Privacy Policy

Effective date: October 22, 2026 Last updated: October 22, 2026

1. Introduction

This Privacy Policy explains how mDev Mikołaj Sobieszczański ("we," "us," or "our") collects, uses, discloses, and protects personal data in connection with the website located at https://influglow.com (the "Site") and the online course and related digital products offered through it (collectively, the "Services").

We are the controller of the personal data described in this Policy within the meaning of Regulation (EU) 2016/679 (the "GDPR") and, where applicable, the United Kingdom General Data Protection Regulation as retained in UK law (the "UK GDPR").

By accessing the Site or purchasing access to the Services, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described here, please do not use the Services.

2. Controller identity and contact details

Controller: mDev Mikołaj Sobieszczański Registered address: Pl. Solny 14 lok. 3, 50-062 Wrocław, Poland Email: hello@influglow.com

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR. All privacy inquiries, rights requests, and complaints should be directed to the email address above.

3. Scope of this Policy

This Policy applies to personal data we process when you:

• visit or browse the Site;
• purchase access to the course or to any other digital product we offer, which you can do before you have an account;
• create an account in order to access the Services;
• access course materials, including audio lessons; or
• contact us by email.

This Policy does not apply to third-party websites, platforms, or services that we link to or reference within our content. Those services operate under their own privacy policies, and we encourage you to review them.

4. Categories of personal data we collect

4.1 Account data

When you create an account, our authentication provider, Clerk, Inc. ("Clerk"), collects and stores on our behalf:

• your email address;
• your first name, where you choose to provide it;
• your password, stored in hashed form (we never have access to your password in plain text);
• a unique account identifier;
• account creation date, last sign-in date, and sign-in history;
• the IP address and device or browser information associated with your sign-in events.

4.2 Payment and billing data

All payments are processed by Stripe. Depending on your location, your payment is handled by Stripe, Inc. or by Stripe Payments Europe, Limited (collectively, "Stripe").

Payments are taken through Stripe Checkout, a payment page hosted by Stripe. We do not receive, process, or store your full payment card number, card expiry date, or card security code at any time. Those details are transmitted directly from your browser to Stripe.

In connection with a purchase, Stripe collects and processes, and shares with us in summarized form:

• your name as provided at checkout;
• your email address;
• your billing address, including country;
• the last four digits of your payment card, the card brand, and the country in which the card was issued;
• the transaction amount, currency, date, and status;
• for installment purchases, the payment schedule and the status of each scheduled payment;
• your IP address at the time of the transaction.

We also collect and retain the location evidence required by applicable value added tax rules for electronically supplied services, which may include your billing country, the country of your card issuer, and your IP address.

Stripe issues transaction documents directly to your email address: a receipt for one-time purchases, and an invoice following each successful payment under an installment plan. Separately, we send you a confirmation email of our own after your payment, containing the link through which you set up your account and reach the course.

Purchases made before you have an account. You can pay before creating an account. In that case we keep a record of the purchase in our database: the email address you gave at checkout, the plan you chose, the amount and currency charged, the identifiers Stripe assigns to the checkout session, to you as its customer and, for installment purchases, to the payment schedule, and a random code that lets the purchase be attached to an account. That code reaches you in two places only: the page you are returned to after paying, where it is held in a cookie rather than in the page address (see Section 6.1), and the confirmation email. When you set up your account you may use a different email address from the one given at checkout. If the checkout address already belongs to an account, we attach the purchase to that account automatically.

Stripe additionally acts as an independent controller for certain purposes, including fraud prevention and compliance with its own legal obligations. Please refer to the Stripe Privacy Policy at https://stripe.com/privacy for details of that processing.

4.3 Course access data

Following a successful payment, we record the status and scope of your entitlement to the Services. This information is stored against your account record at Clerk, and a copy is kept in our database together with a record of each payment you make, its amount, currency and status, and your Stripe customer identifier. It includes the product purchased, the date access was granted, the date on which access expires, and, for installment purchases, whether the entitlement remains current as each scheduled payment is taken.

4.4 Technical data

When you access the Site, our hosting provider and our content storage provider automatically collect technical information generated by your browser, including your IP address, the date and time of your request, the pages or files requested, HTTP status codes, referring URL, user agent string, and approximate location derived from your IP address.

Audio lessons are stored in a private bucket and delivered to your browser through short-lived signed links. Requests for those files generate the same categories of technical data described above.

4.5 Correspondence

If you contact us by email, we process the content of your message, your email address, and any information you choose to include, together with our reply.

