Last updated: October 22, 2026
This Privacy Policy explains how Setup Doctrine (“Setup Doctrine”, “we”, “us”, “our”) collects, uses and protects the personal data of visitors and customers (“you”) of https://setupdoctrine.com/ (the “Site”).
Setup Doctrine operates the Site and is the data controller for the personal data described in this Policy.
For all privacy questions and requests, contact us by email: info@setupdoctrine.com. Email is our only contact channel, and every request sent there is handled.
This Policy applies to personal data we process when you visit the Site, create an account, purchase a digital product or contact us. It does not apply to third-party websites we link to.
We keep data collection to a minimum.
| Data category | Examples | Source |
|---|---|---|
| Account data | Name (or the name you choose to give) | You, at registration |
| Contact data | Email address | You, at registration |
| Authentication data | Password, stored only as a salted hash | You, at registration |
| Assessment answers | Your answers to the assessment questions (for example the markets you trade, your experience, how much risk and time you have) and the personal report built from them | You, when you take the assessment |
| Order data | Plan purchased (Subscription or Lifetime Access), subscription status and renewal dates, date and time, order reference, access status | Generated when you buy |
| Technical data | IP address, browser type, timestamps in security and server logs | Generated by our hosting |
| Anonymous usage statistics | Pages viewed, where a visit came from (for example a link or an Instagram post), device type, browser, country, and actions such as signing up. No name, email or cookie is stored in this data. | Generated by our statistics tool (Umami) |
We do not collect card numbers, bank details, identity documents, date of birth or any special category data.
Payments are processed by Stripe (Stripe Payments Europe, Limited and its affiliates), which acts as an independent controller for the payment data it collects. You enter card and banking details directly on its systems; we never see them. We receive only a payment confirmation, the transaction reference and the amount. See Stripe’s privacy notice at stripe.com/privacy.
We use only strictly necessary cookies: to keep you logged in, keep your checkout session and protect the Site against abuse. These do not require consent. We do not use advertising, profiling or tracking cookies. We measure how the Site is used with Umami, a privacy-focused statistics tool that sets no cookies and does not build profiles of individual visitors.
If you take the assessment before creating an account, your answers stay only in your browser (local storage on your device) while you answer. We do not receive them until you create an account, at which point they are saved to it. We also use local storage to keep an unfinished assessment so you can continue it.
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Matching you to strategies and building your personal report | Assessment answers | Contract, 6(1)(b) |
| Creating and running your account | Name, email, password hash | Contract, 6(1)(b) |
| Giving you access to purchased products | Account and order data | Contract, 6(1)(b) |
| Processing purchases, issuing receipts | Name, email, order data | Contract, 6(1)(b); legal obligation, 6(1)(c) |
| Recording whether a product was opened, to apply the refund policy | Account data, order data, access logs | Contract, 6(1)(b); legitimate interests, 6(1)(f) |
| Customer support | Name, email, message content | Contract, 6(1)(b); legitimate interests, 6(1)(f) |
| Security, preventing account sharing and redistribution | Technical data, access logs | Legitimate interests, 6(1)(f) |
| Understanding how the Site is used and which links bring visitors (anonymous statistics) | Anonymous usage statistics | Legitimate interests, 6(1)(f) |
| Accounting and tax records | Order data, name, email | Legal obligation, 6(1)(c) |
| Marketing emails about our products | Name, email | Consent, 6(1)(a), or soft opt-in where the law allows |
You can stop marketing emails at any time via the unsubscribe link or by emailing info@setupdoctrine.com. Withdrawal does not affect earlier lawful processing.
We do not make automated decisions with legal or similarly significant effects, and we do not profile you for advertising.
We do not sell personal data or share it for third-party marketing. We disclose it only to:
Where a provider processes data outside the EEA, the transfer relies on a European Commission adequacy decision or Standard Contractual Clauses. You can request a copy of the safeguards by email. Our providers based outside the EEA are Supabase, Inc., Stripe, Inc. and Umami Software, Inc. (United States).
| Data | Retention |
|---|---|
| Account data | While your account is active, then deleted or anonymised within 30 days of closure |
| Assessment answers and report | While your account is active, then deleted within 30 days of closure. Answers kept only in your browser before you sign up stay there until you clear your browser data |
| Order and transaction records | 10 years, as required by accounting and tax law |
| Product access logs | 24 months, to apply and defend the refund policy |
| Support correspondence | 24 months from the last message |
| Security and server logs | 6 months |
| Anonymous usage statistics | Up to 24 months, in a form that does not identify you |
| Marketing consent records | Until withdrawn, plus 3 years as proof |
Where we must keep a record for legal reasons, we use it for that purpose only.
Under the GDPR you have the right to:
Email info@setupdoctrine.com to exercise any right. We reply within one month, extendable by two months for complex requests, in which case we will tell you. We may ask you to write from the email linked to your account, to confirm it is you.
You also have the right to lodge a complaint with the data protection authority in your country of residence. We would appreciate the chance to resolve your concern first, so please contact us before you do.
We protect data with measures suited to the risk: TLS/HTTPS encryption in transit, passwords stored only as salted hashes, access limited to those who need it, logging of administrative access, and regular updates and backups.
No system is completely secure. If a breach is likely to pose a high risk to you, we will tell you without undue delay, and we will notify the supervisory authority within 72 hours where GDPR Art. 33 requires.
We may update this Policy and will change the “Last updated” date. For material changes, we will email registered users at least 14 days before they take effect.
Setup Doctrine — info@setupdoctrine.com