Privacy Policy

1. Who We Are

The Ultimate Grok Bundle, its sales page, checkout pages, thank-you page and members area at rewyse.com/grok-bundle (together, the “Website”) are owned and operated by Soltan Enterprises Limited, a company registered in Hong Kong SAR, China, trading under the brand name Rewyse (“Company”, “we”, “us” or “our”).

Our registered address is: Office 3906, 39/F, The Center, 99 Queen’s Road Central, Central, Hong Kong.

We are the party responsible for the personal information described in this policy. “Personal information” means any data that can, directly or indirectly, identify you, describe you, relate to you or be associated with you. “You” means any visitor to the Website and any buyer or user of The Ultimate Grok Bundle (the “Product”).

The Product is an independent product. It is not affiliated with, made, sponsored or endorsed by xAI or SpaceXAI. We cannot control the privacy practices of third-party websites and services that we do not own, including Grok and Grok Bot.

2. What This Policy Covers

The Product is a set of 12 ready-made “AI employees” (pre-configured bots) for Grok Bot, xAI’s AI teammates app, plus the bonuses described on the product page. We deliver it digitally: you receive Grok Bot share links (“Add to Grok Bot”) in a members area that you sign in to with a link or code we email you, and a welcome email.

This policy covers what happens on our Website, at our checkout, in our members area and in our emails and support conversations with you.

3. Information We Collect

3.1 Information You Give Us

We collect information you give us when you:

• Buy the Product at our checkout
• Sign in to the members area, with a link or 6-digit code we email you, or automatically on the thank-you page right after you buy
• Email us for support or with a question
• Comment on, message or otherwise interact with us on social media
• Ask us for an invoice

(Together, these are “Actions”.)

At checkout this means your first name, last name and email address, the tier you chose (Personal or Team) and which optional add-ons you chose (the Self-Improvement Employee and the Time Audit Employee). Your billing details are entered into Whop’s secure payment field and handled by Whop (see Section 5).

Before you pay: if tracking is on for you (see Section 8) and you type your email address into the checkout and move on, we save that address before you pay, together with the visitor reference described in Section 3.2 and the tier you were looking at. We do this so we can see how many people start a checkout and so we can follow up on an unfinished order, for example with an email about the order you did not complete. Every such email has an unsubscribe link. If tracking is off for you (in the EEA, the UK or Switzerland, with Global Privacy Control, or after you opt out on our Your Privacy Choices page), we do not save the address unless you complete your purchase. If you go on to buy, we delete the saved address within a day, because your order record replaces it.

When you email us, we receive whatever you choose to include in your message.

Tax identification information: if you need an invoice for tax purposes, we may collect your Tax Identification Number solely for invoicing and accounting compliance. We store it securely and use it only for that purpose.

3.2 Information Collected Automatically

When you visit the Website or open our emails, some data is collected automatically:

