Privacy and cookies notice

Last updated: [EFFECTIVE DATE]

This notice explains how CMX Ventures Ltd uses your personal data when you use CMX+ (on the web and on iPhone) and CMX Pro (on the web). Our public website, cmxai.co.uk, is run separately and has its own notice. We do not sell your data, show you adverts, track you across other apps and websites, or use your data to train AI models.

Who we are

CMX Ventures Ltd is the controller of your personal data. We are a company registered in England and Wales (company number 17136973), with our registered office at Parkside, Station Road, St Mabyn, Cornwall, PL30 3BN. We are registered with the Information Commissioner's Office (ICO) under number [ICO REGISTRATION NUMBER].

Email: hello@cmxai.co.uk
Phone: [PHONE NUMBER]
EU representative: where the EU GDPR requires us to have a representative in the European Union, it is [EU REPRESENTATIVE]. You can always contact us directly instead.

What we collect and why

Information you give us

Account details: your email address, an optional name and a password. Sign-in is provided by Clerk, which stores your password in hashed form, and we never see it.
Age check: at sign-up we ask for your year of birth to confirm you are 18 or over. We do not store it. We only set a cookie recording that the check was passed or, if it was not, a cookie that blocks sign-up for a short time.
CMX Pro worksheet: the text you type into the AI Opportunity Map worksheet, so you can come back to it.
Certificate details: if you issue a CMX Pro certificate, the name you choose for it, the course, the date and a credential ID that we generate. A public verification page shows that name, course and date, and you can make it private at any time.
Text you type into AI features (CMX Pro): the AI tutor, the prompt sandbox and exercises that give AI feedback currently run in a demo mode with sample answers, so nothing you type is sent to an outside AI provider. If we switch them to live answers, what you type will be sent to Anthropic to generate a reply.
Messages to us: if you email us, we keep the correspondence so we can help you.

Information created when you use the service

Learning progress: your account ID, your plan, the lessons you have completed and the days on which you completed a lesson (for your streak). Your answers to quick checks and swipe cards are not stored, only the fact that you finished the lesson.
Subscription records: sent to us by Stripe (web) or Apple (iPhone): your plan, its status, trial and renewal dates, whether it is set to cancel, and the payment provider's identifiers. These are Stripe customer and subscription IDs, or Apple transaction IDs and a random account token that links an Apple purchase to your CMX account. We never receive your card or payment details.
Security data: Clerk processes your IP address and device and browser details to keep accounts secure. Our host, Vercel, keeps short-lived server logs of IP addresses, browser details and request times for security.
Preferences: small settings, such as the role you choose for personalised examples, are kept in your browser's storage. On iPhone, optional daily streak reminders are scheduled on your device by iOS. We do not run a push notification server or collect a device token.

Our lawful bases

Contract: to create and run your account, provide lessons and your streak, save your worksheet, issue certificates, manage your subscription and send service emails.
Legitimate interests: to keep accounts and the service secure, to prevent fraud and misuse, to make sure users are 18 or over, and to improve our lessons using our own records, without tracking tools. You can object to this (see "Your rights").
Legal obligation: to keep tax and accounting records, and to respond to lawful requests from authorities.
Consent: for optional streak reminders on iPhone, and for any marketing we might send in future. You can withdraw consent at any time, for example by turning reminders off.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects, and we do not profile you.

Emails

We send service emails only. Clerk sends sign-in codes. For web purchases, Stripe sends receipts, a reminder before a free trial ends and before an annual renewal, and cancellation confirmations. Apple sends its own receipts for iPhone purchases.

We do not send marketing emails. If we ever want to, we will ask for your permission first, and every marketing message will include an unsubscribe link and our postal address.

How long we keep data

Account and learning data: while your account is open. When you delete your account, we delete it within 30 days, including from backups.
Invoices and tax records: we keep the records we need for 6 years, as UK tax law requires. Stripe and Apple keep their own payment records under their own policies.
Server and security logs: for short periods set by our providers.
Emails with us: for as long as we need them to deal with your request.

Who we share data with

We use service providers (processors) who handle data on our instructions, under contracts that protect it:

Clerk, Inc. (USA): sign-in, account security and sign-in emails.
Supabase (database hosted in the EU, in Frankfurt): stores your learning and subscription records.
Vercel (USA): hosts the web app.
Stripe (USA): takes web payments, manages web subscriptions and sends payment emails. Stripe also uses some data as an independent controller, for example for fraud prevention and financial regulation, under the Stripe privacy policy.
Apple (USA): takes payment and handles billing for iPhone purchases, under the Apple privacy policy.
Anthropic (USA): only if CMX Pro's AI features are switched to live answers, to generate replies. Under Anthropic's commercial terms, the text you send is not used to train its models.

