Privacy Policy

Controller and contact

Seller: Aaron Williams, sole trader trading as Ambitious Step Academy. Contact: support@ambitiousstep.com. Last updated: 25 October 2026.

Aaron Williams, trading as Ambitious Step Academy, is the data controller for personal information handled for this Academy unless a particular service clearly says otherwise. Contact us to exercise your privacy rights. A full postal contact address for statutory disclosures is being finalised; email support is available now.

Assessment and learning activity

If you complete the Personal Assessment, we process your answers and results, including your growth score, recommended pathway, top priorities and main obstacle. We also process learning progress, goals, habits, journal entries and challenge/check-in details you choose to provide. Avoid putting unnecessary sensitive personal information into free-text responses.

Data we use

Depending on your activity, we may process your name, email, account identifiers, purchase and subscription references, course enrolment and progress, messages, challenge answers, website technical and security logs, consent choices and optional campaign-attribution information. Card payment details are normally processed by our payment provider rather than stored as complete card numbers in the Academy.

Why and lawful bases

We use necessary details to create accounts, deliver purchased learning and administer subscriptions (performance of a contract); maintain accounting and compliance records (legal obligation); prevent abuse, secure and improve services and respond to support queries (legitimate interests where appropriate); and send optional marketing or use non-essential analytics where the relevant consent or other lawful UK basis applies. Where consent is relied on, you may withdraw it at any time.

Purchase consent records

For a one-off digital course purchased with immediate access, we record the account ID and email, course, consent wording version and SHA-256 fingerprint, server-recorded time, IP address, browser/device user-agent, checkout and payment references, amount and currency, payment-completion state, and confirmation-email status where applicable.

We use this information to document your choice, perform and confirm purchases, handle cancellations and complaints, deter fraud and establish or defend legal claims. Depending on the processing, our legal bases are contract performance, legal obligations and legitimate interests. These bases are reviewed against the actual processing.

Consent records are stored in the Academy platform (Base44), with payment and consent references shared with Stripe for payment reconciliation. Our implementation does not itself pass the recorded consent IP address or user-agent field to Stripe as consent metadata. When transactional purchase emails are enabled, Base44's built-in email service processes recipient details and purchase-confirmation content to deliver those messages. This service reports delivery, bounces and message opens, including through tracking images. We are reviewing the appropriate privacy controls for open tracking; blocking remote images in your email client may limit tracking, but is not a replacement for any consent legally required. Contact support@ambitiousstep.com with questions about email processing. SMTP.com is being prepared as a future alternative and is not currently the purchase-confirmation sender.

We retain these records only as long as necessary for purchase evidence, dispute handling and applicable legal obligations. A precise retention schedule is under review; contact support@ambitiousstep.com for information applicable to your record. Your data protection rights, including access, correction, restriction and objection where applicable, are described above. You may complain to the Information Commissioner's Office.

Academy service providers

We use Base44 for Academy hosting, accounts, data and backend operations; Stripe for payment and subscription processing; Vimeo to show lesson video (which may receive technical data such as IP address and device information when video plays); GoHighLevel for CRM storage and communications with eligible assessment leads only after an explicit opt-in and once the Academy CRM connection is configured; and WordPress hosting for this legal website. Base44 currently provides the Academy's built-in email facilities. Purchase-confirmation sending is currently disabled; SMTP.com is being prepared as an alternative transactional email provider and has not yet been activated. Providers may process information outside the UK; applicable international-transfer arrangements require further verification. We do not sell your personal information.

Service providers and international transfers

We use service providers for website hosting, authentication, course delivery, media, payments (including Stripe), email and analytics. These providers may process relevant data on our behalf, or independently as their notices explain. Some processing may occur outside the UK; applicable transfer safeguards must be checked for each provider. We do not sell your personal information.

Retention and security

We keep information only as long as needed for the stated purpose, including account operation, legal accounting obligations, disputes and security. Exact retention schedules depend on the record type and are under review; you can request applicable details at our support address. We use access controls and appropriate technical safeguards, although no online system is completely risk-free.

Your rights

Subject to UK data-protection law, you may request access, rectification, erasure, restriction, portability or object to certain processing. You may withdraw consent where it is the lawful basis, and complain to the UK Information Commissioner's Office at ico.org.uk. We may ask to verify your identity before disclosing account data.

Assessment and marketing choices

The Academy assessment may involve a results or welcome message and an invitation to receive further email communications. The assessment offers a separate, optional marketing-consent checkbox that starts unticked. We record your choice. Assessment results are available whether or not you opt in. Assessment lead details are eligible to be sent to GoHighLevel only when you explicitly tick that box; otherwise they are not sent by this assessment flow. The CRM connection itself is not currently configured for delivery. You can request removal from marketing at support@ambitiousstep.com and use unsubscribe controls on applicable emails.

Cookies and marketing

Essential technologies support login and security. Non-essential analytics and marketing technologies should operate in accordance with the choices shown in the service. Email marketing includes an unsubscribe or preference option where required. Browser storage may also retain campaign attribution and learning-session state.

Updates and contact

We will update this notice when actual suppliers, retention practices or material processing activities change. Questions about privacy may be sent to support@ambitiousstep.com.