• Technical data: your Internet Protocol (IP) address, browser type and version, operating system and device type, which our hosting provider Vercel receives when it serves the Website to you.
• Aggregate visit data: Vercel Web Analytics records page views, referring website, country, browser and device type in aggregate. It does not use cookies and is not used to identify you individually.
• Campaign data: if you arrive through a link that carries campaign tags (UTM parameters, such as the name of the campaign or source), our checkout attaches those tags to your order so we can see which links bring in sales. It also attaches the version of the sales page you saw, your device type (phone, tablet or computer), the country of your IP address and, where tracking is on, the visitor reference described below.
• Our own visit records: on the sales page and the two checkout pages, your browser tells our server, on our own domain, which page you opened, when you typed your email address into the checkout and when you clicked “Complete Order”, with the campaign tags you arrived with, whether you came from a Meta ad link and the name of the website that sent you (not its full address). When you click “Complete Order”, our checkout server also records that a payment was attempted. Our server adds your country (worked out from your IP address) and your device type. Where tracking is on, these records carry a random visitor reference from our first-party ugb_vid cookie (see Section 8), which lets us link a visit to a later purchase in the same browser and see which ad led to the sale. Where tracking is off, no cookie is used: our server makes a one-way code from your IP address, your browser’s user agent and a secret that changes every day, so it can count you once per day. We never store your IP address in these records, and because the daily secret is not kept, the code cannot be turned back into your IP address or linked to your visits on other days.
• Members area cookies: when you sign in to the members area, or when the thank-you page signs you in straight after you buy, we set strictly necessary cookies so you stay signed in (see Section 8).
• Advertising and analytics data (outside the EEA, the UK and Switzerland only, see Section 8): the Meta Pixel sends Meta the pages you view, when you start a checkout, when you type an email address into the checkout (without the email itself) and, after you buy, the purchase value, currency, tier and add-ons and a payment reference, together with your IP address, browser data and Meta’s cookies. Our server also sends Meta three events directly (Meta’s Conversions API): when you open a checkout page, when you type your email address into the checkout (the email in hashed, scrambled, form) and when you buy (your email address, name and billing city, state, postal code and country in hashed form). Each one also carries your IP address, browser data, the Meta ad click reference and a hashed copy of the ugb_vid visitor reference, so Meta can match it to the right ad without receiving your email or name in plain text. These are sent only under the same rules as the Pixel, honouring Global Privacy Control and the opt-out, and never when your browser’s time zone or your IP address places you in the EEA, the UK or Switzerland. Microsoft Clarity records how you scroll, click and move around our pages, with typed text masked.
• Font requests: our pages load font files from Google Fonts, so Google receives your IP address when your browser requests them.
• Payment status: Whop tells us whether your payment succeeded or failed, together with your order details.

3.3 Information from Third-Party Sources

We may receive information about you when you connect with us, comment on or like our posts, or otherwise interact with us on social media platforms. Examples include your profile information, social media handle, name and email address.

3.4 What We Do Not Collect

• Your full card number or card security code. Whop processes these; we never see or store them.
• Your Grok or xAI account password.
• Anything you type, upload, connect or store inside Grok or Grok Bot.
• Information about colleagues you share the employees with under a Team License, unless they contact us themselves.

3.5 Members Area Sign-In, Devices and Progress

The members area has no password. You sign in with your email address, in one of two ways:

• Automatically, right after you buy: the thank-you page signs in the browser you paid with, using the ugb_claim cookie (see Section 8). This only works within 2 hours of your payment and only once Whop confirms it is paid.
• With a link or code we email you: you enter your email address on the sign-in page and, if it has an active purchase, we email you a sign-in link and a 6-digit code (the code is for signing in on another device). Each works once and expires after 15 minutes, and a code allows 5 wrong attempts. Your welcome email also contains a sign-in link, which works once and expires after 7 days. If our database has no purchase for your email address yet, we ask Whop whether it has a paid order for the Product, so a missed order confirmation does not lock you out.

To run the members area, we store the following in our members area database (see Supabase in Section 5.1):

• Sign-in links and codes: only a scrambled (hashed) copy of each link and code, never the link or code itself, with when it was created, when it expires, whether it was used, how many wrong codes were entered and, for links requested on the sign-in page, the IP address that requested it. To stop abuse, we also record the email address and IP address of each sign-in request and limit how many requests can be made in an hour.
• Sessions (your signed-in devices): each sign-in creates a session record with a random reference, when it started and was last checked, your browser’s user agent (a text string that describes your browser, operating system and device type), your IP address at sign-in and, once it has ended, when it ended. We also record when you last signed in.
• Device limit: your account can be signed in on up to 3 devices at once. If you sign in on a fourth, we sign out the device that has been signed in the longest and email you a “new sign-in” notice that shows the browser and operating system used (for example, “Chrome on Windows”) and the approximate time.
• One video at a time: while a lesson video plays, your browser checks in with our server every 20 seconds. We keep one record per account: which session is playing, which lesson, when playback started and the last check-in. If you start a video on another device, the first device pauses. This record is overwritten each time and holds nothing else.
• Lesson progress: for each lesson you start, whether it is started or completed, how far into the video you got (in seconds) and when this last changed, plus which employees you have marked as added to your team, so your progress follows you between devices.
• Team seats: if you hold a Team licence and add a teammate, we store their email address, that you added them, when they were added, invited and removed, and a log of seat changes with the IP address the change was made from (kept for up to 400 days). We send the teammate one invitation email that names you, so they know who added them. If someone added you as a teammate and you did not expect it, reply to that email and we will remove you.
• Access records: your email address, first name and your customer references at Whop and HighLevel; for each purchase, the Whop payment reference, tier, add-ons, amount, payment status and payment date; and which products you have access to. If a payment is refunded or disputed, we also record the refund or dispute reference, the amount and what we did about it.
• Order processing: when an order comes in, we keep its details (including your email address and name) while we send your welcome email and update your customer record. We delete them as soon as that is done, or after 30 days if it keeps failing.

