Privacy Policy

Last updated: October 18, 2026

This policy explains what personal information SafeAI Kit collects, why, who receives it, how long we keep it, and the rights you have. We follow applicable US federal law and the privacy laws of the US states, including California's stricter rules (CCPA/CPRA), and Mexican law for our Spanish-speaking users. This policy also serves as our California notice at collection, our Mexican aviso de privacidad integral (see the Spanish version) and our GDPR notice for visitors from the EU/UK.

1. Who we are

SafeAI Kit ("SafeAI Kit", "we", "the company"), getsafeaikit.com, based in Chicago, Illinois, USA, is the business / data controller (responsable) for the data described here. Contact for every privacy matter: hello@getsafeaikit.com.

2. What we collect and why

We do not collect sensitive personal information, biometric identifiers or biometric information (so the Illinois Biometric Information Privacy Act does not apply to our site), precise location, or data from children. We don't use analytics, advertising pixels or tracking cookies, and we don't make decisions about you by automated means. Please don't send us your clients' tax data; the kit never needs it.

Categories in California terms: identifiers (email, hashed IP), commercial information (purchases), and internet activity limited to security logs. Sources: you, Stripe and our hosting provider.

3. Who receives your data

We don't sell, rent or "share" (for cross-context behavioral advertising) your personal information, and we haven't done so in the last 12 months. We use these service providers, which process data only on our instructions:

• Cloudflare, Inc. (USA): website hosting, database, security and email forwarding.
• Stripe, Inc. (USA): payments, receipts and subscription billing. Stripe also acts as an independent controller for fraud prevention and legal compliance (Stripe Privacy Policy).
• Google LLC (USA): the mailbox that receives messages sent to hello@.
• Resend (USA), once activated: sending transactional emails and the newsletter.

We may also disclose data if required by law, to protect our rights, or to a buyer if the business is sold (you would be told first).

4. How long we keep it

• Newsletter/checklist sign-ups: until you unsubscribe or ask us to delete them.
• Purchase records: as long as required by law (for example, tax and accounting rules). If you ask us to delete your data, we remove your email from these records and keep only the date, plan, amount reference and Stripe ID.
• Download links: expire after 30 days or 10 downloads.
• Deletion requests: your email is erased when the request is completed or expires; we keep a log entry with a one-way hash only as long as needed to prove the request was handled or as required by law.
• Emails to hello@: only as long as needed to answer you and handle any related matter.

5. Your rights

Wherever you live, we give everyone the same rights:

• Know / access what we hold about you, and get a portable copy.
• Delete your data: use Delete my data (instant, after you confirm by email) or write to us.
• Correct inaccurate data.
• Opt out of sale or sharing: we don't sell or share. We also treat a Global Privacy Control (GPC) signal as a valid opt-out.
• Limit use of sensitive data: we don't collect any.
• Withdraw consent / unsubscribe at any time with the link in every email.
• No discrimination: you won't get a different price or service for using your rights.

To make a request, email hello@getsafeaikit.com or use the delete page. We must verify that you control the email address involved, so we'll reply to that address. You may use an authorized agent; we'll ask for your signed permission and may verify your identity directly. We answer within 45 days (California) and, for Mexican residents, within the periods in the Spanish notice. If we refuse, we'll explain why and you can appeal by replying "Appeal"; we decide appeals within 45 days.

6. Do Not Sell or Share My Personal Information

SafeAI Kit does not sell or share personal information as those terms are defined by the California Consumer Privacy Act (as amended by the CPRA), and does not use it for targeted advertising. No action is needed. If that ever changes, we will update this notice first and offer a "Do Not Sell or Share" opt-out, and we will keep honoring GPC signals.

7. Email marketing

We only send the newsletter to people who asked for it. Every marketing email identifies us, includes our postal address and a working one-click unsubscribe link, as required by the US CAN-SPAM Act. We act on unsubscribes within 10 business days (usually immediately). Purchase and delivery emails are transactional.

8. Security

We use HTTPS everywhere, store data with Cloudflare, keep card data entirely with Stripe, hash IP addresses, use private expiring download links, and limit access to the owner. No system is perfect; if a breach affects you, we will notify you and the authorities as required by the Illinois Personal Information Protection Act and other applicable laws.

9. International visitors

Our servers and providers are in the United States. If you are in the EU, UK or Mexico, your data is transferred to the US to provide the service you ask for. EU/UK residents may also object to processing, ask us to restrict it, and complain to their data protection authority.

10. Children

The site is for businesses and adults. We don't knowingly collect data from anyone under 16 (or under 13 under COPPA). If you think a child gave us data, write to us and we'll delete it.

11. Changes

If we change this policy, we'll update the date above; for material changes we'll also email customers and subscribers.

See also: Cookie Policy · Terms · Legal notice.