Privacy Policy

Who we are

Flex My Career is operated by Creative for a Change, LLC, a limited liability company registered in the State of Delaware, United States ("we", "us", "our"), founded by Alysia Lee Asp. For the purposes of the UK and EU GDPR we are the data controller for the information described here.

Where the platform operates. Flex My Career is a United States business. The website, the course platform, our CRM and our payment processing are all operated and hosted in the United States, and your information is processed there. Alysia Lee Asp, our founder, teaches internationally and is personally based in Shanghai — but she works with the platform as any other authorised user does, and your personal data is not transferred to or stored in China.

What we collect

• Assessment answers. The twelve responses you give in "Find your stage" — your stage, goal, available time, biggest blocker, pillar, preferred format, appetite for risk, decision style, what you have already tried, where you live, and why now.
• Contact details. First and last name, email address, country, and anything else you volunteer, such as a LinkedIn profile or a message you write to us.
• Account and learning data. If you buy a course, bundle or membership: your login, which courses you have access to, your progress through them, and any work you submit inside the platform.
• Purchase information. What you bought, when, the amount, and the currency. Card details are entered directly with Stripe — we never see or store your full card number.
• Correspondence. Emails, contact-form messages, and coaching-related notes you send us.
• Technical and usage data. IP address, browser and device type, referring page, pages viewed, and approximate location derived from IP. This is collected automatically.

We do not ask for, and ask that you do not send us, sensitive categories of data — health, biometric, racial or ethnic origin, religious or political beliefs, or trade-union membership.

Why we use it, and our lawful basis

Where the UK or EU GDPR applies, we rely on the following bases:

• To deliver what you asked for — generating your assessment report, giving you access to courses, running coaching sessions, providing support. Basis: performance of a contract.
• To take payment and keep financial records. Basis: contract, and legal obligation for tax and accounting.
• To send service messages — receipts, access details, changes to something you have bought. These are not marketing and you cannot opt out of them while you hold an account. Basis: contract.
• To send the Journal and other marketing, where you have asked for it. Basis: consent. You may withdraw it at any time.
• To improve the site and our teaching — understanding which pages and courses work, fixing problems, preventing abuse. Basis: legitimate interests, balanced against your rights.

Where we rely on legitimate interests, you can object at any time and we will stop unless we have compelling grounds to continue. Where we rely on consent, you can withdraw it at any time.

Cookies and analytics

We use a small number of cookies and similar technologies:

• Strictly necessary — keeping you logged in, remembering your cart, and security. These cannot be switched off without breaking the site.
• Analytics — aggregated measurement of how the site is used, so we can improve it. We do not use analytics to build advertising profiles of you.

You can clear or block cookies in your browser settings. If you block the strictly necessary ones, parts of the site — checkout and course access in particular — will stop working.

Who else sees your information

We do not sell your personal information, and we do not share it for anyone else's advertising. We do use service providers who process data on our behalf, under contract, and only on our instructions:

• Our platform provider (GoHighLevel / HighLevel, Inc.) — hosts this website, the course platform, our CRM and our email sending.
• Stripe — takes and settles payments, and handles card data directly. Stripe is PCI-DSS Level 1 certified and processes your payment information under its own privacy policy.
• Email and communication tools — deliver messages you have asked for.
• Analytics providers — measure site usage.

We may also disclose information where we are legally required to, or to establish, exercise or defend legal claims. If the business is ever sold or reorganised, information may transfer to the new owner, who would remain bound by this policy.

International transfers

We are a United States business serving learners worldwide, so information reaches us from many countries. Our platform and payment providers store and process that data on servers in the United States. We do not transfer personal data to China.

Where we transfer personal data out of the UK or EEA, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), together with additional safeguards where they are needed. You can ask us for details of the safeguards in place at any time.

How long we keep it

• Assessment answers — up to 24 months from submission, so we can send your report and follow up meaningfully. Then deleted or anonymised.
• Account and learning records — for as long as your account is open, and up to 24 months afterwards.
• Purchase and tax records — as long as tax and company law requires, typically seven years.
• Marketing contacts — until you unsubscribe, and then a minimal record so we can honour your choice.

Your rights

Depending on where you live, you may have the right to:

• ask for a copy of the personal information we hold about you;
• have inaccurate information corrected;
• ask us to delete information we no longer need;
• object to, or ask us to restrict, certain processing;
• receive your information in a portable format;
• withdraw consent at any time, without affecting what we did before you withdrew it;
• complain to your data protection regulator.

If you are in California, you additionally have the right to know what we collect, to request deletion, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA.

Security

Access to personal information is limited to those who need it. Traffic to this site is encrypted in transit, payment data is handled by PCI-compliant processors, and platform access is protected by authentication. No system is perfectly secure, and we cannot guarantee absolute security — but if a breach affects your rights, we will notify you and the relevant regulator as the law requires.

Children

Flex My Career is intended for working professionals and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

We update this policy when our practices change. The date at the top always reflects the current version. If a change materially affects your rights, we will tell you by email or with a notice on the site before it takes effect.

Contact