Privacy Policy

This Privacy Policy explains what Personal Data AI Code that Works, LLC ("AI Code that Works," "we," "us," or "our") collects through https://aicodethatworks.com (the "Site"), how we use it, who we share it with, and the rights you have over it. We aim for plain English; defined terms are introduced where they matter.

• We collect Personal Data you give us when you fill out a form (name, email, optional product-interest selections, optional free-text), and limited technical data set by analytics and error-monitoring cookies (subject to your consent).
• We use it to respond to you, send product updates you opt into, improve the Site, and run security and fraud-prevention controls.
• We share it with the named third-party Processors listed below — Supabase (database + auth), Vercel (hosting), GoHighLevel (CRM + email delivery), PostHog (product analytics), Sentry (error monitoring), HYROS (marketing attribution), Meta (the Meta Pixel and the server-side Meta Conversions API, subject to your marketing consent), and Google (Google Tag Manager + GA4, plus Google Ads when enabled).
• We do not sell Personal Data. We do not engage in cross-context behavioral advertising.
• You have rights under the GDPR, UK GDPR, and CCPA/CPRA. Exercise them by emailing alex@aicodethatworks.com.

The following capitalized terms have the meanings set out here:

• "Site" — the website at https://aicodethatworks.com.
• "Service" — the Site and any associated forms, content, and communications described in this Policy.
• "User" / "you" — any natural person who visits the Site, submits a form, or otherwise interacts with the Service.
• "Personal Data" — any information that identifies you, relates to you, or could reasonably be linked to you, as that term is defined under the EU/UK GDPR and the California Consumer Privacy Act (as amended by the CPRA) ("CCPA").
• "Processing" — any operation performed on Personal Data (collection, storage, use, disclosure, deletion), as defined under GDPR Article 4(2).
• "Controller" — the entity that determines the purposes and means of Processing. For Personal Data collected through the Service, AI Code that Works is the Controller.
• "Processor" — a third-party service provider that Processes Personal Data on the Controller's behalf under a Data Processing Agreement.

The Controller of your Personal Data collected through the Service is AI Code that Works, LLC, a limited liability company organized under the laws of Texas, United States. Our mailing address is 2303 Ranch Road 620 S., Suite 160-240, Lakeway, TX 78734, United States.

Contact for any privacy-related question, rights request, or complaint: alex@aicodethatworks.com. We do not currently maintain a separate EU representative or UK representative; if you reside in the EEA or the UK and prefer to contact a representative in your jurisdiction, please email us at the address above and we will route your request.

We collect the following categories of Personal Data through the Service:

