Privacy Notice
Effective date: 30 September 2026
This Privacy Notice explains what personal information BrightThrough collects, why we use it, how we protect and share it, and the choices and rights available to you.
1. Who is responsible for your information
BrightThrough is operated by Maltzman Aizen Monica in Uruguay. Maltzman Aizen Monica is the data controller, or equivalent responsible party, for personal information that BrightThrough decides to collect and use.
Privacy, account, and data-rights questions can be sent to help@monicamaltzman.com.
2. Where this Notice applies and who helps us provide BrightThrough
This Notice applies to personal information BrightThrough controls in connection with the product, your account, the public website, product improvement and research, purchases, and support. Third-party services may also process information under their own privacy notices.
| Service provider | What they do |
|---|---|
| Gumroad | Processes purchases as Merchant of Record, including payments, applicable transaction taxes, receipts, and refunds. Gumroad handles transaction and payment information under its own Privacy Policy. |
| Supabase | Provides account sign-in and stores approved BrightThrough account, access, profile, and product information. |
| Netlify | Hosts and delivers the BrightThrough website and product and supports related technical security and traffic handling. |
| Resend | Sends transactional emails such as access, sign-in, and recovery messages. BrightThrough does not enable marketing-style open or link tracking for these messages. |
| PostHog | Helps us understand use of the public site and product when analytics are enabled. We configure it without session replay or broad automatic capture of page and form content, and private workplace text is not sent to PostHog. |
| Meta | May be used on the public website for advertising attribution and purchase-conversion measurement when permitted. Meta tracking is not used inside the signed-in BrightThrough workplace product. |
3. Information we collect
Depending on how you use BrightThrough, we may collect the following categories of information:
- Account and access information, such as your email address, account identifiers, access status, security records, and records needed to document notices or agreements.
- Onboarding profile information you choose to provide, including country of work, seniority, leadership or people-management status, industry, age range, and gender. Where offered, you can choose Prefer not to say.
- Assessment information, including structured selections about workplace situations, impact, and the kind of help you need, together with the results used to organize what BrightThrough shows you.
- Private workplace content you enter, such as event details, notes, descriptions, Action Card edits, custom wording, drafted follow-up messages, or private After records used by features you choose.
- Saved product information, where a feature supports continuity for your own use, such as confirmed Plans, Cards, preferences, or structured progress information.
- Product-use and feedback information, such as which parts of BrightThrough you use, the structured choices you make, version information, usefulness feedback, and pseudonymous identifiers used to improve the product. Private workplace free text is not included in this analytics or research information by default.
- Public website and marketing information, such as a random or pseudonymous website-session identifier, the pages or calls to action you use, limited campaign-source information, and, when marketing analytics are permitted, limited Meta browser or click identifiers.
- Purchase information provided by Gumroad, such as purchase status, transaction or order identifiers, the purchase email needed to provide access, product information, and refund or reversal status. BrightThrough does not receive or store your full payment-card details from Gumroad.
- Information you send us directly, for example when you contact support, privacy, account, security, or research channels.
4. Why we use information
- To create and maintain your account, verify your purchase and access, help you recover access, and provide the BrightThrough service you purchased.
- To process the workplace information you choose to provide and deliver the Understand, Plan, Prepare, Handle, and After experiences or outputs you request.
- To save information where a feature explicitly supports continuity for your own use.
- To operate, secure, troubleshoot, maintain, and improve BrightThrough.
- To use profile, usage, and feedback information to understand patterns, improve BrightThrough, develop benchmark findings when the evidence and methodology support them, and evaluate product quality over time.
- To understand how people find the public website and move toward a purchase, without sending private workplace activity or content to advertising platforms.
- To respond to support, privacy, account, security, or legal requests and comply with applicable obligations.
Depending on your location and the activity involved, our legal basis may include performing our contract with you, our legitimate interests in operating, securing, and improving the service, consent where required, and compliance with legal obligations. Where the law requires a separate choice or consent, BrightThrough will ask for it rather than treating this Notice as blanket consent.
5. How we keep private workplace content separate from analytics and research
BrightThrough is designed to keep your account identity and private workplace content separate from analytics and research information.
- Your email is used where needed for purchases, account access, security, and support. We do not need to copy your email into every product record.
- Removing an email address does not make workplace free text anonymous. Private workplace text may contain names or other identifying details, so it remains protected as private product information when a feature needs it.
- Private incident descriptions, Action Card text, edited or custom wording, drafted messages, private After records, and similar free text are excluded from BrightThrough analytics, PostHog, Meta, and benchmark outputs by default.
- Where legally permitted, BrightThrough may use a separate pseudonymous research identifier to connect selected usage and feedback information over time. This does not require your email.
- Benchmark outputs use aggregated or de-identified statistics based on defined methods. They do not contain your email, account identifier, research identifier, or private workplace narrative.
