Privacy policy
What success.digital holds about you, where it is held, and what you can do about it.
Last updated 14 September 2026
It is a draft. 4 details are still outstanding, and it has not been reviewed by a lawyer. Do not rely on it.
- State of incorporation — The governing law and the courts a dispute is heard in.
- Registered address — A contract has to name the party it binds.
- Contact address for notices — Where a customer sends a legal notice or a termination.
- Contact address for data requests — Where a member sends an access, correction or deletion request.
Two roles, and which one we are
When you run a community here, you decide what it collects and why — you are the controller. We hold and process it on your instructions: we are your processor. The data-processing addendum is the contract for that.
We are the controller for one narrow thing: your own account with us as a host — your sign-in address, your billing details, and the logs we keep to run and secure the platform.
What is held
- Your account — the email address you sign in with. Passwords are stored hashed by Supabase Auth and are never visible to us.
- Your profile in a community — the name you chose, a picture and cover if you uploaded them, a short bio, your links, the rooms you joined and when you joined.
- What you write — posts, discussions, replies, comments, events, RSVPs, poll votes, reactions and direct messages.
- Courses — which you enrolled in, which lessons you finished and any quiz attempts.
- Operational records — moderation actions, notification preferences, and rate-limit counts. Enough to run the place and answer a complaint.
We do not run advertising, we do not sell anything to anybody, and we do not use what you write to train models.
Where it is held
Fabulous Limited is a United States company, and the data is not. It lives in Mumbai, India.
| Who | What they do | Where |
|---|---|---|
| Supabase | Database, file storage, authentication | Mumbai, India (AWS ap-south-1) |
| Vercel | Application hosting and delivery | Global edge network; requests are served from the nearest region |
| SocketLabs | Sending notification and transactional email | United States |
If you are in the European Economic Area or the United Kingdom, that is a transfer outside it, and we rely on the European Commission’s standard contractual clauses. If you are in India, your data stays in India.
Who can see what
Access is decided by the database rather than by the pages, so what a screen shows and what a request can fetch are the same answer:
- A visitor sees a public community’s public posts, its writing and the names of its courses. Not its member list, not its profiles, not anything marked members-only.
- A member sees what their community allows, room by room.
- A host sees their community’s members and content, and can hide or remove what breaks their rules. A host cannot read direct messages. No role can: only the people in a conversation can read it.
- We can reach the database to operate and repair the service. Every visit a platform administrator makes to a community is logged in that community’s own record, visible to its host.
How long
While your account is open. When you leave a community, your profile and everything personal about you goes immediately — your preferences, your reactions, your RSVPs, your direct messages, your picture. What you wrote stays, with no author on it, so the discussions other people joined in are not deleted out from under them. You can choose to delete what you wrote as well, and replies other people left underneath it go with it.
Deleting your account does that for every community you are in, and then removes the account. It is immediate and it cannot be undone. Backups roll off within thirty days.
What you can do
- See it — your profile page shows what others see; Settings shows the rest.
- Correct it — Settings, your profile.
- Take it — Settings, your account, Download your data. One file, everything you wrote and every record about you, per community.
- Delete it — Settings, your account. Leave a community, or delete the account.
- Object or complain — write to us, and to your data protection authority if we have not put it right.
For anything about a community’s own content, the host is the controller and the first person to ask. We will help them answer you.
Children
The platform is not for children under 13, and where local law sets a higher age for consent to processing, not for anybody under that age. We do not knowingly hold a child’s data; tell us and we will remove it.
Cookies
A session cookie to keep you signed in, and a preference cookie remembering whether you asked for light or dark. That is all. There is no advertising or analytics cookie, so there is no consent banner to click past.
Reaching us
Data requests go to [data request address].