1. Who We Are

Unrelenting Resilience is a mental fitness training platform operated by Piero Corradetti Consulting ("we," "us," or "our"), a business incorporated in Ontario, Canada.

For the purposes of applicable privacy law:

• Under PIPEDA (Canada): Piero Corradetti Consulting is the organization responsible for personal information under its control.
• Under GDPR (European Union): Piero Corradetti Consulting is the data controller with respect to personal data collected through the Platform.
• Under CCPA (California): Piero Corradetti Consulting is the business collecting and processing personal information.

For questions about this Privacy Policy or your personal data, please contact us at unrelenting-resilience.ca.

2. Scope of This Policy

This Privacy Policy applies to all personal information collected through:

• The Unrelenting Resilience web application, mobile application, and progressive web application (collectively, the "Platform").
• Interactions with The Eye AI mentor feature.
• The Comm-Link messaging and community system.
• The Facilitator Portal.
• The Master Command Dashboard.
• Email communications, onboarding flows, and any other touchpoint associated with the Platform.

This Policy applies to all user types: Individual Operatives, Affiliate Facilitators, and Enterprise/Institutional administrators and their enrolled Operatives.

This Policy does not apply to third-party websites or services linked to or integrated with the Platform. Those services are governed by their own privacy policies.

3. Information We Collect

3.1 Information You Provide Directly

We collect information you provide when you:

• Register for an account: Full name, email address, password (stored in hashed form), and any optional profile details you choose to provide.
• Complete onboarding: Your user type (Individual Operative, Affiliate Facilitator, or Enterprise user), and any demographic or organizational information required for your account type.
• Use the platform: Reflection log entries, journal entries, responses to program activities and micro-actions, and course assessment responses submitted through the Curriculum Forge.
• Use The Eye: Conversation content and queries submitted to The Eye AI mentor.
• Use Comm-Link: Messages sent through the in-platform messaging and community chat system.
• Contact us: Name, email address, and the content of any inquiry or support request you submit.
• As a Facilitator: Business name, jurisdiction of operation, payment information, and information provided in your Facilitator application.
• As an Enterprise Administrator: Institution name, administrator name and title, billing information, and cohort configuration details.

3.2 Information Generated by Your Use of the Platform

We automatically collect certain information when you use the Platform, including:

• Activity data: Daily micro-action completions, XP points earned, pillar scores, streak data, leaderboard rankings, badge achievements, and mission board interactions.
• Course and assessment data: Module completion rates, assessment scores, time spent on course content, and pass/fail results.
• Engagement data: Login frequency, session duration, feature usage patterns, and engagement drop-off indicators.
• Facilitator Portal data: Cohort management actions, workout postings, re-engagement communications sent, and oversight tool usage.

3.3 Technical Information

We collect limited technical information necessary to operate and secure the Platform, including:

• Device and browser information: Device type, operating system, browser type and version, and screen resolution.
• Log data: IP address, date and time of access, pages or features accessed, referring URLs, and error logs.
• Cookies and similar technologies: As described in our Cookie Policy.

3.4 Information from Third Parties

We may receive limited information from third-party services integrated with the Platform, such as payment processors (for billing purposes only) and authentication providers (if you choose to sign in using a third-party identity provider). We do not purchase or receive personal data from data brokers.

4. How We Use Your Information

We use personal information for the following purposes:

4.1 To Provide and Operate the Platform

• Creating and managing your account.
• Delivering the 8 Pillar program, daily mission boards, and Curriculum Forge courses.
• Operating The Eye AI mentor and Comm-Link features.
• Processing XP, leaderboard rankings, and gamification elements.
• Providing Facilitator Portal and Master Command Dashboard functionality.
• Processing payments and managing subscriptions and license fees.

4.2 To Personalize Your Experience

• Presenting your progress, history, and achievements within the Platform.
• Tailoring The Eye's responses based on your current session context.
• Displaying cohort-relevant content and challenges.

4.3 To Communicate With You

• Sending account confirmation, onboarding, and welcome communications.
• Notifying you of updates to the platform, these Legal Documents, or your account.
• Responding to support inquiries and compliance questions.
• Sending re-engagement communications where authorized (Facilitators and Enterprise Administrators only).

4.4 To Improve and Develop the Platform

• Analyzing aggregated, anonymized usage data to understand how the program is being used and to improve its effectiveness.
• Conducting research and development on the 8 Pillar framework using anonymized and de-identified data.
• Testing new features and program content.

