Privacy policy
Privacy policy.
What you share with Upward Spiral, how it is used, and the choices you have.
Last revised
What this policy covers
This policy explains how Upward Spiral handles personal information when you browse this public website, contact us, ask to be told when enrolment opens or choose to receive the newsletter. Personal information means information that can identify you, either on its own or together with other information.
The participant app has its own privacy information for accounts, payments, learning progress, personal notes and Feedback. You can review it before joining. Visiting this website does not create a program account or give us access to the contents of your device.
Information you choose to share
When you contact us, through the contact form or by email, we receive your name, email address, enquiry topic and message. We use these details to understand your question, reply and keep relevant correspondence together. If you continue the conversation, we also receive the information in your replies.
Newsletter signup asks for an email address and first name, together with your choice to receive the newsletter. We record the consent wording and version, request and confirmation times, and subscription changes so we can manage your choice.
Please share only what is needed. Do not send passwords, sign-in links, payment-card details, private learning notes, medical records or unnecessary information about another person. A question about Pay What You Can does not require a detailed financial or health history.
Information involved in a website visit
Your browser sends technical information when it requests a page, image or recording. Our hosting and security services may process your IP address, request time, requested page, browser or device information, referring page and error information to deliver the website, diagnose faults and protect it from misuse.
When an active form uses a security check, Cloudflare Turnstile processes technical signals to distinguish ordinary visitors from automated abuse. The form sends the information needed to validate that check. Our application also uses short-lived records to limit repeated requests and avoid duplicate delivery.
These technical records are not your private program notes or learning history. Avoid putting personal information into a page address, because addresses can appear in browser history and hosting logs.
How we use your information
We use website information to deliver requested pages, answer enquiries, provide the newsletter or launch notice you choose, maintain consent and unsubscribe records, investigate technical problems and protect the service. Specific records may also be needed for a legal obligation or complaint.
Sending an enquiry, browsing an article or enrolling in the program does not subscribe you to marketing. A privacy policy is not permission for unrelated uses. If a new use requires consent, we will explain it and ask before proceeding.
We do not sell contact details or newsletter subscriptions, rent them to mailing lists, or use private messages as testimonials without separate permission.
Newsletter consent and unsubscribe
Subscribing is optional. We send a confirmation email after a signup request, and the subscription becomes active only when you confirm it. Confirmation links expire after 24 hours; you can make a fresh request if a link has expired.
Every newsletter includes a way to unsubscribe. An unsubscribe stops newsletter marketing and cancels older pending confirmations. We keep a limited record of that choice so a later import or retry does not add you back by mistake. A later subscription requires a new request and confirmation.
Unsubscribing does not cancel program access, stop a payment plan or prevent necessary account and service messages. Those are managed separately in the app. If newsletter records move from the former website, existing consent and unsubscribe choices must be preserved. A migration is not fresh permission to email someone.
The launch notification list
Before enrolment opens, the Join page lets you leave an email address, and optionally a first name, so we can tell you when it does. We send a confirmation email first, and your address joins the list only when you confirm. Confirmation links expire after 24 hours; you can make a fresh request if a link has expired.
We use these details only to confirm your request and to send the notice that enrolment is open. We also record what you agreed to, when you requested and confirmed it, and any withdrawal. Joining this list is separate from the newsletter and does not subscribe you to it, and it does not create a program account or a payment.
You can leave the list at any time with the link in your confirmation email. Leaving removes your email address and name from the list and cancels any pending request; we keep a limited pseudonymous record of the withdrawal so an older confirmation link cannot add you back. Once the launch notice has been sent, the list has served its purpose and is deleted.
The services that help us run the website
Vercel hosts this public website, and our domain name is managed at SiteGround. Resend delivers the confirmation and notification emails for the launch list and the newsletter, and Upstash holds subscription, consent and security records. Cloudflare Turnstile provides a security check when a form uses one. Google Workspace handles our enquiry correspondence.
A contact message and reply address pass through the delivery service to our inbox. Newsletter delivery involves your email address and the information needed for confirmation and unsubscribe. The shared security store uses protected identifiers for abuse and duplicate-delivery checks; it does not hold contact-message text.
Providers process information for their service, support, security and legal responsibilities under their own terms and privacy information. We remain responsible for our choices about which information to collect and why.
