Privacy Policy

Effective Date: April 1, 2026
Last Updated: April 9, 2026

Welcome to the Upward Spiral Program. We are committed to protecting your personal information and being transparent about how we collect, use, and share it. This Privacy Policy explains our practices for data collected through our website at https://upwardspiralprogram.com and related services (collectively, the “Service”).

Please read this policy carefully. By using our website or enrolling in the Upward Spiral Program, you agree to the practices described here.

Important note: The Upward Spiral Program is an online wellness and personal development program. It is not therapy, medical treatment, or a regulated health service. No clinical relationship is formed by using this Service.

1. Who We Are

The Upward Spiral Program is operated by Upward Spiral Program, based in Vancouver, BC, Canada.

Contact:
Upward Spiral Program
Vancouver, BC, Canada
Email: hello@upwardspiralprogram.com
Website: https://upwardspiralprogram.com

For the purposes of applicable privacy laws, Upward Spiral Program is the data controller responsible for your personal information.

2. Information We Collect

We collect information you provide directly to us, information generated automatically when you use the Service, and — in limited cases — information from third parties.

2.1 Information You Provide

Account and enrollment information: When you create an account or subscribe, we collect your name, email address, and billing address.
Payment information: Payment card details are entered directly into a secure payment form provided by our payment processor, Stripe (through WooPayments). We never see or store your full card number, CVV, or other sensitive payment credentials on our servers. We do retain transaction records such as the last four digits of your card, card type, billing address, and transaction amounts for billing and record-keeping purposes.
Communications: If you contact us by email or through any contact form, we keep a record of that correspondence.
Marketing preferences: If you opt in to receive our newsletter or marketing emails, we collect your email address and any preferences you indicate.

2.2 Information Collected Automatically

Usage data: We collect information about how you interact with our website and course content, including pages visited, videos watched, lessons completed, quiz results, and time spent on course materials.
Course progress data: Our learning management system (LearnDash) records your progress through course modules, lessons, and assessments so you can pick up where you left off. Because the Upward Spiral Program relates to personal wellbeing, we treat course progress data with heightened care and do not share it with third parties for marketing or profiling purposes.
Device and technical data: We collect your IP address, browser type, operating system, referring URLs, and general geographic location (derived from IP address).
Cookies and similar technologies: We use cookies and related tracking technologies as described in Section 5 below.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing and Managing Your Subscription

Creating and managing your account
Processing your subscription payments and free trial
Delivering access to course content and program materials
Tracking your course progress and sending progress-related notifications
Handling billing inquiries, refunds, and subscription changes

3.2 Communication

Sending transactional emails (receipts, login confirmations, password resets, subscription reminders)
Sending program-related updates and announcements
Responding to your questions and support requests
Sending marketing and newsletter emails if you have opted in (you may unsubscribe at any time)

3.3 Improving the Service

Analyzing how participants use the program to improve content and structure
Monitoring website performance and diagnosing technical issues
Conducting internal research and analytics

3.4 Legal and Security Purposes

Complying with applicable laws and regulations
Detecting and preventing fraud or unauthorized access
Enforcing our Terms of Service
Responding to lawful requests from public authorities

3.5 Legal Bases (for EU/EEA residents under GDPR)

If you are located in the European Union or European Economic Area, we process your personal data under the following legal bases:

Contract performance: Processing necessary to fulfill your subscription and deliver the Service (e.g., account creation, course access, billing).
Legitimate interests: Processing necessary for our legitimate business interests, such as improving the Service and preventing fraud, where those interests are not overridden by your rights.
Consent: Where we rely on consent, such as sending marketing emails — you may withdraw consent at any time without affecting the lawfulness of prior processing.
Legal obligation: Processing required to comply with applicable laws.

3.6 Anti-Spam Compliance (CASL)

We comply with Canada’s Anti-Spam Legislation (CASL). We will only send you commercial electronic messages (such as newsletters, promotional offers, or marketing updates) if you have provided express opt-in consent. You may withdraw consent at any time by clicking the “unsubscribe” link in any marketing email or by contacting us at hello@upwardspiralprogram.com. Transactional messages (such as receipts, subscription confirmations, password resets, and billing notices) do not require consent under CASL and will continue to be sent as part of the Service.

4. How We Share Your Information

We do not sell your personal information to third parties. We share your information only in the limited circumstances described below.

