Privacy Policy

Last updated: April 12, 2026 | Effective: April 12, 2026

Jurisdictions covered: United States (CCPA, COPPA, FTC Act, ADA Section 508), State of Israel (Privacy Protection Law 5741-1981, Amendment 13), EU/UK (GDPR principles).

CHANDUCATE LLC ("Company", "we", "us", "our") is a California-based limited liability company operating the website chanducate360.com and related services. This Privacy Policy explains how we collect, use, store, protect, and share your personal information.

1. Information We Collect

1.1 Information You Provide Directly

Data Type	Source	Purpose
Name, email address	Contact form, Challenge questionnaire, Founder assessment	Communication, service delivery
Challenge/questionnaire responses	Challenge form, Founder Readiness Scan, Deep Assessment	Service evaluation, personalized recommendations
Payment information	Stripe (payment processor)	Payment processing — we do NOT store credit card numbers

1.2 Information Collected Automatically

IP address (for rate limiting and security)
Browser type and operating system
Pages visited and timestamps
Referring URL

We use essential cookies only. We do not use tracking, advertising, or third-party analytics cookies.

1.3 Information We Do NOT Collect

Social Security numbers
Health or medical records
Biometric data
Precise geolocation data
Information from minors under 13 (COPPA compliant)

2. How We Use Your Information

To respond to inquiries and provide requested services
To process payments via Stripe (PCI-DSS compliant processor)
To deliver Founder Alignment Reports and related materials
To improve our services and website
To comply with legal obligations
To protect against fraud and ensure security

We do not sell, rent, or share your personal information with third parties for marketing purposes.

3. Legal Basis for Processing

Consent: You provide information voluntarily via forms
Contractual necessity: Processing payments and delivering services you requested
Legitimate interest: Security, fraud prevention, service improvement
Legal obligation: Compliance with applicable laws

4. Data Storage and Security

4.1 Storage

Data is stored on secure cloud infrastructure with encryption at rest and in transit (TLS 1.2+). Payment data is processed and stored exclusively by Stripe (PCI-DSS Level 1 certified).

4.2 Security Measures (Amendment 13 Compliance)

In accordance with Israel's Privacy Protection Law Amendment 13 and US best practices, we implement:

Encryption of data at rest and in transit
Rate limiting on all form submission endpoints
Secure HTTP headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options)
Input validation and sanitization
Access controls on administrative functions
Regular security reviews

4.3 Data Retention

Data Type	Retention Period
Contact form submissions	2 years, or until deletion requested
Founder assessment responses	2 years, or until deletion requested
Scan results	2 years, or until deletion requested
Payment records	7 years (US tax compliance requirement)
DSAR requests	3 years (regulatory compliance)

5. Your Rights

You have the right to request access, correction, deletion, or portability of your data at any time. Submit a request via our Data Subject Access Request form or email [email protected].

5.1 Under CCPA (California, USA)

Right to Know: What personal information we collect and how we use it
Right to Delete: Request deletion of your personal information
Right to Opt-Out: We do not sell personal information
Right to Non-Discrimination: We will not discriminate against you for exercising your rights

5.2 Under Israel Privacy Protection Law (Amendment 13)

Right of Access (Section 13): View personal data we hold about you
Right of Rectification (Section 14): Correct inaccurate data
Right of Deletion (Section 14A): Request erasure of your data
Right to Data Portability: Receive your data in a structured format
Right to Object: Object to processing of your data
Breach Notification: We will notify you within 72 hours of discovering a data breach affecting your data, as required by Amendment 13

5.3 Under GDPR (EU/UK Residents)

EU/UK residents have equivalent rights including access, rectification, erasure, restriction, portability, and objection.

5.4 Response Timeline

We respond to all data subject requests within 30 days. Complex requests may take up to 45 days with notification.

6. Third-Party Services

Service	Purpose	Data Shared
Stripe	Payment processing	Email, payment details (PCI-DSS compliant)
MongoDB Atlas	Database hosting	All form submissions (encrypted)
Cloudflare	CDN and security	IP address, request metadata

We do not share data with advertising networks, data brokers, or social media platforms.

7. International Data Transfers

Data may be transferred to and processed in the United States. For Israeli and EU/UK residents, such transfers are conducted with appropriate safeguards including standard contractual clauses.

8. Children's Privacy (COPPA)

Our services are not directed to children under 13. We do not knowingly collect personal information from minors. If you believe a child has provided us with personal information, contact us immediately at [email protected].

9. Cookies

We use essential cookies only (session management, cookie consent preference). We do not use:

Advertising/targeting cookies
Third-party tracking cookies
Analytics cookies

10. Data Breach Notification

In the event of a data breach affecting your personal information:

Israel (Amendment 13): We will notify the Privacy Protection Authority (PPA) and affected individuals within 72 hours
United States: We will comply with all applicable state breach notification laws
EU/UK (GDPR): We will notify the relevant supervisory authority within 72 hours

11. Data Protection Contact

For any privacy-related inquiries, data subject requests, or complaints:

CHANDUCATE LLC
Privacy Officer
2108 N ST # 15977, Sacramento, CA 95816
Email: [email protected]
DSAR Form: chanducate360.com/api/dsar

12. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated "Last updated" date. Continued use of our services after changes constitutes acceptance of the updated policy.