Privacy Policy

BMP Advisory Inc. ("we", "our", "us") operates claudepmpro.com and the Claude PM Pro learning platform. This policy explains what personal information we collect, how we use it, and the rights you have. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Ontario's Consumer Protection Act. We extend equivalent rights to residents of the EU (GDPR), the UK (UK GDPR), and California (CCPA/CPRA).

1. Information we collect

1.1 Information you give us directly

• Contact details — first name, last name, email address, and (for enrolled learners) profile photo, bio, location, and social links you choose to add.
• Account credentials — password hash (bcrypt-encrypted; we never see or store your plaintext password) or Google account identifier if you sign in with Google.
• Payment metadata — billing name, billing country, and last-4 of card. We never see, store, or transmit full credit-card numbers — Stripe processes payments directly.
• Communications — messages you send us via brian@claudepmpro.com or the in-course community board.

1.2 Information we collect automatically

• Session cookies — a JWT stored in an HttpOnly cookie to keep you signed in.
• Behavioral data — pages viewed, lessons completed, webinar attendance (for enrolled learners) to improve the product.
• Technical data — IP address, browser type, and device type, retained for 30 days for security and abuse-prevention.

2. Third-party data processors

We use the following sub-processors. Each is bound by contract to protect your data:

• Stripe, Inc. (payment processing) — stripe.com/privacy
• Resend, Inc. (transactional and marketing email delivery) — resend.com/privacy
• Zoom Video Communications, Inc. (webinar hosting and attendance reporting) — zoom.us/privacy
• Google LLC (Sign-in with Google, when you choose that method) — policies.google.com/privacy
• Emergent, Inc. (course video and PDF object storage, application hosting)
• MongoDB, Inc. (database hosting, US region)

3. How we use your information

• Deliver the product — course access, video playback, community features, and webinar registration.
• Transactional email — receipts, sign-in confirmations, password resets, webinar reminders (24h / 1h / 10m before your chosen session), and post-webinar replay delivery. These are operationally necessary for the services you requested and are sent regardless of marketing preferences.
• Nurture email sequence — after you register for a webinar, you receive a 7-email educational sequence about the course. Under CASL, this is implied consent from your webinar registration and is valid for six months. You can unsubscribe at any time using the link in any email.
• Marketing email — only if you explicitly opt in (e.g. via the lead-magnet form) or when implied consent applies. Unsubscribe is one click, honored immediately.
• Product improvement — aggregated, non-identifying analytics.
• Legal compliance — to respond to lawful requests, prevent fraud, and enforce our Terms.

We do not sell your personal information to anyone, ever.

4. Your rights

You have the right to:

• Access — request a copy of all personal information we hold about you.
• Correct — ask us to fix inaccurate information (or update it yourself in your profile).
• Delete — ask us to delete your account and personal data. We honor deletion within 30 days, subject to a 7-year retention obligation for financial records under Canadian tax law (Section 230 of the Income Tax Act).
• Restrict processing — opt out of marketing at any time.
• Portability — receive your data in a machine-readable format (JSON).
• Complain — lodge a complaint with the Office of the Privacy Commissioner of Canada, or the equivalent authority in your region.

Email brian@claudepmpro.com with the subject line "Data request" and specify which right you're exercising. We respond within 30 days.

5. Data retention

• Account and course-access data — retained while your account is active. Deleted 30 days after you close your account.
• Financial records — retained 7 years to satisfy Canadian tax obligations.
• Webinar registration data — retained 24 months, then archived.
• Email logs — retained 12 months.
• Support conversations — retained 24 months.

6. International transfers

We are based in Canada. Some of our sub-processors (Stripe, Resend, Google, MongoDB) may store or process your data in the United States or the European Union. Where we transfer data outside Canada, we rely on contractual safeguards including Standard Contractual Clauses (SCCs) where applicable.

7. Security

We protect your data with industry-standard controls: TLS 1.3 for all traffic in transit, bcrypt password hashing, HttpOnly session cookies, role-based access controls, and least-privilege API keys. No system is perfect, however. If we ever discover a breach affecting your personal information, we will notify you and the Privacy Commissioner within 72 hours as required by PIPEDA and GDPR.

8. Children

Claude PM Pro is designed for working professionals. We do not knowingly collect data from anyone under 16.

9. Changes to this policy

Material changes will be announced by email to registered users and posted here with a new "Effective" date at least 14 days before taking effect.

10. Contact us

BMP Advisory Inc.
380 Macpherson Ave., Toronto, ON M4V 3E3, Canada
Email: brian@claudepmpro.com