DRAFT — for lawyer review. Not yet in force.
Privacy Policy
Last updated: 20 October 2026
Who controls your data
- Rethink Leadership, operating SOPleased. Contact: hello@sopleased.com.
- Stripe is the merchant of record and controls payment data (card details, billing address, tax information) under its own privacy policy. We never see your card number.
What we collect
| Data | Why | Kept |
|---|---|---|
| Email address | Sign-in links, receipts, product emails | While your account exists |
| Waitlist email | Telling you when sales open | Until you unsubscribe or the round closes plus 12 months |
| Purchase record from Stripe (Checkout Session and payment IDs, email, tier, amount before tax, currency) | Licence, refunds, tax records | As required by law |
| Refund and dispute notices from Stripe for a payment we cannot yet match to a purchase (payment and charge or dispute IDs, amount, amount refunded, currency, dispute reason; no name, no email, no card data). Our Stripe account also sells other products, so this can include their refunds and disputes | Applying a refund or dispute that reaches us before its purchase | 120 days, or until applied to the purchase |
| Task text, SOPs, scripts, videos, PDFs | Providing the service | While your account exists; files not opened for 12 months are archived (plan kept, video re-made free on request) |
| Training files you upload for a plan, the text we read from them, your notes and answers, the plan and checklist PDFs | Building the training plan and your HR records download | Until you delete the plan or your account; the files are then deleted from storage (normally within minutes) |
| Company name and logo | Branding your videos and PDFs | While your account exists |
| Account events (purchases, refunds, admin actions) and server error logs | Running the service, fixing bugs | Still being set |
People who use a training link
- When you send a training link, the people who open it type their own name, and at the end their initials. We store that name and those initials, their answers to the check questions, how much of each video they played, and when they started and finished. We do not ask for or store their email address, IP address or any device fingerprint. Their browser keeps a random code so they can carry on where they left off; we store only a scrambled (hashed) copy of it. You, the buyer, control these records: you can see them, export them, and delete one row, a whole training, or everything by deleting your account, and we delete them with your account. You are responsible for telling your staff that their name and results are recorded when they use the link.
What we do not want
- Personal information about your staff, guests, patients, students or customers in task text. Do not put it there. We automatically remove emails, phone numbers, street addresses and links before processing, and scan outputs for emails and phone numbers.
Who processes data for us
| Provider | Role |
|---|---|
| Stripe | Payments, tax, receipts and invoices, fraud checks, disputes |
| Anthropic | AI writing of plans (task text after scrubbing) and of training plans (text read from your files, your notes and answers, file names, all after scrubbing) |
| Railway | App and render servers, database, video and PDF storage |
| Mailgun by Sinch | Email delivery |
We do not
- Sell personal data.
- Use your task text or videos to train AI models.
Your rights
- Access, correct, export or delete your data from your account page, or by writing to hello@sopleased.com.
- Delete account removes your videos, PDFs and plans, and deletes every training file you uploaded. Deleting one training plan deletes its uploaded files and PDFs; its videos and training link stay until you delete them. Purchase records are kept as the law requires.
Cookies
- A sign-in cookie (needed), and a short-lived security cookie during "Continue with Google" sign-in. No analytics or advertising cookies.