4.5 To Maintain Security and Compliance

• Detecting, investigating, and preventing unauthorized access, fraud, or misuse of the Platform.
• Maintaining server logs and security records.
• Complying with applicable legal obligations, regulatory requirements, and lawful requests from authorities.
• Enforcing our Terms of Service and Legal Documents.

4.6 Legal Bases for Processing (GDPR)

For users in the European Economic Area, we process personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Platform services you have signed up for (Article 6(1)(b) GDPR).
• Legitimate interests: Processing for security, fraud prevention, platform improvement, and aggregated research, where our interests are not overridden by your rights (Article 6(1)(f) GDPR).
• Legal obligation: Processing required to comply with applicable law (Article 6(1)(c) GDPR).
• Consent: Where we rely on consent (e.g., for certain cookies or optional communications), you may withdraw consent at any time without affecting the lawfulness of prior processing (Article 6(1)(a) GDPR).

5. How We Share Your Information

We do not sell your personal information. We share personal information only in the following circumstances:

5.1 With Affiliate Facilitators

If you are an Operative participating in a program delivered by an Affiliate Facilitator, your engagement data, XP scores, pillar progress, and reflection log content may be accessible to your assigned Facilitator through the Facilitator Portal. This access is governed by the Facilitator's obligations under the Affiliate Facilitator Terms of Service and the Facilitator License Agreement.

5.2 With Enterprise Administrators

If you are an Operative enrolled under an Enterprise account, your engagement data, course scores, and reflection log content may be accessible to your Institution's designated Administrator(s) through the Master Command Dashboard. This access is governed by the Enterprise Terms of Service and the Data Processing Agreement.

5.3 With Service Providers

We share limited personal information with trusted third-party service providers who assist us in operating the Platform, including:

• Cloud infrastructure and hosting providers (Supabase, Inc. / Vercel, Inc.).
• Payment processors (Stripe, Inc., who receive only the billing information necessary to process transactions).
• Email delivery services (Resend, Inc.).
• Analytics providers (who receive only anonymized or aggregated data).

All service providers are bound by contractual data processing obligations consistent with this Policy and applicable privacy law.

5.4 For Legal and Safety Purposes

We may disclose personal information where we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation, court order, or lawful government request.
• Protect the safety of any person where there is an imminent risk of harm.
• Detect, prevent, or respond to fraud, security incidents, or technical issues.
• Enforce our Terms of Service or Legal Documents.

5.5 Business Transfers

If Piero Corradetti Consulting is involved in a merger, acquisition, reorganization, or sale of assets, personal information may be transferred as part of that transaction. We will notify affected users before personal information is transferred and becomes subject to a different privacy policy.

5.6 With Your Consent

We may share personal information with third parties where you have given us explicit consent to do so.

6. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, subject to the following:

• Account data: Retained for the duration of your account and for a period of up to two (2) years following account closure, unless a longer retention period is required by applicable law.
• Reflection logs and journal entries: Retained for the duration of your account. You may delete individual entries at any time through your account settings.
• Activity and engagement data: Retained in identifiable form for the duration of your account and for up to two (2) years following account closure. Anonymized and aggregated versions may be retained indefinitely for research and platform improvement purposes.
• Payment and billing records: Retained for a minimum of seven (7) years as required by applicable Canadian tax and financial record-keeping law.
• Legal hold: Where data is subject to a legal hold, dispute, or regulatory inquiry, retention may be extended until the matter is resolved.
• Facilitator and Enterprise data: Retention periods are further specified in the Facilitator License Agreement and Data Processing Agreement respectively.

When personal information is no longer required, we will delete or anonymize it securely.

7. Cookies and Tracking Technologies

Our use of cookies and similar tracking technologies is described in full in our Cookie Policy, which is incorporated by reference into this Privacy Policy. In summary:

• We use strictly necessary cookies to operate the Platform and maintain your session.
• We use functional cookies to remember your preferences.
• We use analytics cookies (where consent is obtained) to understand how the Platform is used.
• We do not use advertising or targeting cookies.

You can manage your cookie preferences through the cookie consent banner on first visit to the Platform and through your account settings.

