Privacy Notice

Who we are

RBT Ready is operated by Sean Denny. For the personal data described here, we act as the data controller: we decide what data is collected and why. You can reach us at s.denny@inbloomautism.com.

What we collect and why

• Account data (email address, display name, password credentials managed by our authentication provider, or your Google sign-in identity) — to create and secure your account. Legal basis: performance of our contract with you.
• Study data (answers, session results, mastery and readiness scores, streaks, settings) — to provide progress tracking and sync it across your devices. Legal basis: performance of our contract with you.
• Access and entitlement data (subscription status, redeemed access codes, comped access, admin role) — to determine what content your account can open. Legal basis: performance of our contract with you.
• Technical and usage data (IP address, device and browser type, error reports, basic usage events) — to keep the Service secure, diagnose faults, and improve the product. Legal basis: our legitimate interests in a secure, working service.
• Support messages you send us — to answer you. Legal basis: legitimate interests.
• Marketing emails, only if you opt in — legal basis: your consent, which you can withdraw at any time.

We do not collect or store your card details. Payment data is collected directly by Paddle, our Merchant of Record.

Who we share data with

• Service providers and subprocessors — cloud hosting, database and authentication infrastructure, and error monitoring, acting on our instructions.
• Paddle, our Merchant of Record, for the sale of the product, subscription management, payments, tax compliance, and invoicing.
• Professional advisers such as legal and accounting, where needed.
• Authorities, where we are required to disclose by law.

We do not sell your personal data.

International transfers

Our infrastructure and providers may process data in the United States and other countries. Where data is transferred out of the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

How long we keep it

Account and study data is kept while your account is active. If you delete your account or it stays inactive for 24 months, we delete or anonymise the data within 90 days. Records we must keep for tax or legal reasons (mainly transaction records held by Paddle) are kept for as long as the law requires.

Your rights

Depending on where you live, you may have the right to access your data, correct it, ask us to delete it, restrict or object to processing, receive a portable copy, withdraw consent, and complain to your data protection supervisory authority. Email s.denny@inbloomautism.com and we will respond within one month.

Security

We use appropriate technical and organisational measures, including encryption in transit, row-level access controls so users can only reach their own records, and restricted administrative access. No system is perfectly secure, but we work to protect your data and will notify you of a breach where required.

Cookies and local storage

We use strictly necessary cookies and browser local storage to keep you signed in, hold your session, and store study progress on your device. We do not use advertising cookies. Paddle sets cookies needed to run checkout. You can clear or block storage in your browser settings, though signing in and progress sync will stop working.

Children

RBT Ready is intended for working adults and is not directed at children under 16. We do not knowingly collect their data.

Changes

We may update this notice; material changes will be posted here with a new "last updated" date.