Refunds and chargebacks: a full refund, or any dispute or chargeback, removes all the access that payment gave and signs you out on every device. A partial refund that matches the price of an add-on removes that add-on only. Any other partial refund is reviewed by us and does not change your access on its own. The change reaches a signed-in device within a few minutes.

4. How We Use Your Information

We use your personal information to:

• Process your payment and confirm your order
• Give you access to the Product, including the members area and your welcome email
• Sign you in to the members area, save your lesson progress so it follows you between devices and play one video at a time per account
• Keep your members area account secure and prevent account sharing, through the 3-device limit, the new sign-in notice and limits on sign-in requests
• Remove access to the Product when a payment is refunded, disputed or charged back, as described in Section 3.5
• Send you transactional emails about your purchase, such as access details and receipts
• Send you product update emails, including the Lifetime Free Updates to the employees included in your purchase
• Send you marketing emails where the law allows or where you have agreed to receive them (every marketing email includes an unsubscribe link)
• Tag your customer record with what you bought (tier and add-on) so you receive the right emails and the right access
• Understand, in aggregate, which pages and campaigns work, and improve the Website and Product
• Measure, for each page version and each ad, how many people visit, start a checkout, click “Complete Order” and buy, using our own visit records (Section 3.2)
• Where tracking is on, follow up on a checkout you started but did not complete, using the email address saved before payment (Section 3.1)
• For visitors outside the EEA, the UK and Switzerland who have not opted out, measure and improve our advertising on Facebook and Instagram (including showing our ads to people who visited our pages) and review anonymised recordings of how visitors use our pages
• Answer your questions, feedback and support requests, and handle refund requests under our Refund Policy
• Detect, prevent and address fraud, security incidents and illegal activity
• Comply with applicable laws, legal obligations and regulatory requirements, including tax and accounting rules
• Respond to legal and regulatory enquiries and assist law enforcement when required

4.1 Lawful Basis for Processing

Depending on the context, we process your personal information on these legal grounds:

• Contractual necessity: where we need it to fulfil our contract with you or to take steps at your request before entering one (for example, processing your order, delivering the Product, signing you in to the members area and saving your progress).
• Consent: where you have given us clear consent for a specific purpose (for example, receiving marketing emails where consent is required).
• Legal obligation: where we need it to comply with a legal obligation (for example, keeping transaction records).
• Legitimate interest: where we need it for our legitimate business interests and those interests are not overridden by your rights and freedoms (for example, preventing fraud, keeping your members area account secure, preventing account sharing, measuring which campaigns and pages work, using a cookieless daily code where tracking is off, following up on an unfinished checkout where tracking is on, and improving the Product).

5. Who We Share Your Information With

We do not sell, rent or trade your personal information. We share it only with the parties below, and only for the purposes described in this policy.

5.1 Our Service Providers

We do not share your personal information with xAI. If you use the Product, you deal with xAI directly through your own Grok account.

5.2 Customer Service Providers

We may share your information with people or providers who help us answer your enquiries and support requests.

5.3 Professional Advisors

We may share your information with auditors, accountants, consultants, legal professionals and other advisors who provide professional services to us.

5.4 Government Agencies and Law Enforcement

We may disclose your information to government agencies, courts, regulators and law enforcement where we must comply with applicable laws, regulations or legally binding processes, or in response to lawful requests such as subpoenas or court orders. We may also disclose it to establish, exercise or defend our legal rights, or to protect you, us or others from harm, fraud or illegal activity.