• Information you give us through a form. Every form on the Site is wired to a single canonical Server Action (`captureLeadAction`) that stores the submission in our `leads` database table. The fields collected vary by form (newsletter signup, Starter Harness download request, free course enrollment, lab/cohort interest) but draw from a single typed schema: required — email address; optional — first name, last name, phone number, company, role, and free-text describing your build goal or use case. When you submit a form that is itself a marketing opt-in (one that sets `consent_marketing` to true — for example a newsletter signup, a Starter Harness download, a free-course enrollment, or a lab/community interest form) and you are not a test submission, we also send a subset of this lead record — your email address, your first and last name (where provided), and the marketing-attribution tags derived for your submission — server-side to HYROS, our attribution Processor, to attribute the lead to its marketing source. We do NOT send your details to HYROS when the submission does not carry marketing consent (for example a GDPR/CCPA data request, which sets `consent_marketing` to false) — that submission is skipped before any HYROS call. See § Who we share Personal Data with for the full description and how to opt out.
• Provenance metadata captured with each form submission. We attach to each `leads` row the page slug you submitted from and the call-to-action tag of the specific form. We also record three consent-related fields derived from the form itself, not from the cookie banner: `consent_marketing` (a boolean reflecting the opt-in promise of the specific form's copy — e.g. a newsletter signup, a Starter Harness download, or a free-course enrollment sets it to true because submitting the form is the disclosed opt-in action, while a data-request form sets it to false because the form isn't a marketing opt-in), `consent_analytics` (defaults to false; not propagated from your cookie-banner choice today), and `consent_at` (the timestamp of the form submission). We also capture marketing-attribution metadata when it is present: the URL campaign parameters (`utm_source`, `utm_medium`, `utm_campaign`, `utm_term`, `utm_content`) on the link you arrived through, and the address of the external page that referred you (the HTTP `Referer`). These are read from your browser at the moment you submit a form — the same information a hidden form field would carry — and stored on your `leads` row so we can understand which campaigns and sources bring people to us. This is first-party, functional capture tied to a form you chose to submit; it is not cross-site tracking, and we store only the campaign tags and the referring address, never your browsing history. Within a single visit we also remember the first set of campaign parameters you arrived with — held in your browser's session storage and cleared when you close the tab — so that if you convert on a later page the original campaign is still credited. The `consent_ip` column remains unused: the IP address that submitted the form is read transiently for per-IP rate limiting (capped at approximately 10 requests per minute per IP) and is not written to the lead record. That same transiently-read submission IP is also forwarded to Meta's Conversions API as a match key for the consent-gated server-side `Lead` event (see § Who we share Personal Data with) — only when you have not denied marketing consent and your browser does not send a Global Privacy Control signal; it is still not stored on the lead record.
• Technical / device data set by analytics and error-monitoring tools, gated by your cookie-banner choice. When you grant analytics consent, PostHog (product analytics) opts in and begins capturing aggregate usage events (pages viewed, referrer, browser and OS metadata, viewport dimensions, and a pseudonymous device identifier) with cookies named `ph_*`. The PostHog SDK initializes in opt-out mode (`opt_out_capturing_by_default: true`) and only opts in after consent; withdrawing consent re-asserts opt-out and resets the SDK's local identity. When you grant analytics consent, Sentry (error monitoring) also begins session-mode session replay (no session-mode replays are captured before consent — the SDK initializes with `replaysSessionSampleRate: 0` and the `<SentryReplayConsentGate>` only calls `start()` after consent is granted). Regardless of analytics consent, Sentry captures error breadcrumbs (the list of UI actions that preceded a crash), browser metadata, and a short rolling buffer (~15-30 seconds) that is flushed to Sentry only when an error occurs — the Sentry SDK's default PII masking (`maskAllText`, `maskAllInputs`, `blockAllMedia`) keeps the error buffer free of identifiers, which we rely on as a legitimate-interest basis for debugging. We opt every Sentry scope — client-side, server-side, and edge-runtime — out of automatic IP capture by setting `ip_address: null`: the client-side scope is opted out on every page mount via our observability seam, and the server-side and edge-runtime scopes apply a `beforeSend` hook that strips `event.user.ip_address` along with the common IP-bearing request headers (`X-Forwarded-For`, `X-Real-IP`, `True-Client-IP`, `CF-Connecting-IP`) from every event before it leaves the runtime.
• GTM-relayed Google tag data (governed by Google Consent Mode v2 with region-based defaults). Our Google Tag Manager container (GTM-WR9T9R8J) loads Google Analytics 4 cookies (`_ga`, `_gid`, and other `_ga_*` measurement-ID cookies), and we run a Meta Pixel (cookies `_fbp`, `fr`) and may run Google Ads conversion tags (`_gcl_*`). Whether these set cookies on landing depends on the regional default described in § Cookies and similar technologies and the Cookie Policy: outside the EEA, the UK, and Switzerland (for example in the US, Canada, Australia, and New Zealand) the default is GRANT, so these tags fire on landing on an opt-out basis and you turn them off via the cookie banner; inside the EEA, the UK, and Switzerland the default is DENY, so they stay gated until you grant the matching analytics/marketing consent. In all regions, an explicit choice on the cookie banner overrides the regional default.
• Attribution-pixel data set by the HYROS attribution pixel (governed by the same region-based default). We use the HYROS attribution pixel (the HYROS Universal Script, loaded from `*.t.hyros.com` through our Google Tag Manager container) to measure which marketing channels, ads, and campaigns lead to sign-ups and purchases. Outside the EEA, the UK, and Switzerland (for example in the US, Canada, Australia, and New Zealand) this pixel loads on landing on an opt-out basis; inside the EEA, the UK, and Switzerland it is suppressed until you grant consent through the cookie banner (it requires marketing consent there, like the other marketing tags). It records page views, a pseudonymous session/visitor identifier, and the marketing-attribution metadata on the page where you arrive (the URL campaign parameters — `utm_source`, `utm_medium`, `utm_campaign`, `utm_term`, `utm_content` — and the HTTP `Referer` address) for the visitors it fires for, not only form submitters; it is not used to build a cross-site advertising profile of you and we do not sell the data it collects. Our legal basis for this Processing is your consent where consent is required (EEA/UK/Switzerland) and our legitimate interest in measuring the effectiveness of our marketing (GDPR Article 6(1)(f)) where it is not. Where the pixel fires on an opt-out basis you can opt out via the cookie banner or by emailing us at the address above; on receipt of an opt-out request we stop using the HYROS pixel to attribute your activity and exclude you from this attribution Processing going forward. We also forward a Global Privacy Control (GPC) signal to our tag platform as a denial of marketing and analytics consent. See the Cookie Policy for the pixel's entry in the inventory.
• Network metadata captured by our hosting provider, Vercel, including your IP address, request URL, HTTP method, response status, and timestamp, retained for security, abuse prevention, and operational logging.
• Information you send us by email. If you email us at the address above, your email address, your name (if you provide it), the subject line, and the body of the email.

