Draft for attorney review. Last updated: [PUBLICATION DATE]
Privacy Policy — "21 Letters to Money"
This policy follows the same structure as our Spanish-language notice (prepared under Mexico's data protection law) and adds the essentials of the EU/UK GDPR (Annex A), California's CCPA/CPRA (Annex B) and India's DPDP Act (Annex C).
1. Who is responsible for your data
KILOS AI LLC (the "Company"), a company organized in Wyoming, USA, with its address at 1621 Central Ave, Cheyenne, WY 82001, USA, is responsible for processing your personal data, in co-production with Cristina Ouilhet / Lumora Life (a brand the Company operates commercially; for notices, the Company's address applies).
- Privacy contact: [NAME / "Privacy Team"]
- Email for privacy and data-rights requests: legal@lumoralife.co
- Sites and services covered: the Lumora Life and "21 Letters to Money" pages, the Academy (academia.lumoralife.co), forms, the WhatsApp community, emails, text messages, and group session recordings.
2. Personal data we collect
| Category | Data | How we get it |
|---|---|---|
| Identification and contact | Name, email, mobile/WhatsApp number (optional), country, time zone | Sign-up and checkout forms |
| Payment data | Payment method and status, last 4 digits and card type, country, amount. Your full card number is processed by Stripe (or PayPal); we never see or store it. | Stripe / PayPal, when you pay |
| Course use | Lessons watched, progress, access dates, device, recordings viewed | Academy and video platform |
| Communications | Messages you send us by email, text or WhatsApp; participation in the WhatsApp group | You |
| Testimonials (only if you give one) | Name, photo, voice, video and your words | You, with separate consent |
| Technical data | IP address, browser type, pages visited, cookies, advertising identifiers | Cookies and pixels (according to your choice) |
Sensitive data: the Program doesn't ask for sensitive data (health, beliefs, origin, sex life, biometrics, etc.). However, because it is a personal development program, you may voluntarily share sensitive information (emotional, family, belief or health-related) in messages or in the community. If you do, your express consent through the corresponding checkbox authorizes us to process it only to support you. Please don't share more than you want to. We will never ask for health data to sell anything, and we will never use it for advertising.
Minors: we don't knowingly collect data from anyone under 18. If we learn that a minor has signed up, we will delete their data.
3. Why we use your data
Primary purposes (needed for the service)
- Process your purchase, charge you, issue receipts and handle refunds.
- Create and manage your Academy account and give you access to the content.
- Provide the service: session recordings, support, and operational reminders about your access.
- Give you access to the WhatsApp community if you decide to join.
- Meet legal, tax and fraud-prevention obligations, and handle claims.
- Measure basic course use to improve delivery (aggregated statistics).
Secondary purposes (need your consent; you can say no and keep the service)
- Send you promotions, offers, news, invitations to challenges and Lumora Life products by email, text or WhatsApp.
- Use your name, photo, voice, video and words as a testimonial on pages, ads and social media (only with your separate written authorization).
- Personalize and measure our advertising with Meta and Google pixels (only if you accept advertising cookies).
- Surveys and satisfaction studies to create new programs.
To say no to the secondary purposes: leave the corresponding checkbox unchecked, or write to legal@lumoralife.co at any time. Saying no doesn't affect your access to the Program.
We don't make automated decisions with legal effects about you. We use advertising segmentation tools (basic profiling) only with your cookie consent.
4. Who we share your data with
We share your data with third parties who help us provide the service. Most are in the US or other countries, so there are international transfers. We protect them with contracts and security measures.
| Third party | Purpose | Data | Consent |
|---|---|---|---|
| Stripe (and PayPal, if you use it) | Process payments and prevent fraud | Name, email, payment data | Not required (needed for the contract) |
| Bunny.net (Bunny Stream) | Host and deliver the course videos | IP address, playback data | Not required (processor) |
| Kilos Academia / the Company's platform and hosting and email providers | Account, access, emails | Contact, progress | Not required (processors) |
| WhatsApp / Meta and our SMS provider [PENDING: SMS provider] | Community and messages | Phone number and messages | Your opt-in |
| Zoom | Group sessions and their recordings | Name, image and voice if you turn on camera/microphone | Needed for the session |
| Meta and Google (pixels, analytics and ads) | Measure and improve advertising | Identifiers, pages viewed, events (e.g. "purchase") | Cookie/advertising checkbox |
| Authorities | When the law requires it | What is required | Not required |
| Lumora Life / Cristina Ouilhet | Deliver the Program and support you | Name, contact, progress | Not required (co-production) |
We do not sell your personal data. If the Company merges, is sold or reorganizes, your data may pass to the new owner under this same policy.
5. How to limit use or disclosure
You can: (a) unsubscribe from emails with the link at the bottom of every message; (b) reply STOP to texts or write "STOP" on WhatsApp; (c) set your cookie choices in the banner; and (d) ask in writing at legal@lumoralife.co to be added to our internal do-not-contact list.
6. Your rights
You have the right to access your data, correct it, delete it and object to its processing (known in Mexico as ARCO rights), as well as to withdraw your consent and, where applicable, to data portability. Annexes A, B and C add the rights specific to the EU/UK, California and India.
How to exercise them: send a request to legal@lumoralife.co with:
- Your name and a way to reply to you.
- Reasonable proof of identity (we'll tell you what's needed; you can cover any details we don't need).
- A clear description of the right you want to exercise and the data involved.
- If you act through a representative, proof of their authorization.
