Privacy Policy

Effective date: {{EFFECTIVE_DATE}}

This Privacy Policy explains what personal information {{BUSINESS_LEGAL_NAME}} ("we," "us," or "our") collects when you use the Smart Home from Scratch website at {{WEBSITE_DOMAIN}} and the online course sold there. It also covers why we collect it, who we share it with, and the choices you have.

We collect as little as we can. The short version:

Your account is created when you buy the course, with the name and email address you give at checkout. Your password is stored only as a scrambled (hashed) version.
Payments go through Hotmart, the platform that sells the course and handles the payment. Your card number never reaches our servers.
One cookie keeps you logged in. On our public pages we also run Meta's advertising pixel, so we can tell which ads bring people here — never on the pages you reach by logging in, and not at all if your browser asks not to be tracked.
We don't sell your personal information. We do share what an advertising pixel shares, and your email address as a scrambled value when you buy, so we can tell which ads lead to sales. You can opt out — see "Your choices and rights".
You can download a copy of your information from your account page, and you can ask us to correct or delete it at any time by emailing {{CONTACT_EMAIL}}.

Who we are

Smart Home from Scratch is run by {{BUSINESS_LEGAL_NAME}}, based in {{BUSINESS_COUNTRY}}.

Email: {{CONTACT_EMAIL}}

Information we collect

Your account

There is no separate signup. Your account is created when your purchase is confirmed, with the name and email address you gave at checkout, and you log in with that email address. For your account, we keep:

Your name
Your email address
Your password, stored only as a salted scrypt hash. A hash is a scrambled, one-way version of your password: we can check that the password you type is correct, but we can't read it or recover it. Neither could anyone who got a copy of our database.
Whether your account has access to the course
The date the account was created and the date you last logged in

When you buy the course

Hotmart sells the course and handles our payments. You enter your card details on Hotmart's checkout, and they go straight to Hotmart, never to our servers. We never see or store your full card number or security code. Hotmart charges any sales tax that applies, issues the receipt for your purchase, and may show us a few limited details about the payment.

From Hotmart, we receive:

Your name and email address
Your billing country and postal code, if you entered them
The amount you paid, including any tax, and the date of the payment
Hotmart's reference number for the transaction

We also record which version of our Terms of Service, Refund Policy, and Privacy Policy applied to your purchase, and the date of that purchase.

When you take the course

Which lessons you marked as complete, and when
Suggestions you send from the course, and the lesson each one is about

To keep you logged in

When you log in, we set one cookie, named shc_session. The Cookies section below explains it.

We also keep a record of each login session: which account it belongs to, when it started, and when it expires. The record holds only a one-way hash of the code stored in your cookie, never the code itself.

To protect accounts from abuse

To slow down anyone trying to guess passwords or flood our forms, we count recent attempts to log in, reset a password, open checkout, look up a payment on the page you see after checkout, ask for a refund, and download your data. Each counter is identified by a keyed one-way hash of the email address, IP address, or account number involved, never by the address or number itself. A counter lasts for its limit window, at most an hour, and is deleted after that, normally within a day.

Password-reset links work only once and expire after a short time.

The event log

We keep a log of important events, so we can answer questions like "did my payment go through?" or "was my email sent?", and so we can find and fix problems. It records:

payments, refunds, and disputes
emails we send, and emails that fail to send
changes to accounts, such as course access being turned on or off
logins by members of our team
errors on the website

An entry can include the account and the email address it was about, the date and time, and a reference number from Hotmart or our email provider. It never includes passwords, card numbers, or the links we email you.

We keep the event log as part of our business records. If your account is deleted, your email address is removed from it.

Server logs

Our hosting provider, {{HOSTING_PROVIDER}}, automatically records technical details about requests to our website. These include your IP address, the date and time of the request, and the page requested. We use these logs to keep the site secure and to fix problems.

When you contact us

Your email address and whatever you choose to write to us

What we don't collect

We don't use analytics tools or third-party trackers. The one exception is the advertising pixel described under "Cookies", which runs on our public pages and never where you are logged in.
We don't ask for sensitive information such as your Social Security number, health information, or precise location.
We don't store your card number.

