Privacy Policy

1. Who is responsible

Blindspot Studio LLC, a Wyoming limited liability company (“we”, “us”), operates whatjudysays.com (the “Service”) and is the controller of your personal data. Contact: hello@whatjudysays.com.

2. What data we collect

2.1 Data you give us

• [To complete for What Judy Says: the data the product asks for or fetches (answers, files, profiles, photos…).]
• Your email address, when you provide it.
• Messages you send us, attachments included.

2.2 Data we collect automatically

• How you found us — the referring page and any campaign parameters in the link you clicked, including an advertising click identifier when there is one.
• Browser and device data — browser, operating system, device type, approximate country (from your IP address, using IP Geolocation by DB-IP), and the IP address of sign-in sessions.
• Usage data — which screens you saw and which options you chose.
• Transaction data — amount, date, plan, refunds, and payment references. Card details go directly to Whop; we never receive the full card number.
• Cookies and similar technologies, as described in our Cookie Policy.

3. Why we process it

• To provide the Service — [To complete for What Judy Says: what the product does with the data above.] Also to let you sign back in, and to fix errors.
• To process payments — through Whop, and to tell you about your payment.
• To analyse and improve the Service — understand which screens work and which lose people.
• To send reminders. If you leave your email address and do not buy, we may send you at most two emails: one shortly after, and one later with a reduced price. Nothing else — no newsletter, no sequence. Every such email has an unsubscribe link and the one-click unsubscribe header your mail app understands. Unsubscribing stops these reminders only; sign-in links, payment emails and replies to your own messages still work.
• To measure our advertising, as described in section 5.
• To enforce our Terms, prevent fraud, and comply with the law, including responding to lawful requests from authorities.

We do not sell your personal data, and we make no automated decision about you with legal or similarly significant effects.

4. Legal basis (EEA and UK)

• Performance of a contract — providing the Service, processing payments, communicating with you about them.
• Legitimate interests — analysing and improving the Service, keeping it secure, measuring our advertising, and sending the reminders described above, in a measured way and with an easy way out. Where your jurisdiction requires it, we rely on consent instead.
• Legal obligation — keeping transaction records, answering lawful requests.
• [To complete for What Judy Says: any processing based on consent (for example, fetching a profile you point us at).]

5. Who we share it with

We share personal data with providers that operate parts of the Service on our instructions, and only for the purposes above:

• hosting and database providers;
• Whop, our payment processor and merchant of record, which processes your payments and sends your receipts. As merchant of record, Whop also processes payment data for its own legal and anti-fraud obligations, under its own privacy policy;
• our email delivery provider, for the emails we send and receive;
• our product analytics provider (Mixpanel), which receives the screens you saw, the options you chose, your payment amounts and, once you have given it, your email address;
• [To complete for What Judy Says: the product’s own providers (AI models, data lookups…) and what each receives.]
• LinkedIn, for advertising measurement, when it is enabled: LinkedIn receives confirmation of key steps (for example, submitting an email or paying), plus the payment amount and currency. Server-side matching uses a SHA-256 hash of your email and/or the LinkedIn ad click identifier when available. Hashing does not make this data anonymous.

We may also disclose data to public authorities when the law requires it, and to a successor in the event of a merger, acquisition, or sale of assets.

6. International transfers

We and our providers are located in the United States. If you are in the EEA, the UK, or another country that restricts transfers, your data is transferred there under the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

7. How long we keep it

We keep your data until you ask us to delete it. Transaction records are kept for as long as tax and accounting rules require, even after everything else is deleted. When you ask us to delete your data, we do so within thirty days, subject to that exception.

8. Your rights

You can ask us to access, correct, delete, or export your personal data, to restrict or object to a particular use — including advertising measurement — and to withdraw consent where consent is the basis. Write to hello@whatjudysays.com; we answer within thirty days. If you are in the EEA or the UK, you may also complain to your local data protection authority. You may act through an authorised agent, in which case we will verify their authority before responding.

US state privacy rights. Residents of California and other states with privacy laws have the right to know what personal information we collect and how we use it, to access, correct and delete it, to opt out of its sale or sharing for advertising — we do not sell it; write to us to opt out of advertising measurement — and not to be discriminated against for exercising these rights.

9. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, passwordless sign-in, and access limited to those who need it. No method of transmission or storage is completely secure.

10. Age limitation

The Service is not directed at anyone under 18. We do not knowingly collect data from minors; if you believe we have, contact us and we will delete it.

11. Browser signals

We do not currently respond to browser signals such as “Do Not Track” or Global Privacy Control. To opt out of advertising measurement, write to us.

12. Changes

We may update this policy. The date at the top changes when we do, and material changes are announced on the Service or by email. Continued use after the effective date means you accept the revised policy.

13. Contact

Blindspot Studio LLC — hello@whatjudysays.com.