Privacy Policy

www.ebd.pro/privacy-policy/

Policy version: October 18, 2026

1 Who we are and how to contact us

Enterprise by Design, LLC ("EBD," "we," "us," or "our") is a Maryland limited liability company. We determine how personal information is handled for the EBD website, Minimum, Standard, and Maximum memberships, newsletters, and affiliate program. This policy sets the rules for that handling and explains your choices.

Our initial focus is the United States. Our planned European markets are France, Germany, Spain, Portugal, and the United Kingdom. Your rights depend on applicable law, not just our business location. Before introducing Academy, workshops, advisory services, or other services involving additional information, we will provide the relevant disclosures.

Write to Enterprise by Design, LLC, Privacy Requests, 107 Assateague Court, Ocean City, MD 21842, United States. Current online contact options are posted on our Contact page. If no suitable online option is available, please use the postal address. You do not need an account to contact us.

Accepting our Terms of Service or continuing to browse does not, by itself, give consent to optional tracking or unrelated marketing.

2 Information covered by this policy

We limit collection to information reasonably needed for the functions you request, the purposes described below, and applicable legal obligations.

Accounts and subscriptions. Information includes the email address and any name you provide, member identifiers, membership level and status, newsletter selections, account preferences, and records of signup or other choices.

Purchases and affiliate transactions. Information includes billing and contact details, purchased products, amounts, currency, taxes, invoice and transaction references, subscription status, refunds, chargebacks, and relevant payment-method information. Stripe handles credentials entered into its payment interface. Affiliate administration also involves application information, referral identifiers, attributed transactions, commission calculations, payout information, and required tax records. Do not send full card numbers, security codes, or payout credentials through an ordinary contact form.

Communications. We receive the information you include in an inquiry, support request, complaint, or other communication. Please provide only what is relevant. For an accessibility request, describe the assistance needed; a diagnosis or medical record is ordinarily unnecessary. We will arrange a suitable channel if sensitive information is needed.

Technical and preference information. Website delivery and security involve technical request information, such as network addresses, browser or device information, requested pages, referring pages, timestamps, and error or security records. Consent and preference records document your selections and information needed to remember them.

Optional measurement. Where you permit it, analytics can measure visits, content use, events, or referrals. Member-related measurement can associate activity with a member identifier and membership status. Newsletter-open and link-click measurement requires its own assessment and choices; a website cookie choice does not automatically authorize tracking inside email. We will explain any optional measurement before enabling it.

Information comes from you, your interactions with our services, and the providers or referral transactions involved in those interactions. This policy does not authorize purchasing prospect lists, collecting unrelated information from data brokers, or importing contacts for marketing without an appropriate basis and notice.

3 Purposes and lawful bases

We use information to operate the website and requested accounts, deliver membership resources and subscribed communications, administer payments and affiliates, respond to requests, prevent misuse, maintain security, and meet legal obligations.

Where European or UK law requires a lawful basis, the following bases apply to the corresponding activity:

References to a legal obligation in this table mean an obligation qualifying under the applicable EEA or UK data-protection law. Requirements imposed solely by another country's law require a separate lawful-basis assessment.

We assess legitimate interests against your rights and reasonable expectations. They do not replace consent where consent is required. When information is necessary for a contract or legal requirement, we will identify required fields and explain the consequence of not providing it. Optional information remains optional.

We will explain a materially new purpose before using information for it and obtain new consent where required.

4 Service providers and other recipients

We disclose information needed for the relevant function to these providers:

• Magic Pages, using Ghost publishing software: website hosting, member accounts, stored site and member information, membership access, and email delivery within the hosted service. See Magic Pages processing terms.
• Stripe, including Stripe Tax: payments, subscriptions, transaction administration, refunds, applicable tax calculations, and payment security. See the Stripe Privacy Policy.
• Google Workspace: business communications and records handled through the Workspace features we use. See Google's Cloud Data Processing Addendum.
• Formspree: receipt, storage, and forwarding of website form submissions and related technical or security information when an EBD form is connected. See the Formspree Privacy Policy.
• Outpost: publisher, membership, and subscriber-communication functions connected to our service. See Outpost privacy information.

Permitted analytics providers can receive technical or event information for measurement you authorize. Affiliate-management providers can receive the identifiers and transaction information needed to administer referrals and commissions. Optional tracking providers must be identified with their purposes before permission is requested.

Our processing arrangements must limit providers acting on our behalf to authorized purposes, appropriate confidentiality and security, and required assistance with deletion and privacy requests. They may use authorized subprocessors. Some providers, including Stripe, also process certain information independently for purposes such as payment-network operations, fraud prevention, and legal compliance under their own notices and terms.

Affiliates receive information needed to understand and reconcile their referrals and commissions. EBD's rule is to use transaction references, status, and amounts rather than disclose customer contact details where those details are unnecessary. Sponsors do not receive our member or contact lists for their own marketing.

Other recipients include professional advisers who need relevant information, authorities or other parties when disclosure is legally required, and parties to a genuine business reorganization subject to appropriate confidentiality and data-protection safeguards.

5 Limits on advertising and other data uses

This policy prohibits EBD from selling personal information, sharing it for cross-context behavioral advertising, or using it for targeted advertising. We do not authorize processors to reuse EBD information for those purposes. Sponsored content, contextual promotions, and affiliate arrangements remain subject to these restrictions. A feature that requires prohibited reuse must not be enabled.

