Draft — pending legal review
Privacy notice
Who we are
The seller is Simulations, a company based in Albuquerque, New Mexico, USA. Paddle.com Market Ltd processes payments as merchant of record and handles tax and VAT.
Data we collect
We collect your email, edition, locale and signup source, account and purchase records, course progress, and booking details. We keep your IP address briefly for rate limiting, fraud and country checks. For regional pricing, we compare your visitor country with the billing country Paddle records.
How we use it
We use this information to run accounts and the course, record purchases, progress and bookings, and send service and marketing email. You can withdraw marketing consent using the unsubscribe link in every email.
Service providers
Netlify hosts the site and processes server logs; Supabase manages accounts and purchase records in its Frankfurt, EU region; Paddle processes payments, and we never see card numbers; Brevo manages the email list and transactional email; Bunny.net delivers video; Cal.com handles coaching bookings; Plausible Analytics provides cookieless analytics without personal data.
Cookies and analytics
We use no cookies except those needed for login and checkout, so we do not show a cookie banner. Plausible Analytics is cookieless and does not collect personal data.
Legal basis
We process data to perform our contract with you, including accounts, purchases, course access and bookings. We also process it for our legitimate interests in security, rate limiting, fraud and country checks, and cookieless analytics. We send marketing email with your consent; you can withdraw it at any time. We keep tax and accounting records to meet legal obligations; Paddle keeps its own records as merchant of record.
Data retention
We keep waitlist and marketing contacts until you unsubscribe or ask us to delete them; account and course-progress data while your account is active and for up to 24 months after your last login; purchase and tax records as long as tax law requires (Paddle keeps its own records as merchant of record); and server logs and IP addresses for no more than 30 days.
International transfers
Some providers process data outside your country, including in the United States and the EU. Transfers rely on the providers’ standard contractual clauses or equivalent safeguards.
Complaints
You can complain to your local data protection authority, such as your national regulator in the EU or UK, or the Saudi Data & AI Authority (SDAIA) in Saudi Arabia. We would appreciate the chance to help first.
Your rights and contact
You may request access, correction or deletion, object to processing, and withdraw marketing consent. Relevant rights include those under GDPR, UK GDPR, Saudi PDPL and California CCPA/CPRA. For privacy and data requests, contact privacy@startpharmacareer.com. For general questions, contact hello@startpharmacareer.com.