Privacy Policy.

1. Who we are

This site (ivanchocron.com) is operated by Iván Chocrón as part of his coaching, retreat, and speaking work. "We" and "us" refer to Iván and the small team that supports him. "You" means anyone visiting the site or sending us information through it.

If you have any privacy question, write to hello@ivanchocron.com and we'll handle it ourselves. There is no automated privacy team.

2. What we collect

We collect only what you actively send us, plus standard technical information any website receives from a browser request.

• Contact information you submit through any form: typically your name, email, sometimes phone, location, and the contents of your message (a coaching application, a retreat inquiry, a speaking inquiry, a press request).
• Email-only signups for free downloadable resources, where you give us your email in exchange for a PDF or guide.
• Standard request metadata your browser sends to any web server: IP address, user-agent string, timestamp, and the page you visited. Cloudflare logs this at the network level for security and uptime, the same way any modern site does.
• If you reply to an email we send, the contents of that reply, kept in Iván's mailbox.

We do not run advertising trackers, fingerprinting scripts, or third-party analytics that follow you around the web. We do not currently run a paid newsletter platform; if we add one in the future, this policy will be updated to name it.

3. How we use it

We use what you send us to do the thing you asked us to do: reply to your inquiry, deliver a PDF you signed up for, schedule a call, evaluate a coaching application, follow up on a retreat conversation, send you a press kit. That is the entire purpose.

We don't sell your information. We don't rent it. We don't share it with anyone outside the small list of service providers in the next section, all of whom are processing it on our behalf to deliver these basic functions.

4. Who we share it with

The named processors that actually touch your data.

When you submit a form, your submission is processed by these third-party services on our behalf:

Supabase

Stores form submissions and contact records in a Postgres database hosted in the United States. They are our database provider; they don't read or use your data for their own purposes.

Cloudflare

Delivers the website to your browser and protects against abuse. Cloudflare's network logs include your IP address and user-agent for security purposes; they don't have access to your form contents.

Google reCAPTCHA

Protects forms against automated spam. Google receives some signals about your browser to verify you're human. See Google's privacy policy at policies.google.com/privacy.

Google Workspace (Gmail)

Iván's email runs on Google Workspace; emails you send to or receive from him are stored in Google's mail infrastructure.

If law enforcement issues a valid legal request for your information, we'll comply if we have to, and we'll tell you unless we're prohibited by law.

5. Cookies and analytics

We don't use tracking cookies. The site does not load Google Analytics, Facebook Pixel, or similar advertising tools.

Cloudflare may set a small number of strictly necessary cookies for security and to keep the site working (for example, to detect bot traffic). These don't track you across other sites.

If we add web analytics in the future (for example, Cloudflare's privacy-friendly server-side analytics, or a tool like Plausible), it will be the kind that doesn't use cookies and doesn't follow you elsewhere on the internet. We'll update this section if and when it changes.

6. How long we keep it

We keep what you send us only as long as we need it.

• Inquiries, applications, and form submissions are stored in Supabase and reviewed by Iván personally. If we don't end up working together, we typically delete or archive the record within twelve months.
• Email correspondence sits in Iván's mailbox until he deletes it. He clears old threads periodically.
• Email signups for the resource library or any future newsletter stay in our contacts list until you ask to be removed. Every email we send has a one-click unsubscribe link.
• Cloudflare and Supabase keep technical request logs for short windows (typically days to weeks) for security and debugging.

If you want a specific record deleted sooner, write to hello@ivanchocron.com and we'll handle it.

7. Your rights: European Union and United Kingdom (GDPR)

If you're in the EU or the UK, the GDPR gives you a set of rights over your data. We honour all of them, regardless of where you are in the world. Specifically:

• The right to know what personal data we hold about you and to receive a copy.
• The right to correct anything that's inaccurate.
• The right to ask us to delete your data (the "right to be forgotten"), subject to any legal obligations we have to keep it.
• The right to restrict or object to certain types of processing.
• The right to data portability: to receive your data in a structured, machine-readable format.
• The right to withdraw consent at any time, where we're processing your data on the basis of consent.
• The right to lodge a complaint with your local data-protection authority.

Our legal basis for processing varies by activity: consent for newsletter signups and resource downloads, legitimate interest for inquiries and security, and the necessity of taking pre-contractual steps for coaching and retreat applications.

To exercise any of these rights, write to hello@ivanchocron.com.

8. Your rights: California (CCPA / CPRA)

If you're a California resident, you have additional rights under the CCPA and CPRA:

• The right to know what personal information we collect, use, and disclose.
• The right to delete personal information we've collected from you.
• The right to correct inaccurate personal information.
• The right to opt out of the "sale" or "sharing" of personal information. We don't sell or share personal information for cross-context behavioural advertising. We never have.
• The right to limit the use of sensitive personal information.
• The right to non-discrimination for exercising any of these rights.

To exercise any of these rights, write to hello@ivanchocron.com.

9. International transfers

Our infrastructure runs in the United States: Supabase databases are in US-East, Cloudflare's edge network spans the globe but caches and processes requests at the nearest point of presence, and Gmail data lives in Google's US infrastructure.

If you're in the European Union, the United Kingdom, or another jurisdiction with comparable rules, your information is transferred to the United States when you submit it. We rely on the Standard Contractual Clauses (and equivalent UK / Swiss addenda where applicable) that our processors maintain with their own customers, and we keep the volume of data we collect to a minimum.

10. Children

This site and the services we offer are not directed at children, and we don't knowingly collect personal information from anyone under sixteen. If you believe a child has sent us information, write to hello@ivanchocron.com and we'll delete it.

11. Security

We take reasonable precautions: forms are captcha-gated, the database is access-controlled, traffic is HTTPS-only, and the small set of people who handle inquiries do so on personal devices kept up to date.

No system is perfectly secure, and we won't pretend otherwise. If we ever discover a breach affecting your data, we'll notify you and the relevant authorities as quickly as we can, in line with applicable law.

12. Changes to this policy

We update this policy when our practices change (for example, if we add a newsletter platform, switch analytics tools, or expand the team). The "Last updated" date at the top reflects the most recent change. Material changes will be summarized at the top of this page for thirty days after the update.

13. Contact

For any privacy question, request, or complaint, write to hello@ivanchocron.com. Iván reads it himself.

Mailing address available on request.