).If you consent to marketing cookies, we use the Meta Pixel and the Meta Conversions API to measure the performance of our advertising. Any personal data we send to Meta through the Conversions API (such as email or phone) is SHA-256 hashed before it leaves our servers, so Meta does not receive it in readable form. Meta’s data policy is at facebook.com/privacy/policy.
• Google.If you consent to analytics or marketing cookies, we use Google Analytics 4 and Google Ads to understand site usage and measure ad performance. IP addresses are anonymized for analytics. Google’s privacy policy is at policies.google.com/privacy.
• Legal and safety.We may disclose information if required by law, court order, or to protect the rights and safety of Ivy & Rill, our users, or the public.
• Business transfers.If Ivy & Rill is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you in advance.

6. Scout AI and Cross-Border Data Transfer to China

Last updated: June 30, 2026

Groundwork’s Scout AI assistant is powered in part by AI models provided by DeepSeek(Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd., Hangzhou, People’s Republic of China).

What data is sent to DeepSeek.When you use Scout, the text you type into Scout (your prompts) and Scout’s AI-generated responses are processed by DeepSeek’s servers to produce each response. This may include business information you share — descriptions of your coffee shop, questions about operations, financial details, or staffing information you include in your prompts.

Where your data goes. DeepSeek processes and stores this data on servers located in mainland China (Hangzhou). DeepSeek does not offer a hosting option outside China for its hosted API.

Chinese law and government access.Data on servers in mainland China is subject to Chinese national law, including China’s National Intelligence Law (2017), Cybersecurity Law (2017), and Data Security Law (2021). These laws can require DeepSeek to hand data to Chinese government authorities on request. This obligation applies regardless of any agreement between Groundwork and DeepSeek — no contract can override it. We are telling you this plainly because you have the right to know before you use this feature.

Model training. By default, DeepSeek may use Scout prompts and responses to train or improve its AI models. DeepSeek applies de-identification before doing so, but this process is not independently audited. We do not currently have an enforceable mechanism to exclude your data from this use.

If you would like to request that your data not be used for model training, contact us at privacy@groundwork.cafe. We will submit your request to DeepSeek on your behalf. Because no verified opt-out mechanism exists for API customers, we cannot guarantee this request will be honoured, and we will tell you that clearly if we receive a response.

How long your data is kept.DeepSeek has not publicly disclosed a specific retention period for AI API request data. Until we receive written confirmation otherwise, you should treat your Scout data as potentially retained indefinitely on DeepSeek’s servers.

Your options. Scout does not currently offer a model-selection setting that lets you route requests to an alternative AI provider. If we add that capability, we will update this section. In the meantime, if you prefer that your Scout inputs not be processed in China, the current option is to avoid using the Scout AI feature.

Our accountability.Even though DeepSeek processes your data on our behalf, Groundwork (Ivy & Rill Consulting Inc.) remains responsible for your personal information and for how our sub-processors handle it. If you have questions or concerns, contact us at privacy@groundwork.cafe.

For a full list of our sub-processors, see groundwork.cafe/sub-processors.

7. Data Retention

We retain your account information for as long as your account is active, plus up to 3 years after closure for legal and audit purposes. Payment records are retained as required by law (typically 7 years). You may request deletion at any time (see Your Rights below).

Analytics and advertising data is retained only with your consent. Google Analytics user and event data is retained for up to 14 months. Hashed identifiers sent to advertising partners are transmitted for measurement and are not stored by us in a separate profile. Meta and Google retain the data they receive according to their own retention policies. Your consent choice is stored for up to 12 months, after which we ask again.

8. Your Rights

Depending on where you live, you may have rights to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your information.
• Object to or restrict certain processing.
• Export your data in a portable format.
• Opt out of marketing emails at any time via the unsubscribe link or by contacting us.

To exercise any of these rights, email hello@timberline.coffee. We will respond within 30 days.

EEA/UK visitors -- additional rights:

If you are located in the EEA or UK, you also have the right to:

• Lodge a complaint with your local data-protection supervisory authority. In the EU, you can find your authority at edpb.europa.eu/about-edpb/board/members_en. In the UK, the supervisory authority is the Information Commissioner’s Office (ico.org.uk).
• Withdraw consent at any time where we process your data on the basis of consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. To withdraw cookie consent, use the Cookie Preferences link in the site footer, or clear the gw_consent cookie in your browser settings. To withdraw marketing email consent, use the unsubscribe link in any marketing email or contact us.

9. Complaints, Questions, and the Right to File with a Regulator (Canada — PIPEDA)

If you are located in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) gives you the right to raise concerns about how we collect, use, or disclose your personal information.

Step 1 — Contact Groundwork directly.

We ask that you first bring your concern to us so we have the opportunity to address it:

• Email: privacy@groundwork.cafe
• Subject line:“Privacy Complaint — [your name / account email]”
• What to include: A description of the information at issue, the concern you have, and the outcome you are seeking.

We will acknowledge your complaint within 5 business days and provide a written response within 30 calendar days. If we need more time, we will notify you of the extension and the reason for it.

Step 2 — Escalation within Groundwork.

If you are not satisfied with the initial response, you may request escalation to our designated Privacy Officer:

Privacy Officer, Ivy & Rill Consulting Inc. (operating as Groundwork)
Email: privacy@groundwork.cafe
Response time: 30 calendar days from escalation request.

Step 3 — File a complaint with the Office of the Privacy Commissioner of Canada (OPC).

Under PIPEDA s.11, you have the right to file a complaint directly with the OPC at any time. You do not need to contact us first before going to the OPC, although we encourage you to do so.

If our internal process does not resolve your concern, or if you prefer to proceed directly:

Contact method

Online complaint form

Details

priv.gc.ca/en/report-a-concern/

Contact method

Mail

Details

Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3

Contact method

Toll-free (Canada)

Details

1-800-282-1376

Contact method

Fax

Details

819-994-5424

Contact method

TTY

Details

819-994-6591

The OPC will investigate complaints about PIPEDA compliance. Following an OPC investigation, you may also have the right under PIPEDA s.14 to apply to the Federal Court of Canada for a remedy if the matter remains unresolved.

This section applies to personal information processed in connection with commercial activity in Canada. For rights available to residents of the European Union, UK, California, or other jurisdictions, see the relevant sections of this Privacy Policy.

10. Cookies and Your Choices

We group cookies and similar technologies into three categories:

• Necessary. Required to keep you logged in, remember your preferences, and secure the Service. These are always on and cannot be turned off.
• Analytics. Help us understand how the Service is used so we can improve it (for example, Google Analytics). Set only with your consent.
• Marketing. Let us measure the performance of our advertising (for example, the Meta Pixel, the Meta Conversions API, and Google Ads). Set only with your consent.

When you first visit, a banner lets you accept all cookies or choose necessary only. We do not load analytics or marketing cookies until you have made a choice and given consent. You can change your choice at any time by clicking the Cookie Preferences link in the site footer of any page, which will reopen the consent banner. You can also clear the gw_consent cookie in your browser settings, or contact us. Disabling necessary cookies through your browser may affect some Service features.

11. Security

We use industry-standard security measures including encryption in transit (TLS) and at rest, access controls, and regular security reviews. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

12. Children

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at least 14 days before the changes take effect.

14. Contact

Ivy & Rill Consulting Inc.
Email: hello@timberline.coffee