5.5 Business Transfers

If Soltan Enterprises Limited is acquired, merged with another entity or restructured in any way, your personal information may be transferred as part of that transaction. We may also share information with prospective purchasers during due diligence.

6. Emails and Automated Tagging

After you buy, we send you a welcome email with your access details and, from time to time, product update emails about the employees included in your purchase. These are part of delivering the Product. When you ask to sign in, we email you a sign-in link and code, and when a sign-in on a new device signs out an older one, we email you a notice (see Section 3.5). These are transactional emails too.

We use HighLevel to tag your customer record with what you bought, so that, for example, a Team buyer receives the Team materials and an add-on buyer receives that add-on. This is simple tagging based on your purchase. It does not produce legal effects or similarly significant effects on you. You can object to it at any time by contacting us.

Any marketing email we send includes an unsubscribe link (see Section 12.2).

7. Grok Bot and xAI

The employees in the Product run inside Grok Bot, on xAI’s servers. This means:

• Your chats, files, connected apps and business profile in Grok Bot are processed by xAI under xAI’s own terms and privacy policy, not ours.
• We do not receive, see, store or have access to that content.
• Your Grok account and Grok plan are a separate relationship between you and xAI.
• If you share the employees with colleagues under a Team License, each colleague’s use of Grok is governed by xAI’s terms and privacy policy.

Any questions or requests about data held in Grok or Grok Bot should go to xAI. We are happy to point you in the right direction if you are not sure where to start.

8. Cookies and Similar Technologies

We keep cookies to a minimum. Today the Website uses:

• Members area cookie (strictly necessary): after you sign in with the link or code we email you, we set a cookie called ugb_s that keeps you signed in for up to 30 days. It holds a signed session reference, your email address, your first name and which products you own, so the members area can show you what you bought. It is marked HttpOnly and Secure, so scripts on the page cannot read it, and the Website cannot give you access without it.
• Checkout sign-in cookie (strictly necessary): when you pay at our checkout, we set a short-lived cookie called ugb_claim that holds your payment reference and email address, signed so it cannot be altered. It lets the thank-you page sign the browser you paid with in to the members area straight away. It is deleted as soon as it has been used and lasts at most 2 hours.
• Checkout session storage (strictly necessary): during checkout your browser briefly stores a payment reference so we can confirm your order if the page reloads. It is cleared when the order is complete or when you close the tab.
• Members area browser storage (strictly necessary, functional): inside the members area your browser keeps a copy of your lesson progress, the employees you marked as added and your autoplay setting in local storage (ugb.members.v2), so pages open instantly. For the current tab only, it also keeps the lengths of the lesson videos (ugb.dur) and which lesson to play next when one finishes (ugb.autonext) in session storage. None of this is used for tracking or advertising. Your progress is also saved on our server, as described in Section 3.5.
• Your time check (strictly necessary, functional): if you own the Time Audit Employee (Max), the “Your time check” page in the members area keeps the time checks you paste in from Max, and who you picked to do each task, in local storage (ugb.timecheck.v1) on your device. This information stays on your device and is never sent to us or anyone else, including when you open it from a link Max gives you (that link’s data is read in your browser and removed from the address bar). You can delete a time check on that page at any time.
• Whop payment field: Whop’s payment field may use its own cookies or similar technologies to process your payment securely and prevent fraud, under Whop’s privacy policy.
• Vercel Web Analytics: cookieless. It counts visits in aggregate without placing anything on your device.
• Wistia video player (members area only): the lesson videos play in Wistia’s player, which loads from Wistia’s servers. Wistia’s player may set its own cookies or browser storage on your device, for example to support playback and, except for visitors in the EEA, the UK or Switzerland or with Global Privacy Control, to record viewing statistics for each viewing session. These are set by Wistia’s player, not by us, under Wistia’s privacy policy.
• Visitor cookie (analytics and ad measurement, only where tracking is on): on the sales page and the checkout pages we set a first-party cookie called ugb_vid. It holds a random reference and nothing else, and lasts 400 days. It lets us recognise the same browser on a later visit, so a purchase can be linked to the page and the ad that led to it. Our server sets it, so your browser keeps it for the full period. It is never set in the EEA, the UK or Switzerland, with Global Privacy Control or after you opt out on our Your Privacy Choices page, and when tracking is off we delete one that is already there.
• First-visit cookie (ugb_ft, only where tracking is on): remembers the campaign tags of your first visit that came from an ad or campaign link, the time of that visit and a hashed (scrambled) copy of the Meta ad click reference, so a purchase made later, for example in another tab or browser window, can still be credited to that ad. It is set once by our server, lasts 90 days and cannot be read by scripts on the page. The same rules as ugb_vid apply: never set in the EEA, the UK or Switzerland, with Global Privacy Control or after you opt out, and deleted when tracking turns off for you.
• Sales and checkout session storage: ugb_utm keeps the campaign tags you arrived with, ugb_variant the version of the sales page you saw and ugb_fb whether you came from a Meta ad link, so the checkout can attach them to your order. They hold no identifier and are cleared when you close the tab. Where tracking is on, ugb_sid also holds a random reference for the current tab.
• Opt-out cookie (ugb_consent): when you click “Do not sell or share my personal information” on our Your Privacy Choices page, we set ugb_consent to “denied” for 1 year, so the choice is remembered in that browser. An older one left from an earlier cookie banner keeps counting until it expires (at most 180 days after it was set).
• Meta Pixel (advertising, outside the EEA, the UK and Switzerland only): sets the _fbp and _fbc cookies (90 days) and sends Meta the data described in Section 3.2. Under the same rules our server also keeps the ad click reference from a Meta ad link in the _fbc cookie and in our own ugb_fbc cookie (90 days from the ad click), so a purchase can be credited to the ad that led to it.
• Microsoft Clarity (analytics, outside the EEA, the UK and Switzerland only): sets the _clck (1 year) and _clsk (1 day) cookies; Microsoft may also set MUID and related cookies. Clarity keeps recordings for about 30 days and heatmap data for up to 13 months.