For California residents, the following categories of Personal Information from CCPA Section 1798.140 are collected through the Service:

• Identifiers — name, email address, phone number (where provided), IP address.
• Customer record information (Cal. Civ. Code § 1798.80(e)) — name, email, phone, company name.
• Commercial information — programs or content (free course, Starter Harness, lab/cohort) you express interest in.
• Internet or other electronic network activity — pages visited, referrer URL, browser/OS metadata, viewport dimensions, and a pseudonymous device identifier. PostHog captures this category only when you grant analytics consent (mirroring the analytics-capture list in § Information we collect above). Separately, the HYROS attribution pixel captures page views, a pseudonymous session/visitor identifier, and on-page marketing-attribution metadata (URL campaign parameters and the HTTP `Referer` address) on a region-based default — on an opt-out basis outside the EEA, the UK, and Switzerland, and only after you grant consent inside the EEA, the UK, and Switzerland (see § Cookies and similar technologies) — and, after a marketing-opt-in form submission (a form that sets `consent_marketing` to true, for example a newsletter signup, a Starter Harness download, or a free-course enrollment; submissions without marketing consent, such as a data request, are not shared with HYROS), we send your email, name (where provided), and derived attribution tags to HYROS server-side; see § What Personal Data we collect and § Who we share Personal Data with. Where they are present when you submit a form, the URL campaign parameters (`utm_*`) and the referring page address (the HTTP `Referer`) are also stored on your `leads` row as first-party attribution metadata (see the Provenance-metadata item in § What Personal Data we collect); when they are absent, those columns are left null.
• Geolocation data — country/region inferred from IP. We use the country your IP indicates to set the default consent state for analytics and marketing tags (opt-in inside the EEA, the UK, and Switzerland; opt-out elsewhere — see § Cookies and similar technologies). We do NOT collect precise (city-block-level) geolocation.
• Inferences drawn from the above — none currently used to build a consumer profile reflecting preferences or characteristics.
• Sensitive Personal Information (CPRA) — none collected.

We do not knowingly collect Personal Information about minors under 16. See the Children's Privacy section below.

We Process Personal Data only for the specific purposes set out below, and only on the GDPR legal basis named for each. We rely on the equivalent basis under the UK GDPR for UK residents.

• To respond to your form submission, deliver the lead magnet (Starter Harness, course access, etc.) you requested, send the newsletter or program update you opted into, and route the lead to our CRM (GoHighLevel) for follow-up. Legal basis: performance of pre-contractual steps at your request (GDPR Article 6(1)(b)) and, for opt-in marketing communications, your consent (GDPR Article 6(1)(a)).
• To send you newsletter, educational content, and program announcements about AI Code that Works (the free course, the Starter Harness, the paid lab/cohort program, and related education offerings). We send marketing email only when you have opted in via a form or via reply-to-our-emails confirmation. Legal basis: your consent (GDPR Article 6(1)(a)); you can withdraw consent at any time by clicking the unsubscribe link in any email or emailing us.
• To operate and improve the Site through aggregated analytics. Legal basis: your consent (analytics category, GDPR Article 6(1)(a)) where required, or our legitimate interests in understanding which pages and content perform (GDPR Article 6(1)(f)) where consent is not required.
• To monitor for errors, debug, and maintain the security and integrity of the Site. Legal basis: our legitimate interests in keeping the Site secure and functional (GDPR Article 6(1)(f)).
• To prevent abuse and enforce our Terms of Service. We use rate-limiting (capped at approximately 10 form submissions per IP address per minute) and may temporarily block IP addresses that exceed the threshold. Legal basis: our legitimate interests in fraud and abuse prevention (GDPR Article 6(1)(f)).
• To comply with our legal, regulatory, and tax obligations, and to establish, exercise, or defend legal claims. Legal basis: compliance with a legal obligation (GDPR Article 6(1)(c)) and our legitimate interests in defending claims (GDPR Article 6(1)(f)).

