Privacy Policy
Last updated: 19 September 2026
Effective: 19 September 2026
1. Who I am
I am Craig Perry, a sole trader based in Ireland. I am the data controller responsible for the personal information described in this policy.
Email: contact@profoundideas.com
Postal address: Willsborough Industrial Estate, Priorswood, Dublin 17, D17 AE67, Ireland
If you have a question about this policy or about how your information is handled, email me at the email address above.
2. What this policy covers
This policy covers the personal information collected when you:
- visit my course landing page
- go through the checkout to purchase a course
- access the course after purchasing
It does not cover Substack. If you subscribe to my newsletter, you do that on Substack's own platform, and Substack's privacy policy applies to that.
3. What information is collected, and why
When you visit the landing page
My pages are hosted on Kajabi. Kajabi sets cookies on them, and its servers keep the standard technical records any web host keeps in order to serve a page and protect against abuse. Some of these cookies are necessary for the pages to load and function; others are not. See section 7. The full detail of what Kajabi records and stores is set out in Kajabi's own privacy documentation.
Purpose: to deliver the page to you and keep it secure. Legal basis: legitimate interests — the site needs to function and be protected against misuse.
Anonymous page view counting
I use Plausible Analytics to count page views on the landing page and checkout page. Plausible is cookieless. It does not set any cookies, does not collect personal data, and does not store IP addresses. Your IP address is used momentarily to determine your approximate country or region, then discarded — it is never stored. The data Plausible collects is aggregate only (for example, "12 visitors from Ireland today") and cannot identify any individual visitor.
Plausible is a European company incorporated in Estonia. All visitor data is processed and stored exclusively in the European Union, on servers owned by Hetzner (Germany) and UpCloud (Finland). No visitor data leaves the EU.
Purpose: to understand how many people visit the landing page and checkout page, and where they come from in aggregate. Legal basis: legitimate interests — understanding overall traffic patterns to improve the site. No consent is required because no personal data is collected and no cookies are set.
Page experience analysis (landing page and checkout page only)
If you accept analytics cookies, I use Microsoft Clarity on the landing page and checkout page to understand whether the pages are working well for visitors — for example, whether buttons are easy to find, whether anything is confusing or broken, whether the page loads correctly, and where visitors lose interest or get stuck. Clarity does this by recording how visitors interact with the page: mouse movements, clicks, and scroll behaviour.
Clarity is not installed on any course pages. It only runs on the landing page and checkout page, and only if you accept analytics cookies in the cookie banner. If you decline, Clarity does not load and no data is collected.
I am the only person with access to the Clarity dashboard. No one else can see the recordings or data. Clarity automatically masks text on the page in recordings, so the content of what you type is not visible. Clarity does not record keystrokes, and it does not capture any information you enter into forms (such as your name, email, or payment details at checkout).
The data controller for Clarity is Microsoft Ireland Operations Ltd., based in Dublin. Data is stored on Microsoft Azure servers in the United States. The legal basis for this transfer is the EU-US Data Privacy Framework, under which Microsoft is certified, supplemented by Standard Contractual Clauses. See section 4 for more detail.
Purpose: to identify and fix problems with the landing page and checkout page — things like broken elements, confusing layouts, slow-loading sections, and anything else that makes the pages harder to use. Legal basis: consent — Clarity only runs if you accept analytics cookies.
When you buy the course
To process your purchase, the following is collected:
- your name
- your email address
- your billing information
- your payment details
Payments are processed by Stripe. Your card details are entered directly into Stripe's secure checkout. I never see or store your card number.
Purpose: to take your payment, give you access to the course, send you your receipt and any information you need about your purchase, and to keep the sales records I am required by law to keep. Legal basis: performance of a contract (I cannot deliver the course without this), and legal obligation (Irish tax law requires me to retain records of sales).
When you use the course
Kajabi records your login and your progress through the course — which lessons you have opened and completed.
Purpose: to give you access to your account and let you pick up where you left off. Legal basis: performance of a contract.
Emails I send you
Everyone who buys receives emails necessary to the purchase itself: your receipt, your login details, and any information you need to access the course. These are not marketing and you cannot unsubscribe from them, because without them you could not use what you bought.
Legal basis: performance of a contract.
The course is updated over time, and I will occasionally email everyone who has bought it to let them know when something has changed or been added. You paid for lifetime access, so this is part of what you bought rather than marketing.
Legal basis: performance of a contract.
I may occasionally email past customers directly to ask for feedback or a testimonial about the course. You are never obliged to reply, and if you would prefer not to receive these, email me and I will not contact you again.
Legal basis: legitimate interests — improving the course and understanding how it has worked for the people who took it. You have the right to object to this at any time (see section 6).