The Meta Pixel and Microsoft Clarity are loaded through Google Tag Manager. If you are in the EEA, the United Kingdom or Switzerland, they do not load for you and our server does not report your checkout visits, checkout email or purchase to Meta; we do not show a cookie banner, because we do not track visitors there. We work out your region from your browser’s time-zone setting (if it cannot be read, we treat you as being in those regions), and for the purchase report sent from our server we also check the country of your IP address. Elsewhere both tools run unless you opt out. To opt out wherever you are: use the button on our Your Privacy Choices page, turn on Global Privacy Control in your browser (Section 8.1), email support@rewyse.ai to object to this use of your data, or choose how Meta uses your activity for ads in Meta’s ad preferences. When the tools are off for you, we also do not set the ugb_vid visitor cookie or save your checkout email before you pay, and we delete any ugb_vid, Meta and Clarity cookies left from an earlier visit that our own domain can reach. After you opt out on our Your Privacy Choices page, Google Tag Manager does not load at all. Data already sent to Meta or Microsoft is kept under their own policies. Full details, including every cookie and how long it lasts, are in our Cookie Policy.

Most browsers let you block or delete cookies. If you block the members area cookies you will not be able to stay signed in to the members area, and the thank-you page will not be able to sign you in automatically (you can still sign in with the link or code we email you). If you block local storage, the members area still works, but it cannot show which lessons you have finished or where you left off.

8.1 Global Privacy Control (GPC)

We honour Global Privacy Control (GPC) signals. If your browser sends one, the Meta Pixel and Microsoft Clarity do not load, our server does not report your checkout visits, checkout email or purchase to Meta, we do not set the ugb_vid, ugb_ft or ugb_fbc cookies and we do not save your checkout email before you pay. We treat the signal as a valid opt-out of the sale or sharing of your personal information. Our Your Privacy Choices page does the same for browsers that do not send GPC.

For more detail, see our Cookie Policy.

9. How We Protect Your Personal Information

We take the security of your personal information seriously. We maintain reasonable and appropriate physical, technical and procedural safeguards designed to protect it from unauthorised access, alteration, disclosure or destruction. For example, payment details are handled by Whop and never reach our systems, the Website is served over an encrypted connection, the members area is only open to signed-in buyers, sign-in links and codes work once, expire quickly and are stored only in hashed form, and an account can be signed in on at most 3 devices at once.