Where our basis is legitimate interests, we have carried out a balancing test and concluded that our interests are not overridden by your interests, fundamental rights, or freedoms. You may object to legitimate-interests Processing on grounds relating to your particular situation by emailing us at the address above.

We do not engage in automated decision-making that produces legal or similarly significant effects on you, including profiling under GDPR Article 22.

We share Personal Data only with the third-party Processors listed below, and only to the extent each one needs to perform a function on our behalf. We have entered into Data Processing Agreements with each Processor, or rely on the Processor's published standard data-processing terms incorporating the EU Standard Contractual Clauses (which take effect when we accept the provider's terms of service); operator-side execution of each provider's DPA is tracked in GitHub Issue #473. Each Processor is itself the Controller of the limited operational metadata it must retain to run its service:

• Supabase, Inc. (United States) — database and authentication. Stores `leads` records, consent state, and audit/usage event ledgers. Privacy notice: https://supabase.com/privacy.
• Vercel Inc. (United States) — hosting and edge runtime. Receives every HTTP request to the Site, including IP address and request metadata. Privacy notice: https://vercel.com/legal/privacy-policy.
• GoHighLevel (LeadConnector LLC, United States) — CRM, email delivery, and lead workflow automation. Receives `leads` records after submission for follow-up email communications. Privacy notice: https://www.gohighlevel.com/privacy-policy.
• PostHog Inc. (United States, with EU cloud option) — product analytics. Receives pseudonymous page-view and page-leave events. Session replay is NOT enabled in our PostHog configuration today; if we enable it in the future, this Policy will be updated. Privacy notice: https://posthog.com/privacy.
• Functional Software, Inc. dba Sentry (United States) — error monitoring and session replay. Receives error stack traces, breadcrumbs, and session replays. Session-mode replay fires only after you grant analytics consent (via `<SentryReplayConsentGate>`). A short rolling buffer is maintained regardless of consent and flushed to Sentry only when an error occurs; it relies on the Sentry SDK's default PII masking to remain free of identifiers. Privacy notice: https://sentry.io/privacy.
• Google LLC (United States) — Google Tag Manager (the tag-relay container we run at `GTM-WR9T9R8J`), Google Analytics 4 (when analytics consent is granted), and, in the future, Google Ads (when marketing consent is granted). Privacy notice: https://policies.google.com/privacy.
• Meta Platforms, Inc. (United States) — a third-party marketing / ad-attribution service. We share data with Meta through two paths, both gated on your marketing-tracking consent. (1) The Meta Pixel (cookies `_fbp`, `fr`, loaded through our Google Tag Manager container) measures ad conversions on Meta platforms; it follows our region-based default — it fires on landing on an opt-out basis outside the EEA, the UK, and Switzerland, and is suppressed until you grant marketing consent inside the EEA, the UK, and Switzerland, and it honors a Consent Mode denial (including the one GPC triggers) in all regions. (2) When you submit a form that is itself a marketing opt-in (one that sets `consent_marketing` to true — for example a newsletter signup, a Starter Harness download, a free-course enrollment, or a lab/community interest form) AND you have granted marketing-tracking consent, we also send your lead to Meta's Conversions API server-side: a hashed (SHA-256) form of your email address, first and last name, and phone number where provided, plus your Meta browser identifiers (`_fbp`/`_fbc`) and the IP address of your submission, so the conversion is attributed even if the browser pixel did not fire. Meta deduplicates the browser-pixel and server events for the same submission. This server-side share is skipped when you have not granted marketing-tracking consent (a `Reject all` choice, a GPC signal — honored both client-side and via the `Sec-GPC: 1` request header server-side — or the EEA/UK/Switzerland default before consent), when you use a non-marketing form (for example a GDPR/CCPA data request, which sets `consent_marketing` to false), and for test submissions. Our legal basis for both paths is our legitimate interest in measuring the effectiveness of our marketing (GDPR Article 6(1)(f)); to opt out — including the server-side lead share — email us at the address above. Privacy notice: https://www.facebook.com/privacy/policy/.
• HYROS (a third-party marketing-attribution service, United States) — we share data with HYROS through two paths. (1) The HYROS attribution pixel (`*.t.hyros.com`, the HYROS Universal Script loaded through our Google Tag Manager container) measures which marketing channels and campaigns lead to sign-ups and purchases. It follows a region-based default: it fires on landing on an opt-out basis outside the EEA, the UK, and Switzerland, and is suppressed until you grant consent through the cookie banner inside the EEA, the UK, and Switzerland; see § What Personal Data we collect for the data it sets and § Do Not Track and Global Privacy Control below for how to opt out. (2) When you submit a form that is itself a marketing opt-in — one that sets `consent_marketing` to true, for example a newsletter signup, a Starter Harness download, a free-course enrollment, or a lab/community interest form — we also send your lead details to HYROS server-side: your email address, your first and last name (where you provided them), and the marketing-attribution tags we derived for your submission, so the lead is attributed to its marketing source even if the browser pixel did not fire. HYROS upserts this record by email address (email is its natural key). This server-side share is gated on your marketing consent: if you use a non-marketing form (for example a GDPR/CCPA data request, which sets `consent_marketing` to false), your details are NOT sent to HYROS — the submission is skipped before any HYROS call. Test submissions are also excluded. Our legal basis for both paths is our legitimate interest in measuring the effectiveness of our marketing (GDPR Article 6(1)(f)); to opt out of HYROS attribution — including the server-side lead share — email us at the address above and we will stop using HYROS to attribute your activity. Privacy notice: https://hyros.com/privacy-policy/.