4.6 Marketing preferences and consent records

If you choose to receive marketing email from us, we record that choice against your account and keep in our database a separate, append-only record of each time you give or withdraw it. That record contains your account identifier, the categories you agreed to, the legal basis on which we were entitled to write to you, the country used to determine that basis, the version of the consent wording you were shown, and the date and time. Where a salt is configured for that purpose, it also contains a salted, irreversible hash of the IP address from which the choice was submitted; we never store the address itself. We keep these records because Article 7(1) of the GDPR places on us the burden of demonstrating that consent was given.

We also process your email address, your first name where you have provided it, and delivery and engagement data generated by our email provider, such as whether a message was delivered, opened, or reported as spam. For as long as you are subscribed, we keep in our database a copy of the email address you are subscribed under, linked to your account identifier, so that we can take you off the list if your account is deleted.

4.7 Cookie choices, usage and advertising data

When you visit the Site or the academy at https://academy.influglow.com, we record the choice you make about cookies in a cookie on your device, together with a random identifier generated for that choice. Each time you make or change that choice, we also keep in our database a separate, append-only record containing that identifier, the categories you allowed or refused, whether the choice was made by clicking or by a Global Privacy Control signal sent by your browser, which of the two websites it was made on, the country used to decide how you were asked, the version of the wording you were shown, the date and time, your account identifier where you were signed in to the academy at the time, and, where a salt is configured for that purpose, a salted, irreversible hash of your IP address.

Where you allow it, or where the law that applies to you permits it until you object, as described in Section 6, analytics and advertising technologies collect information about your visit: the pages you view, how you arrived at them, clicks, scrolling and other interactions, the approximate location derived from your IP address, device and browser characteristics, cookie and advertising identifiers, and whether a visit led to a purchase, including the type of plan purchased and its value. Some of Google's measurement also runs, without cookies or identifiers, when you have not allowed it, as described in Section 6.1.

4.8 Data we do not collect

We do not knowingly collect special categories of personal data within the meaning of Article 9 of the GDPR, and we ask that you do not send such information to us. We do not purchase personal data from data brokers, and we do not enrich or append your account record with data obtained from external sources.

5. Purposes of processing and legal bases

We process personal data only where a valid legal basis applies. The following table sets out each purpose and the corresponding legal basis under Article 6(1) of the GDPR and the UK GDPR.

Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interests are not overridden by your interests or fundamental rights and freedoms. You have the right to object to such processing as described in Section 12.

Marketing email is never sent to anyone who has not been shown the choice. Consent is requested through a checkbox that is separate from, and never bundled with, acceptance of our Terms of Service, and it can be changed at any time in your account settings, under Email Preferences. Creating an account does not by itself subscribe you to anything.

How that checkbox is presented depends on where you are when you create your account. If you are in the European Economic Area or the United Kingdom, or in any other country whose law requires consent before commercial email may be sent, the box is empty and you are subscribed only if you tick it yourself. Where local law permits commercial email to be sent without prior consent, the box is presented already ticked and you may untick it before your account is created; at present we apply this only to the United States, under the CAN-SPAM Act of 2003. In either case the choice is visible on the form, it is never hidden or pre-selected for anyone whose law requires consent first, and unticking it is a single click.

Which of the two applies is determined from the country associated with your IP address at the moment of sign-up. Where that country cannot be determined, or is one we do not recognise, we ask for consent. We record which basis applied to you, together with the country used to reach that conclusion, so that we can demonstrate afterwards on what footing we were entitled to write to you.

Withdrawing consent stops marketing email only. Messages about your purchase, your access to the Services, and your account are sent on the basis of our contract with you rather than your consent, and are not something you can be unsubscribed from for as long as that contract is in force. Marketing and service email are sent from separate subdomains so that the two remain distinguishable.

We do not share your email address with anyone for their own marketing, and we do not upload lists of our customers to any advertising platform. The one use of your email address in advertising is measurement: where you allow advertising, or where it is active under Section 6.2 until you object, completing a purchase sends Google, Meta and TikTok an irreversible SHA-256 hash of the email address given at checkout, never the address itself. Each of them compares it with the hashed addresses of its own users in order to tell us whether the purchase followed one of our ads; Google calls this enhanced conversions. How the hash reaches Meta and TikTok is described in Section 6.1. Advertising based on your visits to the Site and the academy takes place only through the technologies described in Section 6, and only as that Section allows.

