Privacy Policy

The short version

ADHD Founder is run by True Brew Birdie Ltd, a company in Cyprus (EU). Because we are established in the EU, the General Data Protection Regulation (GDPR) applies to everything we do with your data, wherever you live. This policy explains it in plain English.

• We collect what you give us (name, email, payment details, what you type into our tools) and what your browser sends (IP address, device, pages viewed).
• Some of our tools ask about your ADHD. That is health data. We only process it with your explicit consent, and we use Anthropic's Claude API to generate your results. Anthropic does not train on it.
• We use advertising pixels (Meta, Reddit, Google, OpenAI) and analytics. In the EU, EEA, UK and Switzerland these run only after you opt in via our cookie banner, except on the campaign landing pages described in section 8.
• We never sell your data for money. Ad pixels count as "sharing" under California law. You can opt out at any time via Your choices.
• Email hello@adhd-founder.com to access, correct, export or delete your data. We answer within 30 days.

1. Who is responsible

The data controller is:

True Brew Birdie Ltd (trading as ADHD Founder)
Gladstonos 12-14, 8046 Paphos, Cyprus
Registration HE 424693, VAT CY10424693Y
Director: Jan Kutschera
Email: hello@adhd-founder.com

We have not appointed a data protection officer because we are not required to. Privacy questions go to the email above and are handled by the director personally.

2. What data we collect

Data you give us

• Contact and account data. Name, email address, password (hashed), profile picture if you upload one, timezone.
• Purchase data. What you bought, price, currency, country and postcode (for tax), invoice details, refund history. Card numbers go directly to Stripe. We never see or store them.
• Content you create in our tools. Your answers in the Dopamine ROI assessment, Brain Mapping, Wall of Awful, Big Idea, the script generator, and Revenue Architecture planning. This can include information about your ADHD, your business, your income and your personal challenges. See section 5.
• Communications. Emails, support chats, booking answers, testimonials and videos you submit, applications for programmes.
• Call recordings. If you join a Sprint call, cohort call or coaching call, the call is recorded and transcribed. See section 6.
• Affiliate data. If you join our affiliate programme: name, email, website, payout details, referral statistics.

Data collected automatically

• Technical data. IP address, approximate location derived from it (country, region, city), browser, operating system, device type, language, referring URL, UTM parameters.
• Usage data. Pages viewed, buttons clicked, scroll depth, time on page, videos watched and how far, checkout steps started or abandoned, email opens and link clicks.
• Identifiers. Cookies and similar identifiers listed in section 9, including a pseudonymous ID derived from a one-way hash of your email address once you have given it to us.

Data we receive from others

• Payment and marketplace partners. Stripe (payment status, fraud signals, tax location) and ClickBank (buyer name, email and receipt when you buy through ClickBank).
• Booking and calls. Cal.com (booking details) and Fireflies.ai (transcripts and summaries).
• Affiliates and referrals. Which affiliate or referral link brought you to us.

3. Why we use your data and on what legal basis

GDPR requires a legal basis for each purpose. Here they are.

Where we rely on legitimate interest, we have balanced it against your rights. You can object at any time (see section 12). Providing data for a purchase is a contractual requirement. Everything else is voluntary, though some tools cannot work without your answers.

4. Automated decisions and profiling

Our AI tools generate content based on your answers, but no decision with legal or similarly significant effect is made about you automatically. Advertising platforms may use the events we share with them to decide which ads to show you. That is profiling for advertising and only happens with your consent.

5. ADHD-related information and AI tools

Several of our tools ask how ADHD shows up in your work and life. Under GDPR that is "data concerning health", a special category that needs extra protection.

• Explicit consent. Before you start such a tool we ask you to confirm that you want us to process this information. You can withdraw that consent by deleting the session or emailing us.
• AI processing. Your answers are sent to Anthropic's Claude API to generate your results, roadmap or script. Anthropic acts as our processor under its commercial terms, does not use API data to train its models, and retains it only briefly for abuse monitoring.
• What we store. Your answers and the generated outputs are stored in our database in the EU so you can come back to them inside your account.
• Not medical advice. Nothing our tools produce is a diagnosis or treatment. We do not share this information with advertisers, and it is never used to build ad audiences.
• Deletion. Ask and we delete your sessions within 30 days.

6. Calls, recordings and transcripts

Sprint calls, cohort calls and one-to-one calls are recorded so that you can rewatch them and we can prepare follow-up documents. Recording is announced at the start of the call and by joining you agree to it. If you do not want to be recorded, tell us before the call and we will find another way.

• Fireflies.ai joins the call, records it and produces the transcript.
• Anthropic Claude summarises the transcript and drafts your follow-up notes.
• Bunny Stream hosts the video so you can watch it inside your account. Playback links are signed and expire.
• Recordings of group calls are visible to the other participants of that programme.
• We keep recordings and transcripts for the duration of the programme plus 12 months, then delete them.