How we use your information

We use your information:

to create your account when you buy, run it, and keep you logged in
to process your purchase, turn on your course access, and handle refunds
to keep a record of which version of our terms you agreed to
to save your progress through the lessons
to read the suggestions you send and improve the course
to send transactional emails, such as your purchase confirmation and emails to set or reset your password
to send you emails about the course if you bought it, until you unsubscribe (see "Emails" below)
to keep the website secure, prevent fraud and abuse, and fix problems
to reply when you write to us
to keep business records and meet our legal, tax, and accounting obligations

We don't use your information to build advertising profiles. We don't use it to make automated decisions about you that have legal or similarly significant effects.

Emails

Transactional emails are messages you need because of something you did. Examples are purchase confirmations, receipts, emails to set or reset your password, and messages about your account or a refund. They are not marketing. You'll still get them after you unsubscribe from marketing emails.

Marketing emails are emails with course news, new lessons, or offers. We send them to people who bought the course, and we stop as soon as you unsubscribe. Every marketing email:

clearly comes from us
has a working unsubscribe link
includes our physical mailing address: {{MAILING_ADDRESS}}

When you unsubscribe, we stop sending you marketing emails promptly, and always within 10 business days.

{{EMAIL_PROVIDER}} delivers our emails for us.

Cookies

The cookie that logs you in:

Name: shc_session
Purpose: keeps you logged in to the course
Type: strictly necessary. Logging in can't work without it.
When it's set: only when you log in
Protection: it can't be read by scripts running in the page, and on the live site it is sent only over secure (HTTPS) connections
How long it lasts: your session ends after 7 days without using the site, and always within 30 days of logging in, whichever comes first. Logging out ends it immediately.

Advertising cookies, on our public pages only:

We advertise this course, and we use Meta's (Facebook's) advertising pixel on our public pages — the home page, Support, and the legal pages, which anyone can read without logging in. It sets cookies in your browser (_fbp and _fbc) and tells Meta that a browser visited a page and, if you click the buy button, that a checkout was started.

It is never loaded inside the course, your account, or the pages you log in through. What you read after you buy is not shared with anyone.
It is not loaded at all if your browser sends a Global Privacy Control signal. See "Do Not Track and Global Privacy Control" below.
We also tell Meta when a purchase is completed, from our server rather than from your browser, so we can tell which ads lead to sales. That message contains the amount, the currency, the order number, and your email address as a one-way scrambled (hashed) value — never the address itself.

We don't use analytics cookies beyond this, and we don't let any other company track you on our site.

If you block cookies in your browser, you can still read the public pages, but you won't be able to log in.

Who we share information with

We do not sell your personal information.

We do share limited information with Meta (Facebook and Instagram) so we can advertise the course and know which ads work: that a browser visited a public page, that a checkout was started, and that a purchase happened — with the amount, the order number, and your email address as a one-way scrambled (hashed) value. Under California law this counts as "sharing" for cross-context behavioral advertising, and you can opt out of it. See "Your choices and rights" and "Do Not Track and Global Privacy Control" below.

Nothing about what you do inside the course — the lessons you open, your progress, what you write to us — is ever shared for advertising.

We share personal information only with service providers that help us run the course. Each one gets only what it needs for its job:

Hotmart sells the course, processes payments and refunds, and helps prevent fraud. Hotmart publishes its own privacy policy on its website, hotmart.com.
{{HOSTING_PROVIDER}} hosts our website and keeps its server logs.
{{DATABASE_PROVIDER}} hosts the database that stores account, progress, and purchase information.
{{EMAIL_PROVIDER}} delivers our emails.
Meta receives the advertising information described above, and nothing else. Meta publishes its own privacy policy at facebook.com/privacy/policy.

We may also disclose information in these cases:

when the law requires it, such as a valid subpoena or court order
when needed to protect the rights, safety, or security of our users, the public, or us, including to investigate fraud or attacks on the website
to a buyer or successor if the business or the course is sold, merged, or transferred, in which case your information stays protected as this policy describes

How long we keep information

Account information and lesson progress: for as long as your account exists. If you ask us to delete your account, see "Deleting your account" below.
Suggestions: kept to improve the course, and deleted when your account is deleted.
Marketing email preferences: after you unsubscribe, we may keep your email address on a do-not-email list so we don't send you marketing again by mistake.
Purchase records (amount, dates, which version of our terms you agreed to, and Hotmart transaction references): for as long as we must keep them for tax, accounting, and legal reasons, or to prevent fraud. This applies even after you delete your account.
Event log: kept as part of our business records. Your email address is removed from it when your account is deleted.
Login sessions: a session stops working after 30 days or when you log out.
Abuse-prevention counters: for their limit window, at most an hour, and deleted after that, normally within a day.
Server logs: for {{SERVER_LOG_RETENTION_PERIOD}}.