- BrightThrough does not use private workplace content to train third-party AI models by default.
- If BrightThrough prepares wording or another item that you may use outside the product, nothing is sent automatically. You decide whether to copy, send, show, or otherwise share it.
6. Analytics, cookies, and marketing technologies
BrightThrough may use technologies that are necessary for account security, sign-in, session continuity, fraud prevention, and core site or product operation. These essential technologies are separate from optional analytics or advertising measurement.
When PostHog analytics are enabled, PostHog receives only limited information about how the public site and product are used. Session replay and broad automatic capture of page or form content are disabled, and private workplace text is not sent. Where PostHog provides the relevant controls, we disable use of BrightThrough analytics data for PostHog’s own model or product development.
Meta Pixel and related conversion tools, when enabled, are limited to the public website and purchase journey. They may record events such as page views, checkout starts, and confirmed purchases. Meta does not receive your signed-in BrightThrough activity, onboarding profile, workplace-situation information, Action Card or draft content, or private workplace text.
Where applicable law requires permission before optional analytics or advertising technologies are used, BrightThrough will ask for that choice first. Your ability to purchase, access your account, and use the core product does not depend on accepting optional analytics or advertising tracking. Where a preference control is provided, you can change your choice there.
7. How information is shared
Information may be processed by the service providers listed above and by other providers that help us operate, secure, support, or maintain BrightThrough. They receive information only as reasonably needed for their role and subject to applicable contractual, security, and privacy protections.
Information may also be disclosed where required by law, court order, or valid legal process, or where reasonably necessary to protect the security, rights, or integrity of BrightThrough, its users, or others.
BrightThrough does not sell your private workplace content. Your workplace information is not automatically shared with your employer, coworkers, clients, external contacts, or other BrightThrough users. Limited public-site advertising and conversion information may be shared with Meta only as described in Section 6.
8. Storage, security, retention, and account closure
BrightThrough uses reasonable technical and organizational safeguards designed to protect personal information, including access controls, protected service infrastructure, and least-privilege practices where appropriate. No system can guarantee absolute security.
- Account and saved product information. Information you need to use BrightThrough is kept while your account is active and for as long as the relevant feature requires it. Private workplace content is stored only where a feature requires storage for your own use.
- Product-improvement and benchmark information. Usage and feedback information may be retained for the product-improvement and benchmark purposes described in this Notice. Any link between your account and research information is kept separately and only while that link is permitted and needed. Aggregated or de-identified benchmark statistics may be retained after individual linkage is removed.
- Account closure. When account closure or deletion is completed, BrightThrough will remove account-owned product information and private workplace content from our live systems within 30 days unless a specific item must be retained for a legal, security, fraud-prevention, dispute, or support reason. Any permitted link between your account and research information will also be removed or de-identified within 30 days unless a lawful reason requires a longer period.
- Purchase, legal, security, and support records. Limited transaction, legal, security, and support records may be retained for as long as reasonably necessary to comply with law, establish or defend legal rights, prevent fraud, resolve disputes, or document a purchase. These records do not require us to retain private workplace content.
- Backups. Residual copies may remain temporarily in protected provider backups until normal backup rotation completes. Backups are not used as active product or analytics data except where restoration is necessary for security or disaster recovery.
9. International processing
BrightThrough may use infrastructure or service providers located outside your country. Where personal information is transferred internationally, BrightThrough will use the contractual, technical, organizational, or other safeguards required by applicable law.
10. Your choices and rights
Depending on the law that applies to you, you may have rights to receive information about processing, access personal information, correct or update it, request deletion or suppression, object to or restrict certain processing, request portability, withdraw consent where consent is the legal basis, or complain to a data-protection authority.
You may choose Prefer not to say for onboarding profile fields where that option is provided. Optional analytics choices and voluntary research participation are separate from your right to use the BrightThrough product you purchased. Refusing or withdrawing an optional choice does not remove your access to the core product, although the related optional measurement may stop.
Send privacy or data-rights requests to help@monicamaltzman.com. We may need to verify that the request relates to your account before acting on it. Requests will be handled within the time required by applicable law.
11. Information about other people
Workplace situations often involve other people. Please avoid entering unnecessary direct identifiers or sensitive personal information about coworkers, managers, clients, patients, students, customers, external contacts, or other individuals. Only provide information that is reasonably necessary for the BrightThrough feature you are using and that you are entitled to provide.
12. Age
BrightThrough is intended for adults aged 18 or older. If you believe personal information from someone under 18 has been provided to BrightThrough in a way that should not have occurred, contact help@monicamaltzman.com.
13. Changes to this Notice
The effective date of this Privacy Notice appears at the top of this page. If a material change requires renewed notice, permission, consent, or another action under applicable law, BrightThrough will provide that step before the affected processing continues.
14. Contact
Maltzman Aizen Monica
Uruguay
monicamaltzman.com
help@monicamaltzman.com