Data Protection Policy

Last updated: November 8, 2026

This page explains how Promote Labs Inc. protects personal data and, as our Data Processing Addendum ("DPA"), how we handle data we process for our customers. It forms part of the Terms and Conditions between Promote Labs Inc. ("Processor") and each customer ("Controller") whose members', students' or buyers' personal data we process through our software, such as ProductDyno. It applies automatically when you use the Services; no signature is needed. If you need a signed copy, email privacy@promotelabs.com. How we handle our own customers' and visitors' data is explained in our Privacy Policy.

1. What we process for you

Item	Details
Subject matter	Running the Services you use (membership sites, courses, digital delivery, licensing, checkout, email and analytics)
Data subjects	Your members, students, buyers, leads and team members
Personal data	Names, email addresses, purchase and access records, license keys, course progress, login activity and IP addresses, and any data you add
Special categories	None. You agree not to send them.
Duration	While you use the Services, plus the deletion period below

2. Our commitments

• Process the data only on your documented instructions (these Terms and your settings), unless the law requires otherwise; we'll tell you if we think an instruction breaks the law.
• Make sure everyone with access is bound by confidentiality.
• Keep appropriate security measures (Section 5).
• Use only the categories of sub-processors listed below, under written terms at least as protective as this Addendum. We'll give 30 days' notice of a new category on this page or by email; you may object for reasonable data-protection reasons, and if we can't resolve it you may cancel and get a prorated refund of prepaid fees.
• Help you answer data subject requests and carry out impact assessments, as far as reasonable.
• Notify you without undue delay, and within 48 hours, after we confirm a personal data breach affecting your data, with the details we have.
• When your account is closed, delete or return your data within 90 days, unless the law requires us to keep it. You can export it before then.
• Make available the information needed to show compliance, and allow reasonable audits (normally by written questionnaire, at most once a year).

3. Your commitments

You're responsible for having a lawful basis and giving notice to your members and buyers (for example, in your own privacy notice), for honoring their opt-outs, and for the lawfulness of your instructions.

4. International transfers

Data is stored in the United States. For transfers from the EU/EEA, UK or Switzerland, the parties agree to the European Commission's Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where you're a processor), with the UK Addendum and Swiss amendments, which are incorporated by reference. Where a sub-processor is certified under the EU-US Data Privacy Framework, we may also rely on that.

5. Security measures

• HTTPS (TLS) for all traffic; hashed passwords; regular backups
• Least-privilege access for staff, with confidentiality obligations and data-protection training
• Firewalled servers, security updates and monitoring
• Rate limiting and abuse controls on public endpoints

6. US state laws (CCPA and others)

Where we act as your "service provider" or "processor", we won't sell or share the data, use it outside our direct relationship with you, or combine it with other data except as the law allows. We certify that we understand these restrictions.

7. Sub-processors

Sub-processor	What they do	Location
Amazon Web Services, Inc.	Hosting, file and video storage, backups	United States
Cloudflare, Inc.	Network security and content delivery	United States
PostHog, Inc.	Product usage analytics inside ProductDyno	United States
PayKickstart, Stripe, PayPal, JVZoo and WarriorPlus	Checkout, payments, subscriptions and refunds	United States
Help Scout PBC	Help desk, support email and knowledge base	United States
Email delivery providers	Sending account, course and product emails	United States
AI providers (such as Anthropic and OpenAI)	AI features you choose to use	United States

We'll update this list and give notice before adding a new sub-processor. This list, plus the advertising partners named in our Privacy Policy (Google and Meta), is our list of the third parties we disclose personal data to.

Other policies: Terms & Conditions · Privacy Policy · Refund Policy · Acceptable Use · Website Disclaimer · Earnings Disclaimer · Affiliate Disclosure