Your choices and rights

At any time, you can:

get a copy of the personal information we have about you. Log in, open your Account page, and use Download my data. You get a file with your account, purchases, lesson progress, suggestions, and account history. You can also ask us for it by email.
ask us to correct anything that's wrong or out of date
ask us to delete your information
opt out of the sharing we do for advertising, by turning on Global Privacy Control in your browser or an extension. We honor it automatically and the advertising pixel is not loaded at all — see the section below. You can also ask us by email and we'll confirm.

To make a request, email {{CONTACT_EMAIL}} from the email address on your account. If you write from a different address, we may first ask for something that shows the information is yours, such as a detail from your receipt. We won't ask for more than we need.

We'll reply within a reasonable time, and within any deadline set by the law of the state where you live.

Deleting your account

When we delete your account:

we delete your lesson progress, your login sessions, your suggestions, and any password links we sent you
we remove your email address from the event log
if the account has no purchases, we delete the account itself
if the account has purchases, we anonymize it instead: your name, email address, and password are removed, and course access is turned off. The purchase records stay, with only the amounts, the dates, and Hotmart's reference numbers, because we must keep them for tax reasons.

Hotmart keeps its own records of your payments under its own privacy policy. Deleting your account with us doesn't delete them.

Deleting your account also ends your access to the course. If you bought the course, you won't be able to get back in.

You can also:

unsubscribe from marketing emails with the link in any of them, or by emailing us
block or delete cookies in your browser, though you won't be able to stay logged in without the session cookie

We won't treat you differently for making any of these requests. For example, we won't charge you a different price.

Your state may give you more rights

Depending on where you live, your state's privacy law may give you more rights. These can include the right to get a copy of your information in a portable format, the right to opt out of the sale of personal information or of targeted advertising, and the right to appeal if we turn down a request. We don't sell personal information or use it for targeted advertising.

To use any right your state gives you, email {{CONTACT_EMAIL}}. If we turn down a request, we'll tell you why, and you can reply to ask us to reconsider.

Do Not Track and Global Privacy Control

Global Privacy Control. If your browser or an extension sends a Global Privacy Control signal, we treat it as your opt-out from the sharing described above, and the advertising pixel is not loaded at all on your visit: no cookies are set, no page view is reported, and no checkout event is sent. Nothing else about the site changes, and you can read, buy, and use the course exactly the same way. This is automatic — there is nothing to click.

You can also block the pixel with any content blocker, or refuse third-party cookies in your browser. Neither affects your access to the course.

Do Not Track. The older "Do Not Track" header was never given an agreed meaning, and most browsers dropped it. We do not act on it; we act on Global Privacy Control, which is the signal the law recognizes.

Security

We protect your information with measures such as these:

passwords are stored only as salted scrypt hashes
only one-way hashes of session codes are stored
the session cookie can't be read by scripts in the page and, on the live site, travels only over secure connections
repeated attempts to log in, reset a password, open checkout, or ask for a refund are limited
password-reset links work only once and expire

No website or system is completely secure. We can't guarantee that information will never be accessed, disclosed, or changed without permission. If we learn of a security breach that affects your personal information, we'll notify you as the law requires.

Children

Smart Home from Scratch is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you're under 13, please don't buy the course or use an account. If you believe a child under 13 has given us personal information, email {{CONTACT_EMAIL}} and we'll delete it.

Where your information is processed

We're based in {{BUSINESS_COUNTRY}}, and our service providers may process information in other countries. This means your information may be stored and processed outside your state or country, including in {{BUSINESS_COUNTRY}} and the United States. Privacy laws there may be different from the laws where you live.

Changes to this policy

We may update this Privacy Policy from time to time, for example when we change a service provider or add a feature. When we do, we'll post the new version on this page and change the effective date at the top.

If a change is significant, we'll tell you before it takes effect. We'll do that by emailing the address on your account, or by posting a notice on the website.

We won't use information we already have in a way that's materially different from what this policy said when we collected it, unless we first ask for your consent.

Contact us

For questions or requests about your privacy:

Email: {{CONTACT_EMAIL}}

See also our Terms of Service and Refund Policy.