Affiliated brand — RevAStack. AI Code that Works and RevAStack are sibling brands of the same legal entity, AI Code that Works, LLC. If you opt into our newsletter or download a lead magnet, your contact details are processed by our shared GoHighLevel CRM and may be visible to operators of both brands for coordinated marketing. We do NOT sell your data to any third party; the cross-brand visibility is internal to one legal entity and one CRM workspace.

We do not sell Personal Data within the meaning of the CCPA, the CPRA, or any other US state privacy law that recognizes a right to opt out of sale. We do not share Personal Data for cross-context behavioral advertising. We will update this Policy and provide a conspicuous opt-out mechanism before that changes.

Beyond Processors, we may disclose Personal Data: (i) in response to a subpoena, court order, or other valid legal process, (ii) to law enforcement or governmental authorities to comply with applicable law, (iii) to protect our rights, property, or safety, or those of our users or the public, and (iv) in connection with the sale or merger of our business, in which case we will give you notice and an opportunity to object where required by law.

All of our Processors named above operate primarily from the United States. When we transfer Personal Data from the European Economic Area (EEA), the United Kingdom, or Switzerland to a country that the European Commission has not deemed to provide adequate protection, we rely on appropriate safeguards, including:

• The European Commission's Standard Contractual Clauses (Module 1: Controller-to-Controller; Module 2: Controller-to-Processor) (Commission Implementing Decision (EU) 2021/914), incorporated into our agreements with each Processor.
• The UK Addendum to the EU SCCs (issued by the ICO) for transfers from the UK.
• Where applicable, the EU-US Data Privacy Framework (DPF) or its UK Extension, for Processors that have self-certified under the DPF.
• Supplementary technical and organizational measures (encryption in transit and at rest, access controls, pseudonymization) where the transfer risk assessment recommends them.

You may request a copy of the relevant safeguards by emailing us at the address above. Please note that copies of executed agreements with third parties may be redacted to protect commercially sensitive terms.