Timing: we'll respond within 20 business days of receiving your complete request (or sooner where your local law requires: 1 month under GDPR, 45 days under CCPA); if your request is granted, it will take effect within the following 15 business days. Exercising your rights is free.
If you believe your rights have been violated, you can contact your data protection authority (in Mexico, the Secretaría Anticorrupción y Buen Gobierno, SABG).
7. Cookies and similar technologies
We use:
- Necessary: so the Academy, checkout and your session work. They can't be turned off.
- Analytics: to understand how the site is used. [PENDING: confirm tool].
- Advertising: Meta and Google pixels to measure ads and show you relevant advertising.
We only load analytics and advertising cookies after you accept them in the cookie banner. You can change your choice at any time from the "Cookie settings" link in the footer, or in your browser. We honor Global Privacy Control (GPC) signals as an opt-out of sale/sharing. We don't record your screen or browsing sessions. [CONFIRM with the technical team.]
8. Retention and security
We keep your data while you have an active account and, afterward, for as long as needed to meet legal and tax obligations (generally up to [5] years) and to defend against claims. Then it is deleted or anonymized. We apply reasonable administrative, technical and physical measures (encryption in transit, password-protected access, role-based access control). If a breach significantly affects your rights, we'll inform you without delay so you can take action.
9. Changes to this policy
We'll post any change on this page with its date and, if it is significant, let you know by email. The current policy is always at [URL /privacy].
10. Consent
By checking the acceptance box on our forms and checkout, you confirm you have read this policy. Secondary purposes, text/WhatsApp messages and any sensitive data you choose to share require separate checkboxes, which are unchecked by default. We only treat them as accepted when you check them.
ANNEX A — Additional terms for people in the European Union, the United Kingdom and Switzerland (GDPR)
When it applies: if you are in the EU, the UK or Switzerland when you buy or use the Program.
- Controller: KILOS AI LLC, 1621 Central Ave, Cheyenne, WY 82001, USA. EU representative (Art. 27 GDPR) / UK representative: [PENDING: appoint if advertising is targeted to the EU/UK; assess with attorney]. Privacy contact: legal@lumoralife.co.
- Legal bases:
- Performance of a contract (purchase and access): purposes 1 to 5.
- Legitimate interest (security, fraud prevention, basic statistics): purpose 6.
- Consent (marketing, testimonials, advertising and analytics cookies, any special-category data you share): purposes 7 to 10. You can withdraw it at any time without affecting earlier processing.
- Legal obligation (invoicing, taxes).
- Special-category data (Art. 9): we don't ask for it. If you choose to share it, we process it only with your explicit consent.
- Rights: access, rectification, erasure, restriction, objection, portability, and not being subject to automated decisions. We respond within 1 month. You can complain to your data protection authority.
- International transfers: your data may be processed in the US and other countries. We use providers certified under the EU-US Data Privacy Framework (and its UK extension) or the European Commission's Standard Contractual Clauses. [VERIFY status per provider.]
- Retention: as stated in section 8.
- Cookies: prior consent for non-essential cookies; rejecting is as easy as accepting.
- Breaches: we'll notify the competent authority within 72 hours when required.
- 14-day right of withdrawal (EU/UK consumers): when you buy digital content with immediate access, we'll ask for your express consent to start right away and your acknowledgment that you may lose the right of withdrawal; in any case, our 7-day guarantee applies in your favor. [SEPARATE EU/UK CHECKBOX AT CHECKOUT — see CHECKLIST-LEGAL.]
ANNEX B — Notice for California residents (CCPA/CPRA) and other US states
- Categories collected in the last 12 months: identifiers (name, email, phone, IP address); commercial information (purchases); internet activity (pages viewed, course progress); audio/visual information (only if you take part in a session with camera or microphone, or give a testimonial); and, only if you volunteer it, sensitive personal information. Sources and purposes are described in sections 2 and 3.
- Sale and sharing: we do not sell personal information for money. Using Meta and Google advertising pixels may count as "sharing" for cross-context behavioral advertising; we only load them with your consent, and you can opt out at any time through "Cookie settings" or a Global Privacy Control signal. [PENDING: add a "Do Not Sell or Share My Personal Information" link in the footer if advertising pixels are used]
- Sensitive personal information: we don't use it to infer characteristics about you, and only to provide the service you asked for.
- Your rights: to know/access, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and not be discriminated against for exercising any of these rights. You can use an authorized agent.
- How to exercise them: write to legal@lumoralife.co. We'll verify your identity and respond within 45 days (extendable once by 45 days with notice).
- Retention: as stated in section 8.
- Other US states with similar laws (for example, Virginia, Colorado, Connecticut, Texas, Oregon): you have equivalent rights, including the right to appeal a decision by replying to our response.
- Children: we don't knowingly sell or share data of anyone under 18.
ANNEX C — Notice for people in India (Digital Personal Data Protection Act, 2023)
Notice under the DPDP Act, 2023. KILOS AI LLC ("we") is the Data Fiduciary. We process your name, email, phone/WhatsApp number, payment status (processed by Stripe), course progress and, only if you choose, testimonial material, to deliver the course, process payments and refunds, support you and, if you opt in separately, send offers. You may withdraw consent at any time (as easily as you gave it), access a summary of your data, correct or erase it, nominate another person to exercise your rights, and seek redress at legal@lumoralife.co. We respond within [15] days. If unsatisfied, you may complain to the Data Protection Board of India. We do not knowingly process data of persons under 18. Your data may be processed outside India (including the United States). [VERIFY: final text and rules in force at publication; DPDP rules are being phased in.]