4.1 Service Providers

We work with trusted third-party service providers who process personal information on our behalf in order to operate the Service:

Stripe / WooPayments — Payment processing. Stripe is PCI-DSS compliant and processes your payment card data directly. Stripe’s privacy policy is available at https://stripe.com/privacy.
WordPress / WooCommerce — Website platform and subscription management. Our site is hosted on LearnDash Cloud, a managed hosting service operated by StellarWP (a Newfold Digital brand).
LearnDash — Learning management system that powers course delivery and tracks your progress.
FluentCRM — Email marketing and CRM platform used to send program communications and, with your consent, marketing emails.

All service providers are authorized to use your data only as necessary to provide services to us, and are contractually required to protect your information.

4.2 Legal Requirements

We may disclose your information if required to do so by law, court order, or government authority, or when we believe disclosure is necessary to protect the rights, property, or safety of Upward Spiral Program, our participants, or the public.

4.3 Business Transfers

If Upward Spiral Program is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website before your information becomes subject to a materially different privacy policy.

4.4 With Your Consent

We may share your information for any other purpose with your explicit consent.

5. Cookies and Tracking Technologies

We use cookies and similar technologies (such as web beacons and local storage) on our website. A cookie is a small text file placed on your device that helps us recognize you and remember your preferences.

5.1 Types of Cookies We Use

Essential cookies: Required for the website and your account to function properly. These enable you to log in, access course content, and complete purchases. These cannot be disabled without breaking core functionality.
Functional cookies: Remember your preferences and settings (such as language or login state) to improve your experience.
Analytics cookies: Help us understand how visitors use our website so we can improve it. We use Google Analytics (via the Google for WooCommerce integration) to collect information about website usage in aggregate or anonymized form where possible. Google’s privacy policy is available at https://policies.google.com/privacy.
Marketing cookies: Used to track visitors across websites for the purpose of serving relevant advertisements or measuring the effectiveness of marketing campaigns. We use these only where you have consented.

5.2 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, or be notified when a new cookie is set. Please note that disabling certain cookies may affect the functionality of the Service. Instructions for managing cookies in common browsers are available at www.allaboutcookies.org.

For California residents: please see Section 9.2 regarding your rights related to tracking technologies under CalOPPA.

6. Data Retention

We retain your personal information for as long as your account is active and for a reasonable period thereafter to comply with our legal obligations, resolve disputes, and enforce our agreements.

Active accounts: Data is retained for the duration of your subscription.
After cancellation or expiry: We retain account and transaction records for a minimum of seven (7) years to comply with Canadian tax and financial record-keeping requirements.
Marketing data: Email marketing records are retained until you unsubscribe or request deletion, after which we retain only a suppression record to honor your preference.
Cookies and analytics data: Retained in accordance with the settings of the relevant tool (typically 13–26 months for analytics cookies).

When your data is no longer required, we delete or anonymize it securely.

7. Your Privacy Rights

Depending on where you live, you may have specific rights regarding your personal information. We honor these rights regardless of your location, to the extent applicable.

7.1 Rights for All Users

You may, at any time:

Access your account: Log in to review the information stored in your account profile.
Correct your information: Update your name, email address, or billing details through your account settings or by contacting us.
Unsubscribe from marketing: Click the “unsubscribe” link in any marketing email, or contact us at hello@upwardspiralprogram.com.
Request information: Ask what personal information we hold about you.
Request deletion: Ask us to delete your personal information. Upon a verified request, we will delete or anonymize your data, except where retention is required by law (e.g., transaction records retained for 7 years per Canadian tax requirements) or necessary to complete a transaction you initiated. We will confirm what was deleted and what was retained, and why.

7.2 Rights Under PIPEDA (Canadian Residents)

As a Canadian business subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), we are committed to the following principles:

Access: You have the right to request access to your personal information and to be told how it is being used.
Correction: You may request that inaccurate information be corrected.
Withdrawal of consent: You may withdraw consent to the collection, use, or disclosure of your information at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may prevent us from providing certain services.
Complaint: If you believe we have not handled your personal information appropriately, you may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

7.3 Rights Under GDPR (EU/EEA Residents)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation:

Right of access (Article 15): Obtain a copy of the personal data we hold about you.
Right to rectification (Article 16): Have inaccurate or incomplete data corrected.
Right to erasure (Article 17): Request deletion of your personal data (“right to be forgotten”), subject to certain exceptions such as legal obligations.
Right to restriction of processing (Article 18): Ask us to limit how we use your data in certain circumstances.
Right to data portability (Article 20): Receive your personal data in a structured, machine-readable format and transfer it to another controller.
Right to object (Article 21): Object to processing based on legitimate interests or for direct marketing purposes.
Rights related to automated decision-making (Article 22): We do not make solely automated decisions that produce legal or similarly significant effects on you.
Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at hello@upwardspiralprogram.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority. A list of EU supervisory authorities is available at https://edpb.europa.eu.