I do not run a marketing mailing list from this site and there is no marketing opt-in at checkout. Buying the course does not subscribe you to anything.
4. Who your information is shared with
I do not sell your personal information, and I do not share it with anyone for any purpose other than delivering and improving the course. No third party receives your information for their own use. The providers listed below process data on my behalf and under my instruction only — they do not have independent access to use it for their own purposes.
| Provider | What they do | Who can see the data | Where data is processed |
|---|---|---|---|
| Kajabi | Hosts my pages, runs the checkout, hosts the course and your account | Me only | United States |
| Stripe | Processes your payment | Me only (I never see card numbers) | Ireland, with some transfer to the United States |
| Plausible Analytics | Counts page views anonymously — no personal data is collected | Me only (data is aggregate and anonymous) | European Union (Germany and Finland) |
| Microsoft Clarity | Page experience analysis on the landing page and checkout page — only for visitors who accept analytics cookies | Me only | United States (Microsoft Azure) |
Apple Pay and Google Pay may appear as payment options at checkout. These pass your payment through to Stripe; they do not create a separate relationship with me.
I may also disclose information where I am legally required to — for example, to the Revenue Commissioners, or in response to a valid legal request.
If the business changes hands
I currently operate as a sole trader. If I later incorporate as a limited company, or if the business is transferred to another owner, customer records would pass to that new legal entity as part of the business. If that happens, this policy will be updated to name the new controller before the change takes effect.
Transfers outside the European Economic Area
European law only allows personal data to leave Europe if it stays protected to the same standard once it gets there. The European Commission has not judged the United States to meet that standard, so anything sent to a US company needs a specific legal safeguard in place.
Kajabi is a US company, so your information does go to the United States. The safeguard used is a contract called the Standard Contractual Clauses, written by the European Commission, which legally binds a US company to protect European data to European standards. Kajabi has signed these, and its Data Protection Addendum states that all transfers of personal data out of the EEA are governed by them. Kajabi explains this at help.kajabi.com, in its article on the Data Protection Addendum and Standard Contractual Clauses.
Stripe is different. The Stripe entity you deal with is an Irish company, registered in Ireland with the Irish Data Protection Commission, and it has primary responsibility for handling personal data outside the Americas. Your payment information therefore stays within Europe in the first instance. Where Stripe does send data to the United States, it relies on the same Standard Contractual Clauses.
Plausible Analytics is a European company. All visitor data is processed and stored exclusively in the European Union on infrastructure owned by European companies. No data leaves the EU.
Microsoft Clarity data is processed by Microsoft Ireland Operations Ltd., based in Dublin. Data is stored on Microsoft Azure servers in the United States. The legal basis for this transfer is the EU-US Data Privacy Framework, under which Microsoft Corporation is certified, supplemented by Standard Contractual Clauses.
5. How long information is kept
| What | How long | Why |
|---|---|---|
| Sales and payment records (including the name and email attached to a purchase) | 6 years from the end of the tax year the purchase falls in | Required by Irish tax law (Taxes Consolidation Act 1997). I have no discretion over this. |
| Records of refunded purchases | 6 years, same as above | The transaction still happened. I need the record for tax purposes and in case of a later dispute or chargeback. Course access ends, but the record of the sale and refund does not. |
| Your course account and login | For as long as you have access to the course | So you can use what you bought |
| Course progress data | For as long as you have access to the course | So you can pick up where you left off |
| Your email address in my Kajabi contacts | For as long as you have access to the course | It is how I reach you about the course you bought |
| Cookie and technical data | As set out in Kajabi's cookie notice | Set by the platform, not by me |
| Plausible Analytics data | Indefinite, but anonymous and aggregate | No personal data is stored |
| Microsoft Clarity data | 13 months (Clarity default retention) | Set by Microsoft |
If you ask me to delete your account, I will. The sales record must be kept regardless, because tax law requires it and because I may need it if a payment is later disputed. That applies equally if you have had a refund: your access ends, but the record that the purchase and the refund happened does not. Nothing beyond that record is retained.
6. Your rights
Under the GDPR you have the right to:
- be informed about what personal information I hold and why — that is what this policy is for
- access a copy of the information I hold about you
- rectification — have it corrected if it is wrong or incomplete
- erasure — have it deleted, where there is no legal reason for me to keep it
- restrict processing — have its use paused while a query is resolved
- object to processing carried out on the basis of legitimate interests, including the testimonial emails described in section 3
- data portability — receive the information you gave me in a machine-readable format, or have it sent to another provider
- not be subject to automated decision-making — I do not carry out any
- withdraw consent — where something is done on the basis of your consent, you can take that consent back at any time. This currently applies to the analytics cookies in section 7, which you can turn off using the cookie settings link on the page. Withdrawing does not make anything done before you withdrew unlawful.
