Privacy Policy

The personal data handled on this site is the responsibility of BMAXY LLC, a company formed in the state of Florida, United States.

• Business address: 330 E Central Blvd, Orlando, FL 32801, United States.
• Email for privacy matters: contact@bmaxy.com.

BMaxy does not currently have a named data protection officer. Every request, question, or complaint about personal data should go to the address above, which is the official channel.

This policy applies to bmaxy.com — in both its Portuguese and English versions — and to the student area of the Write Your Book course.

It does not cover third-party sites you reach from here, such as the stores where the books are sold and the social media profiles. Each of those has its own policy, and that policy is what applies there.

We collect only what the site and the student area need in order to work:

• Account data: full name, email address, and password. The password is stored encrypted by Supabase — BMaxy cannot see it or recover it.
• The language preference set on your account (Portuguese or English).
• Course usage data: your enrollment, which lessons you completed, when you completed them, and the progress the player records while a video plays.
• Technical logs generated automatically by the infrastructure providers — such as IP address, date and time of access, and browser type — used to run and protect the service.
• The content of the messages you send us by email, along with the address they came from.

We don't ask for identity documents, we don't collect sensitive data, and we don't build behavioral profiles. No automated decision with legal effect is made about you — unlocking lessons in order is a course rule, not an assessment of who you are.

• Creating and maintaining your account and letting you log in.
• Giving access to the course and unlocking lessons in the right order.
• Recording lesson completion and, once the criteria exist, issuing the certificate of completion.
• Replying to the messages you send.
• Keeping the service secure, preventing fraud, and investigating misuse.
• Meeting the legal, tax, and accounting obligations that apply to the company.

We don't use your data for targeted advertising, and we don't sell, rent, or hand it over to third parties for commercial purposes.

The site uses strictly essential cookies only: the session cookies Supabase creates when you log in. Without them, there is no way to keep you signed in from one page to the next.

We use no analytics, advertising, or tracking cookies, and no audience measurement tool is installed on the site. That's why you don't see a consent banner: there is nothing to consent to beyond what the service needs to function.

There is one exception that comes from outside: when you watch a lesson, the YouTube player is loaded from YouTube's servers. At that point Google may set cookies and collect data in your browser under its own policies — this happens inside the student area, not on the public pages of the site.

You can block or delete cookies in your browser settings. If you block the session cookies, logging in stops working.

We don't sell personal data. We share only what's necessary, and only with the providers that run parts of the service:

• Supabase — authentication, database, and session. This is where your account and your course progress are stored.
• YouTube (Google) — hosting and playback of the lesson videos.
• Hosting provider — application infrastructure and site delivery, which generates the technical access logs.
• Stripe — card payment processing, once enrollment opens.
• Public authorities, where there is a legal obligation or court order.

Each of these services handles data under its own privacy policy. If you'd like the current list of providers in use, ask us by email.

BMAXY LLC is based in the United States, and the providers listed above may process data on servers located outside your country.

By creating an account and using the service, you understand that your data may be transferred to, stored in, and processed in the United States and in other countries where those providers operate.

Account and progress data is kept for as long as your account exists. If you ask us to delete the account, we erase whatever we are not required to keep.

After closure, we keep only what is needed to meet a legal, tax, or accounting obligation and to defend against a possible claim. Technical logs generated by the providers follow each provider's own retention period.

• Passwords are stored encrypted by Supabase; nobody at BMaxy can read them.
• Database access is restricted by row-level security rules enforced in the database itself, not only by the site's code.
• The video for a locked lesson is never delivered to the browser: the video address only leaves the server for someone who has already unlocked that lesson.
• Traffic between your browser and the site is encrypted (HTTPS).

Even so, no system is completely immune. If a security incident occurs that could affect you, we will notify you at your registered email address and take the appropriate steps.

Depending on where you live, local law — such as the LGPD in Brazil, the GDPR in Europe, or state laws in the United States — may grant you rights over your data. Whichever law applies to you, BMaxy offers every user the right to:

• find out what data of yours we hold and get a copy of it;
• correct data that is incomplete, out of date, or wrong;
• ask us to delete your account and any data we are not legally required to keep;
• withdraw a consent you have given, without affecting what was done before;
• object to a specific use of your data or ask that it be restricted;
• complain to the data protection authority in your country.

To exercise any of these, write to contact@bmaxy.com from the email address registered on your account. We may ask for extra information to confirm your identity before acting — it's a safeguard against requests made by someone else. We reply as soon as we can and, where the law in your country sets a deadline, within it.

The site and the student area are not directed at children. Creating an account requires being 18 or older, or having the consent and supervision of a legal guardian.

If we find an account created by a child without a guardian's consent, we delete the data. If you are a guardian and believe this has happened, write to our contact address.

Today we only send operational messages: signup confirmation, password recovery, course notices, and notices about relevant changes to the legal documents. There is no marketing email list in operation.

If we start sending promotional content, it will only go to people who consented, and every message will carry a clear way to unsubscribe. Operational messages tied to your account keep being sent for as long as the account exists.

This policy may be updated — for example, when a new provider comes into use or when Stripe payments go live. The date of the latest update always sits at the top of this page.

When a change matters to you, we will tell you at your registered email address or through a visible notice on the site before it takes effect.

Requests about personal data and questions about this policy are handled by:

• BMAXY LLC
• 330 E Central Blvd, Orlando, FL 32801 — United States
• contact@bmaxy.com