6. Cookies and similar technologies

We use cookies and similar technologies, such as pixels and scripts that store identifiers in your browser, in three categories. The same choice covers both the Site and the academy at academy.influglow.com, so you only need to make it once.

6.1 Categories

Strictly necessary. These are needed for the Site and the Services to work, and cannot be switched off. They do not require consent under Article 5(3) of Directive 2002/58/EC or under the Privacy and Electronic Communications Regulations 2003.

Analytics. These tell us which pages are visited, how visitors move through them and where they run into difficulty, so that we can improve the course and the websites. Hotjar may record interactions with a page, such as clicks, mouse movement and scrolling, in order to reconstruct how it was used; it is configured not to record what you type into form fields.

Advertising. These let Google, Meta and TikTok measure whether our ads led to a visit or a purchase, and help show our ads to people likely to be interested in them, including people similar to our visitors.

Google Consent Mode. Google Analytics and Google Ads receive your choices through Google Consent Mode, and their tags load on both websites whatever you choose. While a category is not allowed, including before you have chosen, those tags set and read no cookies and send no cookie or advertising identifier. They still send Google limited signals: that a page was viewed or a purchase was made, and if so its value, together with the time, the address of the page, and technical data such as browser type and the approximate location derived from your IP address. Google uses these signals only to estimate, in aggregate, how many visits and ad conversions took place that could not be measured directly. They are not used to recognise you across visits or to show you ads.

Meta and TikTok. The Meta Pixel and the TikTok Pixel work differently: they do not load at all, and send nothing whatsoever, while advertising is not allowed. There is no cookieless equivalent for them.

Meta Conversions API. When you allow advertising and then complete a purchase, we also send that purchase to Meta from our server rather than from your browser, so that a purchase is still measured when an ad blocker or a browser privacy setting prevents the pixel from reporting it. That transmission carries the same purchase event, the identifiers in the _fbp and _fbc cookies described above, your IP address and browser type, and your email address in an irreversibly hashed form, which lets Meta recognise a purchase as belonging to someone who saw our ad. Your email address itself is never sent. Each purchase carries an identifier that lets Meta discard whichever copy reaches it second, so the two transmissions are one purchase and not two. While advertising is not allowed, nothing is sent this way either.

TikTok Events API. We do the same for TikTok. When you allow advertising and then complete a purchase, that purchase is also sent to TikTok from our server, so that it is still measured when an ad blocker or a browser privacy setting prevents the pixel from reporting it. That transmission carries the same purchase event, the identifiers in the _ttp cookie described above and in the click identifier TikTok adds to the address when you arrive from one of our ads, your IP address and browser type, and your email address in an irreversibly hashed form, which lets TikTok recognise a purchase as belonging to someone who saw our ad. The TikTok Pixel's own report of the purchase, sent from your browser, carries the same hash. Your email address itself is never sent. Each purchase carries an identifier that lets TikTok discard whichever copy reaches it second, so the two transmissions are one purchase and not two. While advertising is not allowed, nothing is sent this way either.

6.2 How we ask, depending on where you are

European Economic Area, United Kingdom, Switzerland, and everywhere else not listed below. Before any analytics or advertising technology runs, we show a notice at the bottom of the page in which you can accept all categories, reject all of them with a single click, or choose individually. No optional cookie is set or read until you have chosen, and rejecting is as easy as accepting. The only optional technology active before then, or after you reject, is the cookieless Google measurement described in Section 6.1. Where we cannot determine your country, we treat you in this way.

United States, Canada and Australia. Where the law that applies to you permits these technologies to be used until you object, analytics and advertising are active from your first visit, and you can switch either or both off at any time through the "Your Privacy Choices" link at the bottom of every page. If your browser sends a Global Privacy Control signal and you have not made a choice, we treat the signal as a request to switch off both analytics and advertising, and we do so before either runs.

Which of the two applies is determined from the country associated with your IP address when you visit.

6.3 Changing or withdrawing your choice

You can change your choice at any time, on either website, through the "Your Privacy Choices" link at the bottom of every page of the Site, at the bottom of the academy's sign-in and pricing pages, and on the My Account page in the academy. Withdrawing consent stops the technology concerned from that moment and deletes the cookies it set on our domains; it does not affect processing that took place before. We ask for your choice again after 6 months, and sooner if we add a new category or technology.

Most browsers also allow you to block or delete cookies through their settings. Blocking strictly necessary cookies will prevent you from signing in and accessing the Services.

