Privacy Notice

Last updated: June 13, 2026

1. Who we are

Sweet Grass Co. (operated by Leanne van den Brink) is the data controller for personal data processed through Prairie Paths and the Compass Rose product (the "Service"). Contact: sweetgrassseminars@gmail.com.

2. Data we collect

Account data: email address, display name, authentication identifiers (including, if used, Google sign-in identifiers).
Purchase / entitlement data: a record that you bought Compass Rose, the Stripe checkout session ID, and your access status. We do not receive or store full card details.
Reflective content you create: notes, answers, and selections you make while walking the trail. Stored against your account.
Technical & usage data: device/browser type, IP address, timestamps, page views, and basic interaction events for reliability and product analytics.
Support messages: anything you send us by email.

3. Why we use it (purposes & legal bases)

Provide the Service — create your account, deliver the trail, save your progress and reflections. Legal basis: performance of a contract.
Process your purchase — handled by Stripe (see §4). Legal basis: performance of a contract.
Security, fraud prevention, and abuse handling. Legal basis: legitimate interests.
Improve the product via aggregated, privacy-respecting analytics. Legal basis: legitimate interests.
Respond to support requests. Legal basis: legitimate interests.
Legal compliance (tax records, responding to lawful requests). Legal basis: legal obligation.

4. Who we share data with

Stripe — our payment processor. Stripe handles the checkout, payment processing, tax calculation and collection, and receipts. Stripe is an independent controller for payment data. See Stripe's Privacy Policy.
Infrastructure providers — hosting, database, authentication, and email delivery providers acting as processors on our instructions.
Professional advisers (legal, accounting) where necessary.
Authorities where required by law.

We do not sell your personal data.

5. International transfers

Our providers may process data outside your country, including in the United States and the EEA. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent adequacy mechanisms.

6. How long we keep it

We keep account, entitlement, and reflective data for as long as your account is active. If you delete your account, we delete or anonymise associated data within a reasonable period, except where we must retain certain records (e.g. transaction records for tax) for the period required by law.

7. Your rights

Subject to local law, you may have the right to access, correct, delete, restrict or object to processing of your personal data, port your data, and withdraw any consent. Where the GDPR or UK GDPR applies, you also have the right to lodge a complaint with your local supervisory authority. To exercise these rights, email sweetgrassseminars@gmail.com; we will respond within one month.

8. Security

We use appropriate technical and organisational measures — including encryption in transit, access controls, and row-level security on our database — to protect personal data. No system is perfectly secure; please use a strong, unique password.

9. Cookies & similar technologies

We use strictly necessary cookies/local storage to keep you signed in and to remember basic preferences, plus minimal analytics to understand product usage. You can clear these via your browser at any time.

10. Changes

We may update this notice. Material changes will be communicated through the Service or by email.

See also: Terms of Service · Refund Policy