Where information may be processed
Provider infrastructure, email delivery, security checks and support access can involve processing outside Canada, including in the United States. Another country's laws may permit its authorities to access information in circumstances different from those in Canada.
We do not promise that every copy or item of technical metadata stays in Canada. You can ask our Privacy Lead about the services involved before sharing information.
Cookies, browser storage and outside links
The public website does not include advertising pixels, cross-site advertising trackers or a third-party audience-analytics script. Hosting and security services may use cookies or similar mechanisms to deliver and protect the site. An active security check is separate from newsletter consent.
You can control cookies through your browser. Blocking a necessary security function may prevent a form from working. Our contact form does not save a draft to browser storage; refreshing or closing the page can remove what you have typed.
Links to research, the participant app, payment services or other websites lead to services with their own privacy information. We do not control how an outside website handles your visit.
How long information is kept
Contact correspondence is kept while dealing with an enquiry and for the follow-up, complaint handling or legal purpose that still requires it. Information should be deleted or made anonymous when no longer needed for those purposes. We do not promise immediate deletion of every email or provider copy.
Confirmed newsletter records are kept while the subscription is active. Unconfirmed signup and related retry records expire after 48 hours. On unsubscribe, the subscription store removes the active email address and name, while keeping limited consent, protected-identifier and unsubscribe records to respect the opt-out. Earlier email-provider correspondence is not immediately removed by that action.
Short-lived form-security records expire automatically. Contact-delivery acknowledgments used to avoid duplicate messages last for 24 hours. Hosting logs, inbox records and provider recovery copies have separate retention arrangements. Deleted information may remain in restricted backup copies until those copies expire.
Specific records may need to be retained for a legal requirement, unresolved dispute or documented security investigation. We limit that retention to its purpose and can explain an exception relevant to your request. The app's retention and deletion arrangements are described separately.
Protecting your information
We use encrypted website connections, server-side form validation, limited service credentials and abuse controls. Enquiry and subscription information is intended for the people and providers who need it to handle a request or operate the service.
No online service or email system can guarantee absolute security. The contact form is not an end-to-end encrypted clinical channel. Limiting what you share reduces the information exposed if a message is misdirected or a service is compromised.
If an incident affects your information, we will assess it, take appropriate containment steps and provide the notices required by applicable law. Contact us if you believe a message or link claiming to be from Upward Spiral is suspicious.
Access, correction and deletion requests
You can ask what personal information we hold about you, request a correction, ask about deletion, or withdraw consent for an optional use. Use the contact form and say that your message is for the Privacy Lead. Tell us enough to identify the records, but do not send identity documents or sensitive information unless we agree a suitable way to verify the request.
We may need to confirm ownership before disclosing or changing information. We respond within the time required by the law that applies, and explain any lawful extension or limitation. A response may need to protect another person's information or preserve legally required records.
Withdrawal does not undo processing already completed. Where information is necessary to reply or provide a service, withdrawing permission can mean we cannot continue that service. Newsletter unsubscribe, program cancellation and app-account deletion are different actions; ask if you are unsure which you need.
If you use the participant app
The app needs information beyond a public website visit, such as an account email, access dates, policy acknowledgments and learning progress. Personal notes and Feedback are optional. Payment arrangements involve separate payment-provider information and authorizations.
Read the app's current privacy information before accepting its agreements. It explains the actual providers, operator access, storage, recovery copies and export or deletion options. This website policy does not promise that app notes are end-to-end encrypted, monitored for safety or visible only to you.
The program is designed for adults aged 19 or older. If you believe a child has sent personal information through the public website, contact the Privacy Lead so we can assess and address it.
Questions or a privacy concern
Our Privacy Lead handles questions about the public website's information practices and privacy requests. Contact Upward Spiral through the form and identify your message as a privacy question. We will work with you to understand the concern and explain the next step.
You can also raise a concern with the Office of the Information and Privacy Commissioner for British Columbia, or the regulator responsible for your situation. Contacting us does not remove that choice. Support messages are not continuously monitored and should not be used for urgent help.
Changes to this policy
The revision date shows when this wording last changed. We will explain a material change to information use or sharing before it takes effect and seek fresh consent where required. Updating a policy does not turn an earlier enquiry into marketing consent or erase an unsubscribe choice.