7. Automated decision-making and profiling

Stripe applies automated risk scoring to payment transactions in order to detect and prevent fraud. This assessment may result in a transaction being declined. This processing is carried out for the purposes of fraud prevention and is necessary for the performance of the contract between you and us, and for compliance with the legal obligations to which Stripe is subject.

If a transaction of yours is declined by these means, you may contact us at hello@influglow.com to request human review of the decision, to express your point of view, and to contest the outcome.

We do not carry out any other automated decision-making that produces legal effects concerning you or that similarly significantly affects you. Where you allow advertising technologies, or where they are active under Section 6.2 until you object, Google, Meta and TikTok may use information about your visits to decide which of our ads to show you and to whom; this does not produce legal or similarly significant effects, and you can stop it at any time through "Your Privacy Choices".

8. Recipients of personal data

We disclose personal data to the following categories of recipients, each of which acts as our processor under a written data processing agreement, except where indicated otherwise.

We do not sell personal data for money. Apart from the analytics and advertising technologies described in Section 6, which you control there, we do not disclose personal data to third parties for their own independent marketing purposes.

In the event that our business, or any part of it, is transferred, merged, or acquired, personal data may be transferred to the acquiring party. We will notify you of any such transfer and of any resulting change to this Policy.

9. International transfers

Several of our service providers are established in the United States, or process data on infrastructure located outside the European Economic Area and the United Kingdom. Where personal data is transferred outside the EEA or the UK, we rely on one or more of the following safeguards:

• the adequacy decision adopted by the European Commission in respect of the EU-US Data Privacy Framework, and the UK Extension to that framework, where the recipient is certified under it;
• Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) of the GDPR, together with the UK International Data Transfer Addendum where the transfer is subject to the UK GDPR;
• supplementary technical and organizational measures where our transfer risk assessment identifies them as necessary.

You may request further information about the safeguards applied to a specific transfer, and a copy of the relevant documentation, by writing to hello@influglow.com.

10. Retention periods

We retain personal data only for as long as necessary for the purposes for which it was collected, or for as long as required by law.

Where we are required to retain certain records by law, the deletion of your account will not remove those records. In such cases we restrict processing of the retained data to the purpose that requires its retention.

11. Security

We implement technical and organizational measures appropriate to the risk, including:

• encryption of data in transit using TLS across the Site and all connections to our service providers;
• storage of passwords in hashed and salted form by our authentication provider, with no access to plain text passwords by us;
• storage of course audio files in a private bucket that is not publicly accessible, with delivery only through short-lived signed links issued to authenticated users;
• role-based access control and multi-factor authentication on the administrative accounts we hold with our service providers;
• selection of service providers that maintain recognized security certifications and contractual security commitments.

No method of transmission or storage is entirely secure. While we take the protection of your personal data seriously, we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 of the GDPR.

12. Your rights

Subject to the conditions and exceptions set out in the GDPR and the UK GDPR, you have the following rights:

• Right of access (Article 15). To obtain confirmation as to whether we process personal data concerning you, and to receive a copy of that data together with the information set out in this Policy.
• Right to rectification (Article 16). To have inaccurate personal data corrected and incomplete data completed. You may correct most account information directly within your account settings.
• Right to erasure (Article 17). To obtain the deletion of your personal data where one of the grounds in Article 17(1) applies. This right does not extend to data we are required by law to retain.
• Right to restriction of processing (Article 18). To require that we limit our processing of your personal data in the circumstances specified in that Article.
• Right to data portability (Article 20). To receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to have that data transmitted to another controller where technically feasible.
• Right to object (Article 21). To object at any time, on grounds relating to your particular situation, to processing carried out on the basis of our legitimate interests.
• Right to withdraw consent (Article 7(3)). Where processing is based on consent, to withdraw that consent at any time, and to do so as easily as it was given. For marketing email you can do this yourself at any moment, either through the unsubscribe link carried in every such message or under Email Preferences in your account settings; for cookies and similar technologies, through the "Your Privacy Choices" link described in Section 6.3. No request to us is needed. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint. As set out in Section 15 below.

How to exercise your rights. Send your request to hello@influglow.com from the email address associated with your account. We may ask you for additional information in order to verify your identity where we have reasonable doubts as to who is making the request. We respond within one month of receipt. That period may be extended by up to two further months where the request is complex or where we have received a number of requests, in which case we will inform you of the extension and the reasons for it within the first month. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

Account deletion. To delete your account, send a request to hello@influglow.com from the email address associated with the account. Upon verification, we delete your account and the associated account data from our authentication provider, and remove your address from our marketing list if you were on it. Records of your purchases and payments, the customer record held by Stripe, and consent records are retained as set out in Section 10; your account identifier remains in them but no longer leads to an account, and your access is recorded as ended. Please note that deletion of your account terminates your access to the Services, including any remaining period of paid access, and does not entitle you to a refund except as provided in our Terms of Service or as required by applicable consumer law. Accounting and tax records relating to your purchase are retained as set out in Section 10.

