What we collect, and what we don't.

This site is operated by TNT Solutions LLC, doing business as Tim Norwood — AI Education, a limited liability company organized in Illinois. For any privacy question or request, email tim@timothynorwood.com.

• Contact form submissions: your name, business name, phone number, email address, the topic you picked, your message, and any file you choose to attach.
• Account data: your email address, and — if you sign in with Google — the name, email address, and profile picture Google returns. We request only basic sign-in scopes.
• Purchase data: the plan you bought, the amount, the date, your billing email, and the processor's customer/subscription identifiers. We never see or store your full card number.
• Auto-renewal consent records: the plan, the price, the version of the terms shown to you, and the date and time you checked the consent box.
• Membership usage: which prompts you mark as used, so your progress shows up in the portal.
• AI literacy assessment answers, used to show you your result. Your score is not published and is not shared with anyone.
• First-party usage analytics: the page you viewed, where you arrived from, and a random per-tab session id kept only in your browser's session storage. No advertising cookies, no cross-site tracking, no third-party analytics network, and no IP address stored with these events.
• Standard server logs: IP address, browser type, and pages requested, kept for security and troubleshooting.

To reply to you, to deliver and protect the membership you paid for, to process payments, to send transactional email (receipts, access instructions, account notices), to prove you consented to a recurring charge if that is ever disputed, and to keep the site working and secure. That's the whole list.

Only with the service providers needed to run the business, and only for that purpose:

• Stripe — card payments, subscription billing, and the billing portal. Stripe is the controller of your card data; we never receive it.
• NOWPayments — cryptocurrency payments, when you choose that option.
• Our hosting, database, storage, and email infrastructure providers, who process data on our instructions.
• Google — only if you choose Google Sign-In.
• Law enforcement or a court, if we are legally required to.

We do not sell, rent, or share your personal information for cross-context behavioral advertising, and we do not transfer Google user data to anyone except as described above. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Contact leads and attachments: up to 24 months, then deleted, unless you become a customer.
• Account and purchase records: as long as your account exists, plus the period required for tax and accounting records.
• Auto-renewal consent records: at least three years from the date of consent, or one year after the subscription ends, whichever is longer. This retention is required by California law.
• Server logs: 90 days.

Attachments on the contact form are stored in a private bucket and are readable only through short-lived signed links sent to Tim. Please do not upload biometric identifiers — fingerprints, faceprints, voiceprints, or retina/iris scans — or anyone else's sensitive personal information. We do not collect biometric data and do not want to receive any.

• Ask us what we hold about you, and we'll tell you.
• Ask us to correct or delete it, and we will, except where we're required to keep a record (for example, a consent or tax record).
• Unsubscribe from marketing email at any time using the link in any marketing message. Transactional email — receipts, access, account and security notices — is separate and continues while your account exists.
• Close your account by emailing us.

We honor browser Do Not Track / Global Privacy Control signals as an opt-out of sharing, which is straightforward for us because we do not share personal information for advertising in the first place.

We use encryption in transit, row-level access controls on the database, and private storage for uploads. No system is perfect. If personal information is compromised, we will notify affected individuals in the most expedient time possible and without unreasonable delay, and will notify the relevant Attorney General where required.

This site is for business owners. It is not directed to children under 16, and we do not knowingly collect information from them. If you believe a child has given us information, email us and we'll delete it.

We operate in the United States and our services are aimed at U.S. small businesses. Data is processed in the United States. We do not target or market to individuals in the European Economic Area or the United Kingdom. If you are in the EEA or UK and want your data removed, email us and we'll delete it.

If we change this policy materially, we'll update the effective date at the top and, for anything that affects an active subscription, tell you by email before the change takes effect. See also our Terms of Service and Refund & Cancellation Policy.