7. Email

• Transactional email (receipts, access links, programme content, call follow-ups) is sent through Resend. You cannot opt out of these while you are a customer, because they are how we deliver what you bought.
• Marketing email is sent through Kit (formerly ConvertKit) and only if you signed up for a free resource, a challenge, a webinar or our newsletter. Every email has an unsubscribe link. Unsubscribing takes effect immediately.
• Checkout reminders. If you enter your email during checkout and do not complete the purchase, we may send up to a few reminder emails. Each one has an unsubscribe link. If you live in Canada, we only send these where the law allows.
• Open and click tracking. Our emails contain a tracking pixel and tracked links so we can see whether an email was opened and which links were clicked. We use this to stop sending emails that nobody reads and to improve content. Most email apps let you block remote images if you prefer.

8. Analytics, advertising and your consent

Cookieless analytics, always on. We run Plausible and Umami on our own server. They set no cookies and cannot recognise you across days. We also use Vercel's cookieless web analytics. This runs on our legitimate interest in knowing whether the site works.

Consent-based tools. The following run only after you opt in if you visit from the EU, EEA, UK or Switzerland, and can be switched off everywhere via the cookie settings:

• Google Analytics 4 (via Google Tag Manager and our server-side tagging endpoint) for usage statistics.
• Microsoft Clarity for session replays and heatmaps that show us where people get stuck. Form fields with personal data are masked.
• Meta Pixel and Conversions API, Reddit Pixel and Conversions API, Google Ads and the OpenAI Ads pixel to measure which ads lead to sign-ups and purchases and to show you relevant ads on those platforms. We send these platforms event data (page view, lead, add to cart, purchase, value), technical data and a one-way hash of your email address so they can match events to their users. The platforms act as independent controllers for what they do with the data on their side.

Server-side tagging. Tracking events are routed through a server-side Google Tag Manager container hosted by Stape in the Netherlands before they reach Google, Meta or Reddit. This lets us filter data and set first-party cookies. It does not change what the platforms receive.

Campaign landing pages. On the pages we run paid ads to (currently the Starter Kit and Sprint pages and their checkouts and thank-you pages) we do not show the cookie banner, and the measurement tools above run on the basis of our legitimate interest in knowing whether our advertising works. We limit the data to what is needed for attribution, and you can still object: open the cookie settings from the footer of any other page, enable Global Privacy Control in your browser, or use the platform opt-outs below. We are aware that supervisory authorities in some EU countries read the law more strictly, and we have chosen this approach knowingly.

Platform opt-outs. Meta ad preferences, Reddit personalisation, Google ad settings, Your Online Choices (EU), DAA opt-out (US).

9. Cookies and similar technologies

Cookies are grouped as essential (always on), functional, analytics and marketing. The banner controls analytics and marketing. Our cookie choice itself is stored in your browser's local storage under the key af_consent and is never sent to a third party.

Embedded YouTube videos in blog posts use YouTube's privacy-enhanced mode and set cookies only once you press play. Videos inside your account are served by Bunny Stream without tracking cookies.

10. Who we share data with

We share personal data only with providers that help us run the business, under contracts that bind them to protect it, or where the law requires it. We do not sell personal data.

We may also disclose data to professional advisers (accountants, lawyers), to authorities where legally required, and to a buyer if the business is sold, in which case this policy continues to apply.

11. International transfers

We are in Cyprus and store your core data in the EU (Supabase in Ireland). Several providers process data in the United States. For those we rely on the EU-US Data Privacy Framework where the provider is certified (marked "DPF" above), and otherwise on the European Commission's Standard Contractual Clauses plus a transfer risk assessment. The UK and Swiss extensions of the DPF and the UK International Data Transfer Addendum cover transfers from those countries. You can request a copy of the safeguards by email.

12. How long we keep data

13. Your rights

Under GDPR (and the UK GDPR and Swiss data protection law) you can:

• Access the personal data we hold about you and get a copy.
• Correct inaccurate or incomplete data.
• Delete your data ("right to be forgotten"), unless we must keep it, for example invoices.
• Restrict processing while a dispute is resolved.
• Export the data you gave us in a machine-readable format.
• Object to processing based on legitimate interest, including any direct marketing, at any time.
• Withdraw consent at any time. This does not affect processing that already happened.
• Complain to a supervisory authority. Ours is the Office of the Commissioner for Personal Data Protection, Cyprus (dataprotection.gov.cy). You can also complain to the authority where you live, for example the ICO in the UK.

To use any of these rights, email hello@adhd-founder.com from the address on your account, or tell us how to verify it is you. We reply within 30 days and do not charge for reasonable requests.