To exercise any of these, email contact@profoundideas.com. I will respond within one month. There is no charge.
Checking who you are
Before I act on a request, I need to be reasonably sure it comes from you. In most cases this is straightforward: if you email from the address attached to your purchase, that is enough. If you email from a different address, I may ask you a question only the account holder would be able to answer. I will not ask for more than I need, and anything you send me purely to verify your identity is deleted once the request is dealt with.
Complaints
If you are unhappy with how your information has been handled, you can complain to the Irish Data Protection Commission:
Data Protection Commission 6 Pembroke Row, Dublin 2, D02 X963, Ireland Online complaint form: forms.dataprotection.ie/contact Website: www.dataprotection.ie
The DPC's own guidance is that the webform is the most effective way to contact them, and that complaints must be made in writing rather than by telephone.
You can go to them directly without contacting me first, though I would rather have the chance to put things right.
7. Cookies
A cookie is a small file stored on your device by a website. My pages are hosted on Kajabi, and the cookies below are the ones set when you visit. No advertising or third-party tracking cookies are used on my pages.
Strictly necessary
These are required for the pages, your login, and the checkout to work, and for keeping the site secure. They cannot be switched off and no consent is needed for them.
| Cookie | What it does |
|---|---|
| __cf_bm | Cloudflare bot protection — distinguishes real visitors from automated traffic |
| _cfuvid | Cloudflare — supports rate limiting so the site stays available |
| _csrf_token | Security — prevents a form on another site being used to act on your behalf |
| _kjb_session | Keeps you signed in as you move between pages |
| CookieScriptConsent | Stores your cookie consent choice so the banner does not reappear on every page |
| rl_anonymous_id | Assigns an anonymous identifier so page and layout performance can be measured correctly. Kajabi's own guidance is that this cookie must be treated as required, because without it the platform's page measurement does not function. |
Analytics — set only if you agree
These cookies are not needed for the site to work. They help me understand how the landing page and checkout page are performing. With the exception of vs_uniques_landing_page (see note below), none of these are set unless you accept analytics cookies in the cookie banner.
| Cookie | What it does |
|---|---|
| rl_session | Groups your page views into a single visit |
| rl_page_init_referrer | Records which site you arrived from |
| vs_uniques_landing_page | Helps the hosting platform (Kajabi) count unique visitors to the landing page. This is an HttpOnly cookie, which means it is set directly by the server rather than by a script in your browser. Because of this, the cookie banner cannot block it — it is set regardless of your cookie choice. I have no way to prevent or disable it. It is listed here under analytics because its function is analytical, and I want to be transparent about what it does and why it cannot be controlled through the banner. |
| _clsk | Microsoft Clarity — connects multiple page views into a single session. Only set on the landing page and checkout page, and only if you accept analytics cookies. |
Cookieless analytics (no cookies set)
I use Plausible Analytics to count page views on the landing page and checkout page. Plausible does not set any cookies and does not collect any personal data. It is mentioned here for transparency. No consent is needed and the cookie banner has no effect on it.
Your choice
When you first arrive you will see a banner asking whether you accept the analytics cookies. Nothing in the analytics table above is set until you choose, with the exception of vs_uniques_landing_page, which is set by the hosting platform at server level and cannot be controlled through the banner (see note in the table above). You can change your mind at any time using the cookie settings link on the page, and declining does not limit anything on the site.
Kajabi publishes its own cookie notice describing the cookies the platform sets, which is available on Kajabi's website.
A note on cookie domains
My site runs at courses.profoundideas.com, which is a subdomain of profoundideas.com. Some cookies are set on the parent domain (.profoundideas.com) by the services that create them, while the cookie banner reports them under the subdomain (.courses.profoundideas.com). This is a display difference only — the cookies are the same, and they work identically regardless of which domain is shown.
8. How your information is kept secure
I do not store customer information on my own computer or devices. It lives in the systems described in section 4, which are run by established providers using standard encryption in transit and at rest.
The measures within my own control are:
- two-factor authentication on my Kajabi account, which is the only account with access to customer records
- access limited to me alone — I have no staff, contractors, or collaborators with access to customer data
- no export or local copies of customer lists
No system is completely secure, and I cannot guarantee that information will never be accessed by someone who should not have it. If a breach occurs that is likely to put your rights at risk, I will tell you and report it to the Data Protection Commission within 72 hours, as the law requires.
9. Children
The course is intended for adults. I do not knowingly collect information from anyone under 16. If you believe a child has provided me with personal information, email me and I will delete it.
10. Changes to this policy
I will update this policy whenever what I do with personal information changes. Two dates appear at the top: the date the wording was last changed, and the date that version takes effect. For this first version they are the same. If I make a significant change in future, I will publish it with an effective date far enough ahead to give you notice before it applies.
