Your information deserves clarity and restraint.

1. Information we collect

• Account: name, email, email-verification status and time, short-lived verification records, salted one-way password hash, account identifiers, invitation code, and a record of each version of these legal documents you accepted: the version, date, how you accepted (sign-up, checkout, or an update prompt), a keyed hash of your IP address, and your browser type.
• Email preferences: whether you chose to receive marketing email, and the history of each opt-in and opt-out with its date and source. Opt-outs, bounces, and spam complaints are also kept on a suppression list as a keyed hash of the email address, so they are honored even if an account is later deleted.
• Couple space: connected partner, shared course completion, invitation status, and settings.
• Diagnostic and reflections: answers, scores, dates, trends, and the sharing choice selected by the person who completed it, and couples-reflection answers with the optional email given for a shared result. These may reveal sensitive relationship or emotional information and are encrypted in our database.
• Purchase: product, price, status, processor identifiers, purchase email, and the first time paid Temple content is opened. The payment processor—not The Four Bases of Love—handles full card details.
• Technical: IP address, browser/device details, timestamps, essential cookies, request/error logs, sign-in attempts, email-verification attempts, and password-reset activity.
• Communications: information you send for support, privacy requests, or an optional author-conversation inquiry, including scheduling preferences and the topic you choose to share.

2. How information is collected and used

We collect information directly when you prepare or create an account, purchase, complete a diagnostic, use the course, change a setting, or contact us; from the payment provider; and automatically from browsers and infrastructure. We use it to operate and secure the service, authenticate users, activate purchases, document fulfillment and first paid-content access, connect consenting partners, save progress and results, apply sharing choices, send transactional messages, prevent fraud, handle refunds and disputes, enforce terms, and comply with law. Authorized administrators may view names, email addresses, verification and legal-consent records, partner connections, purchase status, first paid use, course progress, and diagnostic count and date for customer support and program operations. The Admin Preview does not display passwords, reset tokens, full card details, raw IP addresses, or diagnostic answers and scores.

3. Legal bases (EU, EEA, and UK)

Where the EU or UK General Data Protection Regulation applies, we rely on: contract, to create your account and provide the program you bought; legitimate interests, to secure the service, prevent fraud, measure use in the limited way described below, keep records of the terms you accepted and of consent choices, keep an opt-out list, and establish or defend legal claims; consent, for marketing email, optional cookies, sharing diagnostic results with a partner, and the one-time shared-result email; and legal obligation, for tax and accounting records and lawful requests. You may withdraw consent at any time; this does not affect processing that happened before. The Four Bases of Love is the controller of this information.

4. Partner visibility

Course completion is shared within a connected couple space. Diagnostic results are private by default unless the person who completed a result chooses to share it or enables optional automatic sharing. A person may unshare a result later. Do not connect accounts or share a result if doing so could expose you to coercion or harm.

5. Traffic measurement, cookies, and local storage

Our hosting infrastructure processes request information such as IP address, timestamp, requested path, browser headers, country, and request identifiers for delivery, reliability, and security. Our separate first-party measurement records page views and limited funnel events, time, country, coarse browser, operating-system and device family, referring domain, and named UTM campaign tags. It uses a daily-changing pseudonymous visitor code derived from the IP address and a random browser-tab session code so events in one short journey can be ordered. We do not copy the raw IP address into the analytics database. Signed-in administrator activity is marked so it can be excluded from new reports; earlier records do not contain that marker.

Analytics does not include form contents, passwords, password-reset tokens, diagnostic answers or scores, email addresses, names, or full payment-card details. Purchase events may record the amount paid and whether access was full-price, discounted, or complimentary. We use essential cookies and similar storage for sign-in, security, session continuity, anonymous journey measurement, cookie preferences, and core site functions. If you add the site to your home screen, copies of the practice pages you open may be kept on that device so they work without a signal; they expire within 12 hours and are deleted when you sign out. We do not currently use advertising cookies. If optional advertising or marketing cookies are added, they will remain off until you opt in where consent is required. See the cookie notice or reopen “Cookie choices” in the footer to update optional preferences.