14. Your choices

• Cookie settings. Open the cookie settings to change your analytics and marketing choices. The same dialog is linked from the footer of every page as "Do Not Sell or Share My Personal Information".
• Global Privacy Control. If your browser sends the GPC signal, we treat it as an opt-out from advertising cookies and sharing, without you having to do anything else.
• Email. Use the unsubscribe link in any marketing email, or reply and say "unsubscribe".
• AI sessions. Delete individual sessions inside your account, or ask us to delete all of them.
• Testimonials. Ask us to take down a testimonial you submitted at any time.

15. Additional information for US residents

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another US state with a comprehensive privacy law, the following applies in addition to the rest of this policy.

Categories collected in the last 12 months. Identifiers (name, email, IP address, cookie IDs, hashed email); customer records (purchase history, billing details); commercial information; internet activity (pages viewed, clicks, email opens); approximate geolocation; audio and video (call recordings, testimonial videos); inferences about your interests drawn from usage; and, where you use our ADHD tools, health information you choose to share. Sources: you, your device, and the partners in section 2. Purposes: section 3.

Selling and sharing. We do not sell personal information for money. We do "share" identifiers, internet activity and commercial information with Meta, Reddit, Google and OpenAI for cross-context behavioral advertising, and we did so in the last 12 months. We do not knowingly share the data of anyone under 16, and we do not share the health information you enter into our tools. Opt out via the "Do Not Sell or Share My Personal Information" link in the footer or by sending the Global Privacy Control signal. We do not use or disclose sensitive personal information beyond what is needed to provide the service you asked for.

Your rights. You can request to know what we collect, correct it, delete it, receive a portable copy, opt out of sharing and targeted advertising, and limit the use of sensitive personal information. We will not discriminate against you for exercising these rights. Email hello@adhd-founder.com. We verify requests by matching the email address on your account; an authorised agent must provide your written permission. We respond within 45 days and can extend once by another 45 days. If we deny a request you can appeal by replying to our decision.

Retention is described in section 12. We do not engage in profiling that produces legal or similarly significant effects.

16. Additional information for other regions

• United Kingdom. The UK GDPR gives you the rights in section 13. We have no UK establishment; contact us at the details above. The ICO is at ico.org.uk.
• Australia. We handle personal information in line with the Australian Privacy Principles. We send marketing email only with your consent as required by the Spam Act. Complaints can go to the OAIC (oaic.gov.au) if we cannot resolve them.
• Canada. We comply with PIPEDA and Canada's Anti-Spam Legislation. We send commercial email only with express consent or where implied consent exists (for example after a purchase), and every email lets you unsubscribe. You may contact the Office of the Privacy Commissioner of Canada.
• Brazil. Under the LGPD you have the rights to confirmation, access, correction, anonymisation, portability, deletion and information about sharing. Contact the email above; our director acts as the contact point (encarregado).
• Switzerland. The revised Federal Act on Data Protection applies. Transfers abroad rely on the Swiss-US DPF or recognised standard contractual clauses.
• New Zealand, Singapore, Israel, UAE and elsewhere. You have at least the rights of access and correction under local law, and we honour the GDPR rights in section 13 for everyone.

17. Affiliate and referral programme

Our affiliate programme runs on GoAffPro. When you apply, GoAffPro stores your name, email, website, tax details and payout information on our behalf and shows you your referral statistics. When a visitor arrives through your link, a 30-day cookie records the referral, and when they buy, the order ID and amount are attributed to you. Referred customers are told about this in section 9. Affiliates see aggregate statistics and order IDs, never the customer's name or email.

Our own referral links work the same way inside our database, without a third party.

18. Testimonials and public content

If you submit a written or video testimonial, you agree that we may publish it on our website, in ads and on social media with the name and picture you provide. You can withdraw this consent at any time and we will remove it from the places we control within 30 days. Content already printed or distributed by others cannot be recalled.

19. Security

All traffic is encrypted (HTTPS with HSTS). Our database, storage and secrets are access-controlled, passwords are hashed, payment card data never touches our servers, and video links are signed and expire. We enforce a Content Security Policy and log security events. No system is perfectly secure. If a breach affects your data we will inform you and the authorities as the law requires.

20. Children

Our products are for business owners and are not directed at anyone under 18. We do not knowingly collect data from minors. If you believe a minor has given us data, email us and we will delete it.

21. Changes to this policy

When we add a new tool or provider we update this page and the effective date at the top. For material changes that affect you as a customer we also email you. Previous versions are available on request.

22. Contact

True Brew Birdie Ltd (ADHD Founder)
Gladstonos 12-14, 8046 Paphos, Cyprus
Email: hello@adhd-founder.com