However, no method of transmitting data over the internet or storing it electronically is completely secure. While we work to protect your personal information, we cannot guarantee absolute security. By using the Website, you acknowledge and accept this risk.

10. How Long We Keep Your Information

We keep your personal information only for as long as we need it for the purposes it was collected for, including to meet legal, accounting or reporting requirements.

When we no longer need your information, we securely delete or anonymise it. We cannot control the retention policies of third-party service providers, which keep data under their own policies.

11. Data Breach Notification

If a data breach compromises the security, confidentiality or integrity of your personal information, we will:

• Investigate promptly and take reasonable steps to limit any harm
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to your rights and freedoms
• Notify the relevant supervisory authority where applicable law requires it (including within 72 hours under the GDPR)
• Follow the recommended breach notification guidelines under Hong Kong’s Personal Data (Privacy) Ordinance

We maintain internal breach response procedures and will tell you about the nature of the breach, the data affected and the steps we are taking to address it.

12. Your Rights

Wherever you live, we believe you should have meaningful control over your personal information. You can exercise the following rights by emailing support@rewyse.ai:

• Right to access: ask for a copy of the personal information we hold about you.
• Right to correction: ask us to correct inaccurate or incomplete personal information.
• Right to deletion: ask us to delete your personal information, subject to legal retention requirements.
• Right to restrict processing: ask us to limit how we process your personal information in certain circumstances.
• Right to data portability: ask for your personal information in a structured, commonly used, machine-readable format.
• Right to object: object to our processing of your personal information, including for direct marketing or automated tagging.
• Right to withdraw consent: where we rely on your consent, withdraw it at any time. This does not affect processing carried out before you withdrew it.

We will respond within 30 days (or within 40 days as permitted under Hong Kong’s Personal Data (Privacy) Ordinance). We may need to verify your identity before we act on your request.

12.1 Deleting Your Information

If you ask us to delete your personal information, we will delete or anonymise your customer record within 30 days. Once it is deleted, we will no longer be able to confirm your purchase, resend your access details or send you product updates. Records we must keep by law (such as transaction records) are kept as set out in Section 10. Deleting your information with us does not delete anything in your Grok account; for that, contact xAI.

12.2 Unsubscribing from Marketing Emails

You can opt out of marketing emails at any time by clicking the “unsubscribe” link in any marketing email we send. This does not stop transactional emails about your purchase, such as order confirmations and access instructions.

13. International Data Transfers

The Website is available to people worldwide. Our service providers and their servers may be located outside your country or region, including in the United States and other jurisdictions. Your personal information may therefore be transferred to, stored in and processed in countries other than your own. When we transfer it internationally, we take steps to make sure appropriate safeguards are in place, including:

• Relying on the Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EEA
• Making sure our service providers maintain appropriate data protection standards through contractual obligations
• Complying with applicable data transfer requirements under Hong Kong’s Personal Data (Privacy) Ordinance

By using the Website, you acknowledge that your personal information may be processed in jurisdictions with different data protection laws from your own. This Privacy Policy is governed by the law of Hong Kong SAR, China.

14. Notice Under Hong Kong’s Personal Data (Privacy) Ordinance (PDPO)

As a company registered in Hong Kong, we are committed to complying with the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) and its six Data Protection Principles:

• DPP1, Purpose and Manner of Collection: we collect personal data only for lawful purposes directly related to our business, by means that are fair and not unreasonably intrusive.
• DPP2, Accuracy and Retention: we take reasonable steps to keep your personal data accurate and up to date, and not to keep it longer than necessary.
• DPP3, Use of Data: we use your personal data only for the purposes it was collected for, or directly related purposes, unless we have your consent.
• DPP4, Data Security: we take reasonable steps to protect your personal data against unauthorised or accidental access, processing, erasure, loss or use.
• DPP5, Openness: we make information about our data practices publicly available through this Privacy Policy.
• DPP6, Access and Correction: you have the right to ask for access to, and correction of, your personal data held by us.

To make a data access or correction request under the PDPO, email support@rewyse.ai. We will respond within 40 days as the Ordinance requires.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong at www.pcpd.org.hk.

