ThriveSerene Privacy Policy

1. Scope & Acceptance

This Privacy Policy explains how we collect, use, share, secure, retain, and transfer personal information when you visit our Site or purchase our digital products (the Services).
By using the Services, you agree to this Policy; if you do not agree, discontinue use.
This Policy is incorporated into our Terms of Service.

Controller: ThriveSerene (Israel) for personal information we collect directly.
Personal Information means information relating to an identified or identifiable individual.
Processing means any operation on personal information (collection, storage, use, disclosure, deletion, etc.).
We act as controller for data we collect, and independent or joint controller with certain third parties where their tools collect directly (e.g., payment providers).

You provide: name (or alias), email, billing details, purchase information, support messages, and any content you send us.
Automatic: device data, IP address, general location (city/region), pages viewed, timestamps, error logs, and anti-fraud indicators (e.g., unusual download patterns).
From third parties: payment/checkout providers, email service providers, security/anti-fraud vendors, and dispute/chargeback platforms (e.g., transaction confirmations, risk scores, dispute outcomes).
Cookies & similar tech: we use strictly necessary cookies (operation, security, licensing). If/when enabled, we also use functional/analytics cookies. We will request consent for non-essential cookies where required by law and provide controls to manage choices.

Contract: to take and fulfill orders, deliver digital content, manage access links, and provide support.
Legitimate interests: to secure the Services, prevent fraud/piracy (including download/device limits), improve performance, and maintain accurate records.
Legal obligations: tax, accounting, compliance, and responding to lawful requests.
Consent (where required): email marketing, non-essential cookies, and certain international transfers when consent is the chosen basis.

Service providers/Processors: hosting, email delivery, analytics (if enabled), customer support tools, and logistics for digital deliverybound by contracts to handle data lawfully and securely.
Payment providers: (e.g., Shopify Payments/PayPal or equivalent) typically act as independent controllers; we do not receive full card data.
Security/anti-fraud: limited sharing to investigate abuse, piracy, or chargeback fraud and to protect users and our platform.
Legal: disclosures to comply with law, court orders, or to protect our rights, security, users, or the public.
No sale/share: we do not sell or share personal information for cross-context behavioral advertising as defined by the CPRA. If this changes, we will update this Policy and honor applicable opt-out rights.

We operate from Israel and may process data in other countries using reputable vendors.
For EEA/UK users, where required, we rely on appropriate safeguards such as EU Standard Contractual Clauses (SCCs) and, for the UK, the IDTA or UK Addendum.
Note: The EU recognises Israel as providing an adequate level of protection, permitting transfers from the EEA to Israel without additional transfer tools.

We implement administrative, technical, and organizational measures to protect personal information against unauthorized access, disclosure, alteration, or destruction.
Access to personal information is limited to authorized personnel and vetted vendors with a need-to-know.
We monitor for suspicious activity and may restrict access temporarily (e.g., link/device limits) to protect users and the platform.
Where required by law, we will notify authorities and/or affected individuals of certain security incidents.

We keep personal information only as long as reasonably necessary for the purposes described (including legal/accounting obligations) and then delete or de-identify it.
Examples:
1. Purchases/invoices: kept for statutory accounting/tax periods;
2. Security/access logs: kept for a limited period to detect and investigate abuse;
3. Marketing records: kept until you opt out or withdraw consent.

EEA/UK (GDPR/UK GDPR): right of access, rectification, erasure, restriction, portability, and objection; right to withdraw consent where applicable. We aim to respond within one month (may extend by up to two months for complex/volume requests and will notify you within the first month if extended).
US State Privacy Laws (e.g., CA/CO/CT/VA/UT/OR/TX/DE, etc.): rights to know/access, delete, correct, and to opt-out of sale/share or targeted advertising (where applicable). We typically respond within 45 days (may extend once by 45 days with notice). If we deny a request, you may appeal by emailing us with Appeal in the subject.
Israel (PPL, incl. Amendment 13): rights include access and correction of data in a registered database; the law and guidance continue to evolve following Amendment 13 (in force Aug 14, 2025).
Submitting requests: email support@thriveserene.com with the right youre invoking and your jurisdiction; we may verify your identity (e.g., order ID, email confirmation). We do not discriminate for exercising rights.

Where legally required (e.g., California), we honor the Global Privacy Control (GPC) opt-out signal for sale/share or targeted advertising. We may choose to honor it more broadly as a good-faith practice.
Non-essential cookies/analytics (if enabled) are used only with your consent in jurisdictions that require it; consent can be withdrawn at any time via the banner or browser settings.

Our Services are not directed to children under 13 and we do not knowingly collect their data.
Purchases are restricted to adults (18+) or 1617-year-olds with parental/guardian consent (see Terms of Service).
EEA/UK note: child consent thresholds vary by country (often 1316, default 16); where consent is relied upon for information-society services, parental authorization may be required below the set age.

We do not make decisions with legal or similarly significant effects based solely on automated processing.
We may use automated anti-fraud signals to flag suspicious behavior; any access-limitation decision can be reviewed upon request.

We collect only what we need for stated purposes and take steps to keep data accurate and up to date.
You are responsible for providing accurate contact and order information.

EU/UK representatives: If we are required to appoint an EU/UK representative under GDPR Art. 27/UK GDPR, we will publish their details here; designation does not limit our responsibilities.
Supervisory authorities: You may lodge a complaint with your local data-protection authority. We encourage contacting us first so we can try to resolve your concern promptly.

We may update this Policy from time to time; the Last Updated date shows the current version.
Material changes will be posted on the Site. Continued use after changes constitutes acceptance.

Email: yoavman997@gmail.com
Postal/Registered address: will be published once available; until then, contact us by email for privacy requests or complaints.