7.4 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). While we believe our operations currently fall below the CCPA/CPRA thresholds, we respect the following rights for all California users:

Right to know: You may request what personal information we collect, use, disclose, and sell (if applicable). This Privacy Policy describes our practices.
Right to delete: You may request deletion of your personal information, subject to certain exceptions (e.g., legal record-keeping obligations).
Right to opt out of sale: We do not sell your personal information to third parties, as defined under CCPA/CPRA.
Right to non-discrimination: We will not discriminate against you for exercising any privacy rights.
Right to correct: You may request correction of inaccurate personal information we hold about you.
Right to limit use of sensitive personal information: We use sensitive personal information (such as course progress related to your wellbeing) only to provide the Service and do not use it for profiling or advertising.
Do Not Track: Our website does not currently respond to “Do Not Track” (DNT) browser signals, as no industry-wide standard exists for interpreting such signals.

To exercise your California privacy rights, contact us at hello@upwardspiralprogram.com. We will respond within 45 days as required by law.

8. International Data Transfers

Upward Spiral Program is based in Canada. If you access the Service from outside Canada, your information may be transferred to and processed in Canada or other countries where our service providers operate (including the United States, where Stripe and other technology providers may be located).

These countries may have different data protection laws than your home country. We take steps to ensure your information receives an adequate level of protection, including by using contractual safeguards with service providers. EU residents should note that Canada has been recognized by the European Commission as providing adequate protection for personal data for the purposes of commercial transfers.

9. Third-Party Websites and Services

Our website may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party websites you visit. We are not responsible for the content or privacy practices of third-party sites.

Our platform is built on and integrated with the following third-party services, each of which has its own privacy policy:

Stripe: https://stripe.com/privacy
WordPress / Automattic: https://automattic.com/privacy/
LearnDash: https://www.learndash.com/privacy-policy/
FluentCRM / WPManageNinja: https://wpmanageninja.com/privacy-policy/

10. Security

We take reasonable technical and organizational measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include:

SSL/TLS encryption for all data transmitted between your browser and our website
PCI-DSS compliant payment processing through Stripe — your full card details are never stored on our servers
Access controls limiting who within our organization can access personal data
Regular software updates and security monitoring

10.1 Data Breach Notification

In the event of a breach of security safeguards involving your personal information that we determine poses a real risk of significant harm to you, we will:

Notify the Office of the Privacy Commissioner of Canada as required under PIPEDA;
Notify you as soon as feasible, describing the nature of the breach, the personal information involved, the steps we are taking in response, and what you can do to protect yourself;
Where applicable, notify relevant third-party organizations (such as law enforcement) if doing so could help reduce the risk of harm; and
For EU/EEA residents, notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required under GDPR Article 33.

We maintain records of all breaches of security safeguards for a minimum of 24 months, as required by PIPEDA, regardless of whether they meet the threshold for notification.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee absolute security. In the event of a data breach that poses a risk of harm to you, we will notify you and the relevant authorities as required by applicable law.

11. Children’s Privacy

The Upward Spiral Program is designed for adults aged 18 and older. We do not knowingly collect personal information from anyone under the age of 18. If you are a parent or guardian and believe your child under 18 has provided us with personal information, please contact us at hello@upwardspiralprogram.com and we will promptly delete that information from our records.

If you are under 18, please do not use the Service or submit any personal information to us.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

Post the updated policy on this page with a revised “Last Updated” date
Send a notification to your registered email address
Where required by law, seek your consent to the updated terms

We encourage you to review this policy periodically. Your continued use of the Service after any changes become effective constitutes your acceptance of those changes.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:

Upward Spiral Program
Vancouver, BC, Canada
Email: hello@upwardspiralprogram.com
Website: https://upwardspiralprogram.com

We will do our best to respond to all inquiries within 30 days. If you are an EU resident and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.