We keep Personal Data only as long as we need it for the purpose it was collected, or as long as required by law. Our default retention periods are:

• Lead-capture records (the `leads` table) — 24 months from the date of your last interaction with us (form submission, email reply, or other inbound engagement), after which we delete or anonymize the record. We may retain a suppression-list entry (your email address tagged 'do not contact') indefinitely to honor opt-out requests.
• Analytics events (PostHog, GA4) — 14 months from event capture. After 14 months, individual events are deleted; aggregated, non-identifying summaries may be retained indefinitely for trend analysis.
• Sentry error events and breadcrumbs — 30 days from capture, after which they are deleted by Sentry's retention policy.
• Session replays — 30 days from capture; we apply field-level masking by default so most replays do not contain identifying input.
• Audit and usage-event ledgers (Supabase `audit_events` and `usage_events`) — 7 years, to support security investigations, billing reconciliation, and statutory record-keeping obligations.
• Email correspondence with us — for the duration of our ongoing relationship plus up to 7 years thereafter, for tax, accounting, and dispute-resolution purposes.
• Backups and disaster-recovery snapshots — up to 35 days after the source record is deleted, after which the backup retention window closes.

Where we are required by law to retain certain records (for example, tax records or records related to an active legal claim), we will keep them for the statutory period and apply the shortest retention period above only after the statutory period expires.

Depending on where you live and the law that applies to you, you have one or more of the following rights over your Personal Data.

To exercise any of the rights above, email us at alex@aicodethatworks.com with the subject line "Privacy Rights Request" and tell us (a) which right you want to exercise, (b) which jurisdiction's law applies to you (e.g., GDPR, CCPA), and (c) enough information for us to identify your records (typically the email address you used to submit a form).

We will acknowledge receipt of your request within 10 business days and complete our response within the statutory window applicable to you — typically within 1 month under the GDPR (extendable by 2 further months for complex requests), and within 45 days under the CCPA/CPRA (extendable by 45 further days on notice).

We may need to verify your identity before acting. For GDPR and CCPA requests, we typically verify by confirming you control the email address on file. We do not require additional documentation unless your request involves a high-risk action (e.g., deletion of an account with substantial history) or we have reason to believe your account has been compromised.

You may designate an authorized agent to make a request on your behalf. For California residents, the agent must provide proof of authorization (a written designation signed by you, or a power of attorney). We will then verify both the agent's authority and your identity, and may contact you directly to confirm.

There is no fee for exercising your rights. We reserve the right to charge a reasonable fee for, or refuse to act on, requests that are manifestly unfounded or excessive — in particular because of their repetitive character.

Our use of cookies and similar technologies (localStorage, sessionStorage, pixel tags) is described in detail in our Cookie Policy, including the specific cookies set, their purposes, durations, and how to manage your preferences. The Cookie Policy is incorporated into this Privacy Policy by reference.

Our consent model is Google Consent Mode v2 with region-based defaults, configured as follows. We set the default consent state from the country your IP indicates you are visiting from. If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, our default is to DENY analytics and marketing consent (opt-in): nothing analytics- or marketing-related fires until you grant consent through the cookie banner, and the banner is how you turn it on. If you are visiting from anywhere outside the EEA, the UK, and Switzerland — including the United States, Canada, Australia, and New Zealand — our default is to GRANT analytics and marketing consent (opt-out): analytics and advertising-measurement tags load on landing, and the cookie banner is how you turn them off (revoke consent), in addition to the Global Privacy Control signal and the email opt-out described below. PostHog opts in only after you grant analytics consent (the SDK is initialized with `opt_out_capturing_by_default: true`); Sentry session-mode session replay only starts after you grant analytics consent (via `<SentryReplayConsentGate>`). The functional cookie that stores your consent decision is named `revastack_consent`. These cookie names come from our shared observability package, which is namespaced under our parent organization; the provider of the cookie when set on this site is AI Code that Works. The cookie is set the first time you interact with the banner; if you have already made a banner choice, that choice overrides the regional default. The HYROS attribution pixel (`*.t.hyros.com`) is a third-party attribution tag that follows the same regional posture: outside the EEA/UK/Switzerland it fires on landing (opt-out) and you opt out via the cookie banner or by emailing us; inside the EEA/UK/Switzerland it is suppressed until you grant consent. See the Cookie Policy for full detail.