15. Notice for Individuals in the EEA, United Kingdom and Switzerland (GDPR)

This section applies to individuals covered by the General Data Protection Regulation (“GDPR”), including its United Kingdom equivalent. If you are located in the European Economic Area (EEA), the United Kingdom or Switzerland, the following additional rights and protections apply to you.

15.1 Legal Basis for Processing

We process your personal information on the legal bases described in Section 4.1. On request, we are happy to tell you which legal basis applies to any particular processing activity.

15.2 Your GDPR Rights

In addition to the rights in Section 12, you have the following rights:

• Right to lodge a complaint: you may complain to the supervisory authority in your country of residence. A list of supervisory authorities is available at edpb.europa.eu.
• Right to be informed about international transfers: you have the right to know about international transfers of your personal data and the safeguards in place. See Section 13.
• Right not to be subject to automated decisions: we tag customer records automatically based on what you bought (see Section 6). You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you. To exercise this right, email support@rewyse.ai.

16. Your US State Privacy Rights (California and Other States)

This section applies to residents of California and of the other US states with a consumer privacy law (such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon). California’s law is the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”); the other states’ laws give similar rights. Wherever you live in the US, we give you the rights below.

16.1 Your Rights

• Right to know: you can ask about the categories and specific pieces of personal information we have collected about you, the sources, the purposes and the categories of third parties we have shared it with over the past 12 months. You can make this request free of charge, up to twice a year.
• Right to delete: you can ask us to delete the personal information we have collected about you, subject to certain exceptions.
• Right to correct: you can ask us to correct inaccurate personal information.
• Right to opt out of sale, sharing and targeted advertising: we do not sell your personal information for money. Letting Meta use the Meta Pixel and our purchase reports to show you ads may count as “sharing” personal information for cross-context behavioural advertising (“targeted advertising” in some states). You can opt out at any time on our Your Privacy Choices page, by clicking “Do not sell or share my personal information”, or by sending a Global Privacy Control (GPC) signal, which we honour automatically as the same opt-out. After you opt out, the Meta Pixel, Microsoft Clarity and Google Tag Manager stop, our server does not report your checkout visits, checkout email or purchase to Meta, we do not set the ugb_vid, ugb_ft or ugb_fbc cookies and we do not save your checkout email before you pay. The choice made on the page is remembered in that browser; to apply it to an email address, email support@rewyse.ai. You can also choose how Meta uses your activity for ads in Meta’s ad preferences.
• Right to limit use of sensitive personal information: we do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA/CPRA.
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights, including by denying you the Product, charging you a different price or giving you a lower quality of service.

To exercise your right to know, delete or correct, email support@rewyse.ai. You can also ask someone you have authorised to make the request for you. We will verify your identity before acting on your request and respond within 45 days. If we turn down your request, you can appeal by replying to our answer with the word “Appeal”; we will answer the appeal within 60 days and, if you are still not satisfied, you can contact your state’s Attorney General.

16.2 California’s “Shine the Light” Law

We do not share your personal information with third parties for their direct marketing purposes.

17. Notice for Nevada Residents

We do not exchange your personal information for monetary consideration with anyone who would license or sell it to third parties.

18. Children’s Privacy

The Website and the Product are not directed at or designed for children under 18. We do not knowingly collect, use, store or share personal information from children under 18. If you believe we have collected information from a child under 18 by mistake, please contact us at support@rewyse.ai and we will promptly delete it.

19. Third-Party Links and Services

The Website and the Product link to third-party websites and services, including Grok and Grok Bot. We do not control and are not responsible for the privacy practices, content or security of any third-party website or service. Please review the privacy policy of each one you use.

20. Changes to This Privacy Policy

We may update this Privacy Policy at any time, for example if we add a new service provider or start using advertising or analytics tools. When we do, we will update the “Last updated” date at the top of this page. For material changes that significantly affect how we handle your personal information, we will make reasonable efforts to notify you, such as by email or a prominent notice on the Website.

Your continued use of the Website after a change means you accept the updated policy.

Related pages: Your Privacy Choices, Terms and Conditions, Refund Policy, Cookie Policy and Earnings and Results Disclaimer.