Privacy Policy

Version 1.0 · Effective September 12, 2026 · InBoundAI365, LLC d/b/a Neurodivergent Vitals

In plain English: We collect what we need to sign you in, take payment, and remember your progress. We don't sell your data, we don't run ad trackers, and you can ask us to delete everything.

1. What we collect 2. How we use it 3. Who we share it with 4. Cookies and local storage 5. How long we keep it 6. Security 7. Your rights and choices 8. Children 9. Where data lives 10. Changes and contact

1. What we collect

Account information

When you create an account, our sign-in provider (Clerk) collects your name, email address, and password or the identity you sign in with (for example Google), plus sign-in events and device/IP data used for security. We receive your name, email, a user ID, and sign-in status.

Payment information

Payments are processed by Stripe. Stripe collects your card or payment details directly; we never receive your full card number. We keep Stripe's identifiers for your purchase (session, customer, subscription, and charge IDs), the amount, the plan you chose, any promotional code, and — for showing you a receipt — the card brand and last four digits as returned by Stripe. If you choose a buy-now-pay-later provider, that provider collects what it needs under its own policy.

Learning data

To run the Service we store what you do in it: lessons started and completed, where you paused, drill and check answers and their timestamps, mastery status per chapter, recall scheduling, and settings such as theme. When you are signed in, this syncs to our servers so it follows you between devices; when you are not, it stays in your browser.

Communications

If you email us, we keep the correspondence so we can help you and keep a record of it.

Technical data

Our hosting provider (Cloudflare) processes IP addresses, request logs, and basic browser information to deliver the site and defend it against abuse. We record a hashed IP address and browser string when you accept our Terms or make a purchase, as evidence of the agreement. We do not use advertising trackers, social-media pixels, or third-party analytics scripts.

2. How we use it

to provide, personalize, and improve the Service — including saving and syncing your progress and deciding what to teach or ask next;
to take payment, deliver receipts, manage payment plans and refunds, and prevent fraud;
to communicate with you about your account, purchases, and material changes, and — if you opt in — study reminders and product news (you can unsubscribe any time);
to secure the Service and enforce our Terms;
to understand how the Service is used, in aggregated or de-identified form, and to publish statistics that do not identify anyone;
to comply with law.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

3. Who we share it with

Only service providers that process data on our behalf under contract, and only what each needs: Clerk (authentication), Stripe (payments; and through Stripe, your chosen buy-now-pay-later provider), Cloudflare (hosting, database, content delivery, security), and Resend (transactional email). We may also disclose information if required by law or legal process, to protect the rights, safety, or property of users or InBoundAI365, or as part of a merger, acquisition, or sale of assets (in which case this policy continues to apply to your data until changed with notice).

4. Cookies and local storage

We use a small number of strictly necessary cookies: our own session cookie (nv_s) that proves your access to paid content, and Clerk's cookies that keep you signed in. Your browser's local storage holds your theme choice and, if you study without an account, your progress. Stripe's checkout pages set their own cookies under Stripe's policy. We do not use advertising or analytics cookies. You can clear cookies and local storage in your browser at any time; doing so signs you out and, without an account, erases local progress.

5. How long we keep it

Account and learning data are kept while your account exists and for up to 90 days after deletion is requested, to allow recovery from mistakes, then deleted or de-identified. Purchase records, Terms acceptances, and correspondence are kept for as long as needed for tax, accounting, dispute, and legal-compliance purposes (typically seven years). Aggregated statistics that do not identify anyone may be kept indefinitely.

6. Security

Data is encrypted in transit; access to production systems is limited to those who need it; payments never touch our servers; and paid content is protected by signed, server-verified sessions. No system is perfectly secure, and we cannot promise that unauthorized access will never occur. If a breach affects your data, we will notify you as required by law.

7. Your rights and choices

You can update your name, email, and password from the Account panel inside the app. You can email hello@neurodivergentvitals.com from your account address to: access a copy of your data, correct it, delete your account and data, or object to a particular use. We will verify the request and respond within 45 days (extendable once as the law allows). We do not discriminate against you for exercising your rights.

California residents have these rights under the CCPA/CPRA, including the right to know the categories of personal information we collect (listed in Section 1), the purposes (Section 2), and the categories of third parties we share with (Section 3). We do not sell or share personal information as those terms are defined in the CPRA, so there is nothing to opt out of; we honor Global Privacy Control signals as an opt-out preference regardless. You may designate an authorized agent by providing written permission. Residents of other U.S. states with privacy laws have comparable rights and may use the same contact. Nevada residents: we do not sell covered information.

Email preferences. Transactional messages (receipts, payment problems, material changes) are part of the Service. Any optional reminders or news include an unsubscribe link.

8. Children

The Service is not directed at children under 13 and we do not knowingly collect their personal information. Users must be 16 or older (Section 1 of the Terms). If you believe a child under 13 has given us personal information, email us and we will delete it.

9. Where data lives

We are based in the United States and our providers store and process data in the United States (Cloudflare may serve cached, non-personal content from locations near you). If you use the Service from outside the United States, you understand your data will be processed in the United States, where privacy laws may differ from those of your country.

10. Changes and contact

We will post any changes here and update the version and effective date above; for material changes we will notify you by email or in the Service at least 30 days in advance. Questions or requests: InBoundAI365, LLC · Neurodivergent Vitals · hello@neurodivergentvitals.com.