We apply technical and organizational measures designed to protect Personal Data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption in transit via TLS 1.2+ for every connection between you and the Site and between our services and Processors.
• Encryption at rest for the Supabase database and Vercel build artifacts.
• Row-Level Security (RLS) policies on the `leads` table and every other tenant-scoped table, enforcing isolation at the database layer rather than relying on application-level filtering.
• Least-privilege access controls — service-role credentials are never exposed to client bundles or browser code, and operator access to production data is gated and logged.
• Per-IP rate limiting on the form-submission endpoint to mitigate abuse and credential-stuffing.
• Automated error monitoring (Sentry) and audit-event ledgers in the database, so unusual activity surfaces quickly.

No security measure is perfect. We do not guarantee the absolute security of any Personal Data and you transmit it to us at your own risk. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required by law, and notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms (GDPR Articles 33-34).

The Service is not directed to, and we do not knowingly collect Personal Data from, individuals under the age of 16. If you are under 16, do not submit Personal Data through the Service or send us email. If we learn that we have collected Personal Data from a child under 16 without verified parental consent, we will delete that Personal Data as soon as reasonably possible.

If you are a parent or guardian who believes that we may have collected Personal Data from your child without your consent, please contact us at alex@aicodethatworks.com and we will investigate and respond promptly.

The Site links to third-party platforms that we do not operate or control — most notably (a) our Skool community at https://www.skool.com/aicodethatworks (where the free course and any paid lab/cohort programming are hosted), (b) our YouTube channel and individual video pages on https://www.youtube.com, and (c) the marketing website of our affiliated brand RevAStack at https://revastack.ai. This Privacy Policy applies only to data we collect through the Service. When you click through to any of these third-party platforms, the platform's own privacy notice governs the data they collect about you on their surfaces, and we encourage you to read each one before submitting Personal Data there.

AI Code that Works does not operate a software-as-a-service application at aicodethatworks.com — there are no user accounts, no API, and no billing surface on this Site. Enrollment in the free course and any paid programs happens on Skool (linked above); video content is hosted on YouTube; the Starter Harness is delivered as a free downloadable ZIP through our newsletter or download form.

Browsers vary in their handling of the Do Not Track (DNT) signal and there is no consensus among industry participants as to what DNT means. We do not currently respond to DNT signals as a standalone signal.

AI Code that Works honors the browser Global Privacy Control (GPC) signal across regions. When your browser exposes `navigator.globalPrivacyControl === true`, we dispatch a Consent Mode v2 denial of analytics and marketing consent regardless of your region's default — so even where our default would otherwise be to grant consent (outside the EEA, the UK, and Switzerland), GPC turns our analytics and marketing tags (GA4, the Meta Pixel, Google Ads, and the HYROS attribution pixel) off. You can still affirmatively grant consent via the cookie banner — the GPC spec recognizes the signal as a universal opt-out, not a binding floor, so an explicit Accept on the banner overrides GPC. We remember the explicit Accept on this device (in browser local storage and a first-party cookie) until you withdraw it via the banner; that means the override persists across subsequent page loads, not only the current session. We also honor the `Sec-GPC: 1` request header server-side for our export jobs (the Meta Conversions API and HYROS lead shares), so a visitor with a GPC-compliant browser is protected even when the client-side signal does not reach our browser-side layer.

The HYROS attribution pixel follows the region-based default. As described in § What Personal Data we collect and § Cookies and similar technologies, the HYROS pixel fires on landing on an opt-out basis outside the EEA, the UK, and Switzerland, and is suppressed until you grant consent inside the EEA, the UK, and Switzerland; in all regions it is configured to honor a Consent Mode denial (including the one GPC triggers), so a GPC signal or a "Reject all" choice on the banner turns it off. Where the pixel fires on an opt-out basis, you can also opt out by emailing us at alex@aicodethatworks.com; on receipt of your request we stop using the HYROS pixel to attribute your activity and exclude you from this attribution Processing going forward.

We may update this Privacy Policy from time to time. The 'Last updated' date at the top of the page reflects the most recent change. When a change is material, we will notify you by email (if we have your email on file and the change is relevant to your relationship with us) or by a prominent banner on the Site for at least 30 days before the change takes effect.

Your continued use of the Service after a material change becomes effective constitutes your acceptance of the updated Policy, except where we have asked for fresh consent under applicable law.

For any privacy-related question, rights request, or complaint, email us at alex@aicodethatworks.com.

Postal address — AI Code that Works, LLC, 2303 Ranch Road 620 S., Suite 160-240, Lakeway, TX 78734, United States.

Effective date: 2026-06-29.