13. Age requirement

The Services are intended solely for individuals aged 18 or over. We do not knowingly collect personal data from anyone under the age of 18. By purchasing access or creating an account, you represent that you are at least 18 years old.

If you believe that a person under the age of 18 has provided us with personal data, please contact us at hello@influglow.com. We will delete the account and the associated data promptly upon verification.

14. Additional disclosures for California residents

The following section applies to residents of the State of California, to the extent that the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), applies to our processing. Terms used in this section have the meanings given to them in the CCPA.

Categories of personal information collected. In the preceding twelve months we have collected the following categories of personal information, as described in detail in Section 4: identifiers, including name, email address, account identifier, and IP address; commercial information, including records of products purchased and transaction history; internet or other electronic network activity information, including server log data, pages viewed, interactions with the Site and the academy, and cookie and advertising identifiers; inferences drawn by advertising partners about interest in our products; and geolocation data, limited to approximate location inferred from IP address and to billing country.

Sources. We collect personal information directly from you, automatically from your device when you use the Site, and from our service providers, namely our authentication provider, our payment processor, and our analytics providers.

Business purposes. We use personal information for the purposes set out in Section 5.

Sensitive personal information. We do not collect or process sensitive personal information as defined by the CCPA.

Sale and sharing. We do not sell personal information for money. When advertising technologies are active, Google, Meta and TikTok receive identifiers, internet activity and purchase events from the Site and the academy, and use them in part for their own purposes. This may constitute "selling" or "sharing" personal information for cross-context behavioral advertising within the meaning of the CCPA. The categories concerned are identifiers, internet or other electronic network activity information, commercial information limited to purchase events, and inferences. We do not knowingly sell or share the personal information of consumers under 16 years of age.

Your rights. Subject to the CCPA, you have the right to know what personal information we have collected about you and how we have used and disclosed it; the right to request deletion of your personal information; the right to request correction of inaccurate personal information; the right to opt out of the sale or sharing of personal information; and the right not to receive discriminatory treatment for exercising any of these rights. We do not offer financial incentives in exchange for personal information.

Opting out of sale and sharing. Use the "Your Privacy Choices" link at the bottom of any page of the Site or the academy and switch off Advertising. Your choice takes effect immediately in that browser, applies to both websites, and does not require an account or any other information from you.

Submitting a request. Send your request to hello@influglow.com. We verify requests by matching the email address used to submit the request against the email address held on your account, and we may request further information where necessary. An authorized agent may submit a request on your behalf on provision of written authorization signed by you, and we may require you to verify your identity directly.

Opt-out preference signals. We honour Global Privacy Control. If your browser sends the signal and you have not made a choice through "Your Privacy Choices", we treat it as a valid request to opt out of sale and sharing, and we switch off both advertising and analytics in that browser before either runs. If you later switch a category back on through "Your Privacy Choices", we treat that more specific choice as prevailing. We do not respond to browser "Do Not Track" signals, as no common standard for their interpretation has been established.

15. Complaints

If you have a concern about how we handle your personal data, we ask that you contact us first at hello@influglow.com so that we may address it directly.

You also have the right to lodge a complaint with a supervisory authority.

Poland, and our lead supervisory authority for the purposes of the GDPR: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) ul. Stawki 2, 00-193 Warsaw, Poland https://uodo.gov.pl

European Economic Area: You may lodge a complaint with the supervisory authority of the Member State of your habitual residence, your place of work, or the place of the alleged infringement.

United Kingdom: Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom https://ico.org.uk

16. Changes to this Policy

We may amend this Policy from time to time in order to reflect changes to our Services, to the technologies we use, or to applicable law. The date at the top of this document indicates when it was last revised.

Where a change is material, we will notify registered users by email or by a prominent notice on the Site before the change takes effect. Your continued use of the Services after the effective date of a revised Policy constitutes acceptance of that revision, except where your consent is required by law, in which case we will obtain it separately.

17. Contact

Questions, requests, and complaints relating to this Policy should be addressed to:

mDev Mikołaj Sobieszczański Pl. Solny 14 lok. 3 50-062 Wrocław Poland hello@influglow.com