Privacy Policy

This Privacy Policy explains how Kathleen Loving Harner, an individual sole trader operating from Pennsylvania, United States, trading as SteadyPath ("SteadyPath", "we", "us" or "our"), collects, uses, and shares information about you when you use the SteadyPath program and related websites and services (the "Service").

1. Who is responsible for your information

SteadyPath is the controller of the personal information described in this policy. You can reach us at any time through the Support page.

2. Information we collect

• Account information: your email address, password (stored in a hashed form by our authentication provider), display name, and, if you upload one, profile picture.
• Program activity: which lessons you have viewed and marked complete, your comments on lessons, and any community discussion posts you create.
• Support communications: the content of support tickets and replies you send to us, along with any information you choose to include.
• Payment information: when you make a purchase, our reseller Paddlecollects your billing details and payment method directly. We receive limited transaction data (such as order status, plan, and renewal date) from Paddle but do not store your full card number.
• Technical data: device and browser information, IP address, and basic usage events needed to operate and secure the Service.

3. How we use your information

• To provide the program, save your progress, and personalize your experience.
• To operate community and comment features you choose to use.
• To respond to your support requests and send transactional emails (e.g. password reset, ticket replies, receipts issued by Paddle).
• To keep the Service secure, detect fraud, and enforce our Terms.
• To comply with legal obligations.

We do not sell your personal information, and we do not use your program content to train third-party AI models.

4. Legal bases

Where applicable law requires a legal basis, we rely on: performance of our contract with you (to deliver the program), our legitimate interests (to keep the Service safe and improve it), your consent (for optional communications you opt into), and compliance with legal obligations.

5. Who we share information with

• Paddle (Merchant of Record) — for payments, subscription management, invoicing, and sales tax compliance.
• Lovable Cloud — our hosting, database, authentication, and email delivery infrastructure provider.
• Professional advisers — accountants and lawyers, only where necessary.
• Authorities — where required by law, court order, or to protect our rights, users, or the public.

6. International transfers

We operate from the United States, and our service providers may process your data in the United States and other countries. Where personal data is transferred from regions with data-export restrictions (such as the UK/EEA), our providers rely on appropriate safeguards, including Standard Contractual Clauses.

7. How long we keep your information

We keep your account information and program activity for as long as your account is active. Support ticket history is retained for up to 3 years for quality and legal recordkeeping. Paddle retains transaction records for the period required by tax law (typically 7 years). When you delete your account, we remove your personal data and content from active systems promptly, and from backups within 30 days, except where we are required by law to keep certain records.

8. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your account and associated data (available directly from the Account page);
• object to or restrict certain processing;
• request a portable copy of your data;
• withdraw consent where processing is based on consent.

Residents of California and other US states with comprehensive privacy laws have the rights described above, including the right to know, delete, correct, and opt out of any "sale" or "sharing" of personal information (we do not sell or share personal information for cross-context behavioral advertising). UK/EEA residents additionally have the right to lodge a complaint with their local supervisory authority. To exercise any right, contact us via the Support page; we will respond within 30 days.

9. Security

We use industry-standard technical and organisational safeguards, including encryption in transit, hashed passwords, and role-based access controls, to protect your information. No system is perfectly secure, but we work to reduce risk and respond quickly to any incident that may affect you.

10. Children

SteadyPath is intended for adults. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, please contact us and we will delete it.

11. Cookies

We use a small number of cookies and similar technologies. See our Cookie Policy for details and how to manage them.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email. The "Last updated" date at the top of this page always reflects the current version.

13. Contact

Privacy questions or requests? Please contact us through the SteadyPath Support page.