8. Data Security

We implement and maintain reasonable and appropriate technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption of personal data in transit (TLS/HTTPS) and at rest.
• Access controls limiting personal data access to authorized personnel and systems.
• Regular security assessments and vulnerability monitoring.
• Incident response procedures for detecting and responding to security breaches.

No method of electronic transmission or storage is completely secure. While we take the security of your personal information seriously, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify you and applicable regulators in accordance with our obligations under applicable law.

9. International Data Transfers

The Platform is operated from Canada. If you access the Platform from outside Canada — including from the European Economic Area or the United States — your personal information may be transferred to and processed in Canada.

For users in the EEA, Canada is recognized by the European Commission as providing an adequate level of data protection under PIPEDA for commercial organizations.

Where we transfer personal data to service providers located outside Canada or the EEA, we ensure appropriate safeguards are in place, including standard contractual clauses or other transfer mechanisms recognized under applicable law.

10. Your Privacy Rights

10.1 Rights Under PIPEDA (Canada)

Under PIPEDA, you have the right to:

• Access: Request access to the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Withdrawal of Consent: Withdraw consent to our collection, use, or disclosure of your personal information, subject to legal and contractual restrictions. Note that withdrawal of consent may affect your ability to use the Platform.
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

10.2 Rights Under GDPR (EEA Users)

In addition to the rights above, EEA users have the right to:

• Erasure ("Right to be Forgotten"): Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Restriction of Processing: Request that we restrict processing of your personal data in certain circumstances.
• Data Portability: Receive a copy of personal data you have provided to us in a structured, commonly used, machine-readable format.
• Object to Processing: Object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw Consent: Where processing is based on consent, withdraw that consent at any time.
• Lodge a Complaint: File a complaint with your national data protection authority.

10.3 Rights Under CCPA (California Users)

California residents have the right to:

• Know: Request disclosure of the categories and specific pieces of personal information we have collected, the sources of that information, the purposes for which it is used, and the categories of third parties with whom it is shared.
• Delete: Request deletion of personal information we hold about you, subject to certain exceptions.
• Opt-Out of Sale: We do not sell personal information. No opt-out is required.
• Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

10.4 How to Exercise Your Rights

To exercise any of the rights described above, please contact us through unrelenting-resilience.ca. We will respond to verified requests within the timeframe required by applicable law (30 days under PIPEDA and CCPA; one month under GDPR, extendable by a further two months for complex requests).

We may need to verify your identity before processing your request to protect the security of your personal information.

11. Children's Privacy

The Platform is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13 without verified parental or guardian consent.

Where the Platform is deployed by an Institution to a Cohort that may include individuals between the ages of 13 and 17, the Institution is responsible for obtaining verified parental or guardian consent and for ensuring compliance with applicable laws governing the collection of minors' personal data, including COPPA (United States) where applicable.

If we become aware that we have collected personal information from a child under 13 without appropriate consent, we will take steps to delete that information promptly.

12. The Eye — AI Feature and Privacy

Conversations with The Eye are processed to generate responses and are stored as part of your session data subject to the retention periods described in Section 6. Specifically:

• Conversation content is used to generate AI responses during your session.
• Conversation logs are retained as part of your account data and are accessible to you through your account history.
• Where you are an Operative under a Facilitator or Enterprise account, your Administrator may have access to The Eye conversation logs as described in Sections 5.1 and 5.2.
• Conversation content may be used in anonymized and aggregated form to improve The Eye's prompting and response quality.
• Conversation content is never shared with third-party AI providers or used to train external AI models beyond what is necessary to generate your responses.

The Eye is not a confidential communication channel. Content shared with The Eye does not attract professional privilege or clinical confidentiality protections.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. The effective date at the top of this document reflects the most recent revision.

When material changes are made, we will notify you through the Platform and by email, and where required by applicable law, we will seek your consent before the changes take effect. We encourage you to review this Policy periodically.

14. Contact and Complaints

Piero Corradetti Consulting
Operating as Unrelenting Resilience
Website: unrelenting-resilience.ca
Jurisdiction: Ontario, Canada

If you are not satisfied with our response, you have the right to contact the applicable supervisory authority:

• Canada: Office of the Privacy Commissioner of Canada — www.priv.gc.ca
• European Union: Your national data protection authority — www.edpb.europa.eu
• United Kingdom: Information Commissioner's Office — www.ico.org.uk
• California: California Privacy Protection Agency — www.cppa.ca.gov