Privacy and cookies
Who is responsible
Alex Bashlaev LTD, company no. 516686821, 55 HaMasger Street, Tel Aviv, Israel (המסגר 55, תל אביב), is responsible for the C3 account and learning data described here. Contact Alexmercurie@gmail.com for privacy requests. Dodo Payments separately handles payment and tax information under its own privacy notice.
What we use and why
We use your purchase email, payment reference, payment status and purchase date to deliver access and provide support. We record the terms version and delivery acknowledgement accepted at checkout, and when content is first opened, to administer purchases and resolve disputes. Lesson completion is saved so you can track your progress. We do not receive your full payment-card number.
Account protection
We store hashed session tokens, a random device identifier, a general browser/device label, sign-in and last-active times, and keyed hashes derived from network addresses. These support device limits, rate limiting and manual review of suspected sharing. A hash is pseudonymous data, not anonymous data. Our infrastructure providers also process IP addresses and technical logs to operate and secure their services. We do not automatically remove access solely because an IP address changes.
Essential cookies
The c3_session cookie keeps you signed in for up to 14 days. The c3_device cookie recognises a browser for up to 180 days. Both are first-party, HttpOnly cookies used for access and security. Signing out invalidates the session. The c3_checkout cookie keeps a signed checkout reference for up to 24 hours so we can confirm payment and avoid an unnecessary second checkout. Blocking essential cookies prevents sign-in. We do not load advertising pixels in the C3 student area or its policy pages. Other areas of the studio website have their own privacy information.
Service providers and transfers
C3 uses Vercel for hosting, Supabase for account verification and database storage, Dodo Payments for checkout, Cloudflare Stream for private video delivery, and Resend for transactional email delivery. They receive only data needed for their roles. These providers may process data in other countries, including the United States. International processing is subject to applicable data-protection requirements and the providers’ data-processing terms, including contractual transfer safeguards where required. Contact us for information about a transfer affecting your data. We do not sell C3 account data or use purchase consent as marketing consent.
Retention
Routine daily maintenance deletes security activity older than 30 days and expired or revoked session records after a further 30 days. Unpaid checkout requests are removed after 30 days. Progress includes your saved playback position and the unique video segments reported as watched by your browser. Account, entitlement and progress records are retained while needed to provide your ongoing access. Purchase and consent records may be retained longer to meet tax, accounting and legal requirements or resolve disputes. Financial and consent records are retained for applicable statutory recordkeeping periods and any ongoing dispute or legal hold. Once no longer required for these purposes or ongoing access, they are deleted or anonymised. Recovery copies may persist until their backup retention period expires.
Optional advertising measurement
If you choose Allow optional tools, Meta Pixel and the server-side Meta Conversions API measure visits to the C3 landing page, checkout starts and confirmed purchases so we can measure and improve our Facebook and Instagram ads. Meta may use these events for ad attribution and audiences under its privacy terms. It receives event and product information, purchase value and currency, browser and network information, and advertising identifiers such as _fbp and _fbc. We do not send your email, lesson activity or raw payment reference in these events. We record your advertising choice separately from purchase terms, and retry failed purchase events for up to seven days. Meta Pixel does not load on sign-in, lesson, account or policy pages. Use Privacy choices on the landing or payment-confirmation page to withdraw permission. The optional c3_marketing cookie keeps a signed checkout reference for up to seven days so a withdrawn advertising choice can stop pending server delivery. Withdrawing does not undo events already delivered. A local purchase-event marker helps prevent duplicate reporting and is removed on a later consented visit after 90 days. Blocking tracking does not prevent purchase or access.
Public-page session analytics
With your optional consent, Microsoft Clarity records browsing activity on the public C3 landing pages, including clicks, scrolling, time and navigation. It provides session replays and heatmaps to improve these pages. Form content is masked. Clarity does not load on checkout confirmation, sign-in, account, lessons, review, policy or admin pages. You can withdraw consent using Privacy choices. Microsoft processes this information under its privacy statement at https://privacy.microsoft.com/privacystatement.
Bonus fulfilment
We keep a record of the personal Kolbo code assigned to your purchase so we can deliver the included gift and prevent duplicate allocation. Kolbo processes redemption and any optional subscription under its own privacy terms. Your gift code is shown only after C3 account verification.
Email and marketing
Resend delivers purchase confirmations and release or delivery updates; Supabase uses Resend to send requested sign-in codes. Purchase and launch messages are service emails, not newsletter enrollment. We do not add buyers to a promotional mailing list just because they purchased. Any future marketing enrollment will be separate, optional and withdrawable. Account and purchase data are used to fulfil the purchase; proportionate security processing protects the service and its users; accounting records are retained to meet legal obligations.
Your choices and rights
Depending on applicable law, you may request access, correction, deletion, restriction, objection or a portable copy of your personal data, and complain to the relevant privacy regulator. Email support from your purchase address; we may reasonably verify your identity. Deleting data needed for method access can prevent continued access, and records required by law may need to be kept. Transactional access emails are necessary for the service; marketing messages, if offered, require a separate choice.