The short version
- We collect what we need to sell you ebooks, run coaching sessions, answer your messages and keep your account working.
- We do not sell your personal information and we don’t use advertising cookies or targeted ads.
- Analytics (Google Analytics and our own anonymous visitor counts) only runs with your consent where that’s required, and you can turn it off anytime in . We honor Global Privacy Control.
- You can download or delete your data yourself from your Account page, or email us.
This policy explains how Sydney Stephenson, DC (“we”, “us”) handles personal information on dr.sydneystephensondc.com and related services (ebook store, online reader, coaching bookings and contact form). We are the “controller” (GDPR) / “business” (CCPA) for this information.
What we collect
- Account details: name, email, password (stored securely by Google Firebase — we never see it), or your Google sign-in.
- Profile (optional): photo, location, Instagram handle, an “about you” note, interests and whether you want email updates.
- Purchases: what you bought, amount, date and download count. Card details are entered on Stripe’s secure page and are never stored by us.
- Coaching bookings: session, time, your name, email, phone (if needed), time zone and any notes you choose to share.
- Messages: what you send through the contact form.
- Reading data: your place in each ebook and reader settings, so you can pick up where you left off.
- Usage (only with analytics allowed): pages viewed, referring site, device type and approximate location (from Google Analytics). Our own visitor counter stores no names, emails or IP addresses.
- Security data: limited technical information (such as a hashed request fingerprint) used to prevent spam and fraud.
How we use it
- To provide what you asked for — your account, purchases, ebook access, bookings, reminders and replies (GDPR: performance of a contract).
- To keep the site secure and prevent fraud and abuse (legitimate interests).
- To understand which pages are useful and improve the site (your consent, where required).
- To send updates about new ebooks or coaching openings — only if you opt in (consent; unsubscribe anytime).
- To keep business, tax and accounting records (legal obligation).
Cookies and similar technologies
We keep this minimal. Change your choices anytime in .
| What | Type | Why |
|---|---|---|
| Sign-in (Firebase) | Necessary | Keeps you signed in (browser storage). |
| Bag, reader position & settings | Necessary | Remembers what you added and where you were reading. |
Cookie choice (ss-consent) | Necessary | Remembers your privacy choices for 12 months. |
| Security check (Google reCAPTCHA) | Necessary | Protects sign-in, checkout and forms from bots. |
| Stripe checkout | Necessary | Set by Stripe on its own payment page for fraud prevention. |
Google Analytics (_ga, _ga_*) | Analytics | Counts visits and pages. Up to 2 years. Only with your choice. |
Visitor counter (ss-sid, ss-visit) | Analytics | Anonymous visit counts and “people on the site now”. Cleared when you close the tab. |
Fonts are hosted on our own site, and we don’t embed social media widgets, so visiting a page doesn’t contact Google Fonts, Instagram or Facebook.
Who we share it with
Only with service providers who process data on our behalf, under contracts that limit how they can use it:
- Google (Firebase / Google Cloud): hosting, accounts, database, file storage and security checks.
- Stripe: payments, refunds and receipts.
- Google Analytics: site analytics (only with your choice). Google signals and ad features are off.
- Google Calendar: booked sessions appear on Sydney’s calendar, with a Google Meet link when the session uses Meet.
- Resend: sends booking confirmations and reminders.
- Zoom: if your session is on Zoom, Zoom’s own privacy policy applies during the call.
We may also disclose information if required by law or to protect rights and safety. If the business is ever sold, your information would transfer under this policy.
Health information
Our ebooks and coaching are educational and are not medical care, and we are not a HIPAA “covered entity” for these services. You may choose to mention health details (for example, an injury) in booking notes; we use that only to prepare for your session and you can ask us to delete it anytime. Please don’t send medical records or urgent health concerns through the website.
How long we keep it
- Account, profile and library: until you delete your account.
- Order and payment records: as long as tax law requires (typically 7 years), unlinked from your account if you delete it.
- Bookings: up to 3 years after the session, for scheduling history and records.
- Messages: up to 2 years, or sooner on request.
- Analytics: Google Analytics data for 14 months; our own counts are anonymous daily totals.
Your rights and choices
- Access / download: Account → Download my data.
- Correct: edit your profile on your Account page, or email us.
- Delete: Account → Delete account, or email us.
- Analytics: — or turn on Global Privacy Control in your browser.
- Marketing emails: untick the option on your Account page, or use the unsubscribe link in any marketing email.
We respond to requests within 30 days (GDPR) or 45 days (US state laws) and won’t treat you differently for exercising your rights. We may need to verify your identity, usually by confirming your email address.
California and other US states
Under the CCPA/CPRA and similar laws (Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others), you have the right to know, access, correct and delete your personal information, to opt out of its “sale” or “sharing” for cross-context behavioral advertising, and to limit use of sensitive information.
- We do not sell or share personal information for cross-context behavioral advertising, and have not in the past 12 months. We don’t knowingly sell or share data of anyone under 16.
- Categories we collect: identifiers (name, email), customer records (purchase and booking history), commercial information, internet activity (with analytics on), approximate geolocation (from analytics), and any health details you choose to include in booking notes (sensitive, used only to provide the session).
- Sources: you, and your use of the site. Purposes and recipients are described above.
- Your Privacy Choices: use to opt out of analytics. We honor the Global Privacy Control signal as an opt-out request.
- You may use an authorized agent; we’ll ask for proof of their authority.
EU / UK visitors
We rely on the legal bases listed under “How we use it”. You also have the right to object, to restrict processing, to data portability, and to withdraw consent at any time (without affecting earlier processing). Our providers store data in the United States; transfers are protected by the EU–US Data Privacy Framework and/or Standard Contractual Clauses. You can complain to your local data protection authority, though we’d appreciate the chance to help first.
Children
This site isn’t directed to children under 16, and we don’t knowingly collect their information. If you believe a child has given us information, contact us and we’ll delete it.
Security
Data is encrypted in transit, ebook files are only reachable through short-lived private links, payments are handled by Stripe, and access to admin tools is limited. No system is perfectly secure, but we work to protect your information.
Changes
If we make material changes, we’ll update the date above and, where appropriate, let you know by email or on the site.
Contact
Privacy questions or requests: privacy@sydneystephensondc.com or our contact form.