6. Email communications and author conversations

Necessary account, verification, security, purchase, scheduling, support, and legal-update messages are transactional or service messages and are sent while you have an account. Marketing email (program news and ideas) is sent only if you opt in; the choice is separate, optional, and unchecked by default. Every marketing email identifies The Four Bases of Love, uses an honest subject line, includes our postal address, and has a one-click unsubscribe link that works without signing in, plus the unsubscribe button many mail apps show. Opt-outs take effect immediately (never later than 10 business days) and unsubscribe links keep working for at least 30 days after each message. A spam complaint or a permanently failed delivery is recorded as an opt-out automatically. You can also opt out in Settings or by emailing us. Withdrawing marketing consent never affects program access.

If you request a private author conversation, we use the information you provide to assess the request, communicate availability, arrange payment, schedule and conduct the video call, and address follow-up or disputes. Do not include sensitive health, crisis, abuse, or financial details in an inquiry email. A video-call provider may process meeting metadata under its own terms. Sessions are not recorded by The Four Bases of Love unless every participant gives advance written consent.

7. Disclosures and service providers

We may disclose necessary information to providers of hosting, infrastructure and database (Cloudflare), payment processing (Stripe), email delivery (Resend), security, and support; when required by law; to protect rights or safety; to investigate fraud; to complete a lawful business transaction with safeguards; or at your direction. Providers may use information only for contracted purposes and their legal obligations. Some providers process information in the United States and other countries; where the law requires it, transfers from the EU, EEA, or UK rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

8. Sale, advertising, and tracking signals

We do not sell personal information, share it for cross-context behavioral advertising, use diagnostics for advertising, or use traffic measurements to build advertising profiles. Because there is no universally accepted Do Not Track standard, the service does not currently respond differently to browser Do Not Track signals. If our practices change and a legally recognized opt-out signal applies, we will honor it as required.

9. Retention

Account, course, couple-space, and diagnostic records are kept while an account is active and as needed to provide the service. When you delete your account, they are deleted, except: purchase and accounting records (amount, date, and payment reference, without your name or email) are kept for seven years for tax and dispute obligations; records of which legal terms were accepted and of consent choices are kept under an anonymous reference to show what was agreed; and your email address stays on our opt-out list as a keyed hash so you are never sent marketing again. Accounts that never verified their email are deleted in periodic clean-ups once they are more than 30 days old, unless tied to a purchase. Logs of emails we send are kept for two years, and the record of administrator actions for seven. Pseudonymous first-party traffic-measurement records are retained as historical analytics. Hosting security logs follow the infrastructure provider’s shorter operational schedule. Security and reset records are kept for shorter operational periods. De-identified information may be retained.

10. Security

Safeguards include encrypted transport (HTTPS), salted one-way password hashing, access controls limited to two named administrators with every administrative action logged, rate limits, and security headers. Sensitive fields (diagnostic scores, couples-reflection answers, and the shared-result email) are encrypted in our database with AES-256-GCM using a key kept separately from the data. Email addresses on opt-out lists and IP addresses in acceptance records are stored only as keyed hashes. No service can guarantee absolute security. Use a unique password and contact us if you suspect unauthorized access.

11. Your rights and choices

You can download a copy of your information (access and portability) and delete your account (erasure) yourself at any time from Your privacy choices or Settings; you can correct your name in Settings and withdraw marketing consent or diagnostic sharing there. Where the GDPR or similar laws apply, you may also ask us to restrict or object to processing, and you may lodge a complaint with your local data protection authority. For anything else, email hello@fourbasesoflove.com; we respond within one month and may verify your identity first. We may retain information where the law permits or requires, as described under Retention.

12. California notice

California residents may have rights to know, access, correct, or delete information; opt out of sale or sharing; limit certain uses of sensitive information; and receive non-discriminatory treatment. The Four Bases of Love does not currently meet every threshold that makes the CCPA applicable, but we will evaluate verified requests in good faith and provide rights required by law. We have not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months.

13. Children and international users

The service is for adults 18 and older and is not directed to children. It is operated from the United States, and information may be processed where providers operate, with the safeguards described above.

14. Versions and changes

This policy is versioned together with the Terms of Service, Participant Agreement, and Program & Safety Disclaimer. Each version has a number, an effective date, and a plain-language summary in the public version history. When we make a material change, we email account holders, and signed-in users are asked to review and accept the new version before continuing to use member areas. If you do not accept, you may download your information and delete your account. Changes apply going forward only.

Contact

Questions, privacy requests, and support inquiries may be sent to hello@fourbasesoflove.com. The service is operated under the business name The Four Bases of Love.