Privacy Policy

Your privacy matters to us. This policy explains what information we collect, how we use it, and how we protect it. Be Sure They Know is operated by Golden Pond Investments Inc. (“we”, “us”, “our”). When we say “the platform” or “the service”, we mean the Be Sure They Know application available at app.besuretheyknow.com and the marketing site at besuretheyknow.com.

By creating an account or using the platform, you agree to the practices described in this policy.

1. What we collect

Information you provide

• Your name and email address, provided when you create an account
• Any content you record — written instructions, personal messages, story entries, trusted contact details, document locations, important information, and any other material you enter into the platform
• Audio and video recordings you make within the platform
• Profile information such as a date of birth, location, or biography, if you choose to add it
• Communications you send to us, such as support requests or feedback

Information collected automatically

• Session authentication tokens managed by our authentication provider (Clerk)
• Basic server logs including IP addresses, timestamps, and request paths — retained for a short period for security and debugging purposes only

We do not use advertising trackers, retargeting pixels, or third-party analytics that profile your behaviour.

2. How we use your information

• To provide and operate the platform — storing your plan and making it accessible to you
• To send transactional emails you have explicitly triggered, such as invitations to key people or release confirmer introductions
• To generate AI-assisted writing when you use the AI writing assist feature — your content is sent to our AI provider solely to generate the requested text and is not retained by that provider for training
• To transcribe audio and video recordings into text when you request it
• To process subscription payments via our billing platform
• To respond to your support requests
• To protect the security of accounts and the platform

We do not sell your personal information. We do not share your content with any third party except as described in Section 3.

3. Third-party services we use

The platform relies on a small number of carefully selected third-party services to operate. Each receives only the minimum information necessary for the function it performs.

• Clerk (auth.clerk.com) — handles account creation, sign-in, and session management. Clerk stores your email address and name for authentication purposes. See clerk.com/privacy.
• Resend — our transactional email provider. Resend receives the recipient email address and email content only when you trigger a notification (such as sending a contact introduction). See resend.com/privacy.
• Google Cloud Storage (via Replit) — stores audio and video files you upload. Files are stored in encrypted buckets and are not publicly accessible without a valid signed URL.
• OpenAI (via Replit AI Integrations) — used for AI writing assistance and audio/video transcription. Content sent via the API is not used by OpenAI for model training per their standard API data usage policy. See openai.com/policies/api-data-usage-policies.
• Systeme.io — processes subscription payments. Systeme.io handles your billing details directly; we do not store payment card information. See systeme.io/privacy-policy.
• Replit — our hosting and infrastructure provider. The application and database run on Replit infrastructure. See replit.com/privacy.

4. Who can see your plan

Your plan is private by default. No one can see what you have recorded unless you explicitly grant them access. Specifically:

• Key people you name can only access content you have marked as visible to them, and only through the sharing mechanism you have activated
• Group plan members (people whose accounts are covered under your subscription) cannot see any of your plan content, and you cannot see theirs — the only connection is billing
• Golden Pond Investments Inc. staff do not access your plan content except in the event of a verified support request where you have explicitly requested it, or where required by applicable law

5. Data retention

We retain your account and plan content for as long as your account is active. If you delete your account, your personal data and plan content are deleted within 30 days, except where retention is required by applicable law.

Backups may retain data for up to an additional 30 days after deletion for disaster recovery purposes, after which they are overwritten.

6. Your rights

You have the right to:

• Access a copy of your personal data (you can export your full plan from the Export page at any time)
• Correct inaccurate personal data via your Profile page
• Delete your account and all associated data by contacting us at hello@besuretheyknow.com
• Withdraw consent for optional processing at any time
• Lodge a complaint with a data protection authority if you believe your rights have been infringed

If you are located in the European Economic Area, the United Kingdom, or Australia, you may have additional rights under applicable data protection law. Contact us to exercise any of these rights.

7. Cookies and local storage

The platform uses session cookies and browser session storage strictly to maintain your authenticated session. We do not use advertising cookies or cross-site tracking.

8. Security

All data is encrypted in transit using TLS. Data at rest is encrypted by our infrastructure provider. We apply the principle of least privilege to internal data access. No security measure is infallible, however, and we encourage you to use a strong password and keep your account credentials private.

9. Children

Be Sure They Know is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has created an account, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or by displaying a notice in the platform before the changes take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.