Lesson narration was recorded in advance using ElevenLabs, and no personal data is sent to ElevenLabs.

We may also share data where the law requires it, to protect someone's safety or our legal rights, with professional advisers bound by confidentiality, or with a buyer of all or part of our business, on terms that keep it protected. We do not sell your personal data, and we do not buy data from, or share data with, data brokers.

International transfers

Clerk, Stripe, Vercel, Apple and, if live AI answers are switched on, Anthropic process data in the USA. When your data leaves the UK or the European Economic Area, we rely on:

for UK data: the UK Extension to the EU-US Data Privacy Framework, where the provider is certified, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses;
for EU data: the EU-US Data Privacy Framework, where the provider is certified, or the EU Standard Contractual Clauses.

You can ask us for more information about these safeguards.

Cookies and similar storage

We use only cookies and storage that are strictly necessary to provide the service you ask for, so we do not show a cookie consent banner.

Clerk session cookie (for example, the cookie named __session): keeps you signed in securely.
Clerk client cookie (named __client_uat): helps the app check whether you are signed in.
cmx_age (set by CMX): records that you passed the age check. It lasts 12 months.
Stripe cookies: set on Stripe's own checkout page while you pay, for payment security and fraud prevention.
Browser storage: small preferences, such as the role you chose for examples. You can clear it in your browser settings.

We do not use analytics, advertising or tracking cookies, tracking pixels, session replay or advertising identifiers, on the web or on iPhone. Our fonts are hosted by us, so your browser does not contact font services. The iPhone app does not track you across other companies' apps and websites, so it does not ask for permission to do so.

Children

CMX+ and CMX Pro are for adults aged 18 and over. If we learn that a user is under 18, we close the account and delete their data.

In line with the US Children's Online Privacy Protection Act (COPPA), our service is not directed to children under 13 and we do not knowingly collect personal information from children under 13. If you think a child has given us personal information, contact us and we will delete it.

Your rights

If you are in the UK or the EU, you have the right to:

access your personal data and receive a copy;
have inaccurate data corrected (rectification);
have your data erased;
ask us to restrict how we use your data;
receive your data in a portable format (portability);
object to processing based on legitimate interests;
withdraw your consent at any time, where we rely on consent.

How to use them

Download my data: in Account, choose Download my data to get a JSON file of the data we hold about you.
Delete account: in Account, choose Delete account. This deletes your CMX account and learning data, and cancels a web subscription immediately. If you subscribed on iPhone, you must also cancel with Apple, or Apple will keep charging you.
Email us at hello@cmxai.co.uk for anything else. We will reply within one month, or tell you if we need longer as the law allows. We may need to confirm your identity. There is normally no charge.

Complaints

You can complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection supervisory authority in the EU country where you live or work.

California residents

Categories we collect: identifiers (email address, name, account ID, IP address, Stripe and Apple identifiers); customer records (name and email address); commercial information (plan, subscription status and dates); internet or other electronic network activity (device and browser details, server logs, lesson progress); and sensitive personal information limited to your account sign-in details, which we use only to sign you in and keep your account secure.
Sources, purposes and retention: as described above.
Disclosures: only to the service providers listed in "Who we share data with", for business purposes.
No sale or sharing: we do not sell your personal information or share it for cross-context behavioural advertising, and have not done so in the past 12 months. We have no actual knowledge of selling or sharing information of anyone under 16.

You have the right to know what personal information we collect, use and disclose, and to ask us to delete or correct it. We will not discriminate against you for using these rights. You, or an authorised agent, can make a request by emailing hello@cmxai.co.uk. We will verify requests using your account email.

Security

Our safeguards include:

encryption in transit (HTTPS) for all connections to the app;
passwords handled by Clerk and stored only in hashed form;
a database with restricted access and row-level security, so each account can reach only its own records;
least-privilege access, so people and systems get only the access they need.

Changes to this notice

We may update this notice when our service or the law changes. If we make a significant change, we will tell you in advance.

Contact

CMX Ventures Ltd, Parkside, Station Road, St Mabyn, Cornwall, PL30 3BN. Email hello@cmxai.co.uk or call [PHONE NUMBER].