Optional analytics and referral tracking require an affirmative choice unless a specific lawful exception has been documented and explained. A tracking tool does not become necessary merely because it supports our revenue.

EBD must not use customer, member, contact, or affiliate personal information to train AI models, license it for model training, or authorize a processor to use it for that purpose. Private customer information must not be entered into public AI tools. Any separate AI-assisted service workflow requires a defined purpose, an appropriate legal basis, suitable provider restrictions, and disclosure before use. Independent payment-provider security and fraud processing is addressed in the relevant provider notice.

We minimize sensitive information and restrict it to a necessary, clearly identified purpose with any additional legal condition required. You may ask for human review of an EBD membership or affiliate decision that materially affects you.

6 Marketing and privacy choices

Subscribing to a newsletter permits that requested communication. Buying a membership, submitting an inquiry, applying as an affiliate, or accepting cookies does not subscribe you to unrelated marketing.

Marketing messages must include a straightforward unsubscribe method. You may also write to us using the contact details above. We process withdrawals promptly; for commercial email governed by CAN-SPAM, no later than ten business days, and sooner where another applicable rule requires it. Necessary account, payment, security, and service messages can continue. Unsubscribing does not itself cancel a paid membership.

The Cookie Policy explains browser choices. EBD must honor legally required opt-out preference signals, including Global Privacy Control, with the scope required by law, including an associated account when applicable. EBD does not assign a separate automated response to legacy Do Not Track signals. Optional tracking remains governed by your choices and required opt-out signals.

7 Retention and deletion

The following rules govern information controlled by EBD and information processed on our instructions. We delete or deidentify information when its retention purpose ends, subject to a necessary legal hold or retention requirement.

Cancellation, account deletion, newsletter withdrawal, and removal of browser storage affect different records. A continuing need for an invoice does not justify retaining an entire member profile.

Deleted information in backups must remain restricted to recovery or legal requirements until it expires under the documented backup rotation. If a backup is restored, applicable deletion instructions must be reapplied. Independent providers may have their own lawful retention duties; their records are governed by those duties and their notices.

8 Security and international processing

EBD is responsible for reasonable administrative, technical, and organizational safeguards appropriate to the information and risk. Our operating rules require restricted access, appropriate account protection, secure handling of sensitive records, and a process for responding to security incidents and required notices. No service can guarantee absolute security.

EBD operates in the United States. Its connected services can process information in other countries. Magic Pages identifies EU primary hosting and additional processing through its service providers; Formspree identifies hosting in the United States. Other locations depend on the service, its subprocessors, and authorized access arrangements.

Where applicable law restricts an international transfer, EBD must establish a valid transfer mechanism and necessary safeguards before making that transfer. These can include an applicable adequacy decision or appropriate contractual safeguards with any required additional measures. This policy does not represent that EBD has a particular certification or that a particular transfer agreement has been executed. You may contact us for information about safeguards relevant to your information and a copy where required. Visiting the site does not waive transfer protections.

9 Privacy requests and appeals

You can ask to access, correct, or delete your information through the contact details in section 1. Depending on applicable law, additional rights can include confirmation of processing, portability, restriction, objection, information about recipients, withdrawal of consent, and opt-outs relating to sale, sharing, targeted advertising, or qualifying automated decisions.

We consider requests from all users. Statutory rights and exceptions depend on the relevant law. You will not be penalized unlawfully for exercising a privacy right.

Describe your request and provide the information reasonably needed to locate the relevant records. An authorized agent may submit a request for you. Where permitted and necessary, we may seek proof of authority and proportionate verification from you or the agent. We will not demand unnecessary identity documents or require a new account solely to make a request. Opt-outs and browser signals must not be burdened with verification that applicable law does not permit.

We respond without undue delay and within applicable deadlines. EEA and UK requests generally receive a response within one month, subject to legally permitted extensions. US access, correction, and deletion requests ordinarily receive a response within 45 days unless a shorter period applies. Where Maryland's Online Data Privacy Act applies, an additional 45 days is permitted when justified and explained within the initial period. Other extensions are used only as the applicable law permits. Withdrawals and opt-outs receive their required effect within the applicable, potentially shorter, period.

If we decline a request, we explain the reason and how to seek review. You may appeal through the same contact channels by identifying the original request and the decision you want reviewed. We will provide a written appeal decision and reasons within 60 days, or sooner if applicable law requires. A denial will identify available complaint routes, including an online route to Maryland's Consumer Protection Division where required.

Requests are ordinarily free. We will impose a charge or decline an excessive request only where law permits, and explain the basis beforehand. Necessary exceptions can protect other people's rights, required records, security, or legal claims.

You may complain directly to a competent regulator. The European Data Protection Board directory, UK Information Commissioner's Office, and Maryland Attorney General provide information about the relevant authorities. EBD's contract dispute procedures do not prevent privacy requests or regulatory complaints and do not suspend statutory deadlines.

10 Age limits and policy updates

Accounts, memberships, and the affiliate program are intended for people aged 18 or older. People under 18 are not eligible to create an account, purchase or use a membership, or participate as an affiliate. Contact us if you believe an underage person has supplied personal information so we can investigate and take appropriate action.

External services have their own notices for their independent activities. This does not remove EBD's responsibility for information it collects or discloses.

We will update this policy when practices change, identify the revised version, and provide material-change notice appropriate to the change and applicable law. Where new consent is required, posting an update or continued use alone will not replace it.