Privacy Policy
Elyse Collat LLC
Effective date: August 1, 2026
Last updated: September 3, 2026
1. Who we are
Elyse Collat LLC ("Elyse Collat," "Company," "we," "us," or "our") is a Hawai'i limited liability company that provides business coaching, education, digital products, and related services to eCommerce and product-based business owners.
Contact for privacy matters:
Elyse Collat LLC 1629 Wilder Ave #1201 Honolulu, HI 96822 United States Email: hello@elysecollat.com
For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), Elyse Collat LLC is the data controller of the personal data described in this policy.
2. What this policy covers
This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what rights and choices you have.
It applies to:
- elysecollat.com and any subdomains or landing pages we operate
- Our course and membership platform hosted on Kajabi (including any elysecollat.mykajabi.com pages and checkouts)
- Our email marketing, forms, surveys, and quizzes
- Our paid programs and digital products, including The Growth Lab, eCommerce Unlock, and The Ads Fix
- Our free content, lead magnets, webinars, and challenges
- Our social media pages and any advertising we run
- Any other website, page, or service that links to this policy
Collectively we call these the "Services."
What this policy does not cover: third-party websites, platforms, and tools that we link to or that you access separately, including Instagram, Facebook, YouTube, LinkedIn, TikTok, Slack, Zoom, and your own Shopify store or ad accounts. Those are governed by their own privacy policies.
If you are an enrolled coaching client: this policy applies alongside your signed Client Agreement. Where your signed agreement addresses confidentiality of your business information, that agreement also applies.
3. Information we collect
3.1 Information you give us directly
| Category | Examples | When we collect it |
|---|---|---|
| Identifiers | Name, email address, phone number, mailing or billing address, Instagram handle, business name, website URL | Opt-in forms, checkout, application forms, discovery calls |
| Commercial information | Products and programs purchased, payment plan selected, purchase history, refund and support requests | Purchase and support |
| Payment information | Billing name, billing address, card details, and the last four digits of your card | Checkout (processed by our payment processors, not stored by us) |
| Business and professional information | Your revenue range, ad spend, business stage, platform, niche, goals, challenges, team size | Applications, onboarding surveys, coaching intake, pulse check surveys |
| Audio, video, and written content | Zoom recordings of coaching and sales calls, Slack messages, submitted homework, questions, and worksheets | Program delivery |
| Contract and signature data | Signed client agreements, signature, signing date, IP address at signing | Contract execution via our e-signature provider |
| Testimonials and likeness | Written testimonials, photographs, screen recordings, video clips, screenshots of your results | Where you provide them or consent to their use |
| Correspondence | Emails, DMs, comments, and support messages you send us | Any time you contact us |
3.2 Information we collect automatically
When you visit or interact with our Services we automatically collect:
- Device and connection data: IP address, browser type and version, operating system, device type, screen size, language, referring URL
- Usage data: pages viewed, time on page, scroll depth, clicks, links followed, video watch time, lesson and course progress, checkout steps started and completed
- Session recordings and heatmaps: anonymized recordings of mouse movement, clicks, and scrolling on our pages
- Email engagement: whether you opened an email, which links you clicked, and your delivery status
- Advertising data: whether you saw or clicked one of our ads, and which ad or campaign led you to us
- Cookies and similar technologies: see Section 6
3.3 Information we receive from third parties
- Payment processors: confirmation of payment, subscription status, chargeback and dispute notices
- Advertising platforms: aggregated campaign performance, audience insights, and conversion matching data
- Social platforms: your public profile information when you interact with our pages or ads
- Analytics providers: aggregated traffic and behavior reporting
- Referrals: if an existing client or partner refers you, we may receive your name and email
3.4 Client business data (coaching clients only)
If you enroll in a 1:1 or group coaching program, you may grant us access to your business accounts and data so we can audit and advise on them. This can include:
- Your Shopify store, admin, and analytics
- Your Meta Business Manager and ad accounts, including creative performance data
- Your Google Ads and Google Analytics accounts
- Your Klaviyo or other email platform, including list size, flows, and campaign metrics
- Screenshots, exports, dashboards, and reports you send us
- Ad creative and performance data reviewed through our creative analytics tool
How we treat this data:
- We use it only to deliver the coaching and strategy you have paid for
- We do not sell it, and we do not share it with other clients in an identifiable form
- We may use anonymized, de-identified patterns and learnings to improve our teaching and to create educational examples, with all identifying details removed
- We will not publish your business name, store URL, screenshots, or specific numbers in marketing without your separate consent
- Access is revoked at the end of your engagement upon your request, and we ask that you remove our access at that point as well
- Where we grant a contractor or team assistant access, they are bound by a written confidentiality agreement
Your business data may include personal data belonging to your customers (for example, customer names in a Shopify order view or subscriber emails in a Klaviyo list). Where that happens, you remain the controller of that data and we act as a processor on your behalf and only on your instructions. If you require a formal Data Processing Agreement, contact hello@elysecollat.com.
3.5 Sensitive personal information
We do not intentionally collect sensitive personal information as defined under the CPRA or special category data as defined under the GDPR. We do not ask for government identification numbers, precise geolocation, health data, racial or ethnic origin, religious beliefs, union membership, sexual orientation, or biometric data.
Please do not send us this information. If you volunteer it in a coaching call, Slack message, or email, we do not use it for any purpose other than responding to you, and we do not use or disclose it to infer characteristics about you.
4. How we use your information
We use personal information to:
- Deliver what you bought. Grant course access, run coaching calls, provide Slack support, deliver templates and resources, and manage your enrollment.
- Process payments. Take payment, run payment plans, issue refunds where applicable, and handle failed payments and disputes.
- Communicate with you. Send transactional emails such as receipts, access links, call reminders, and program announcements, and respond to your questions.
- Market to you. Send newsletters, promotions, launch emails, and offers where you have opted in or where permitted by law, and run advertising on Meta, Google, and other platforms.
- Personalize your experience. Segment our email list and site content by your business stage, interests, and behavior so what you receive is relevant.
- Improve our Services. Analyze traffic, conversion, and content engagement, run A/B tests, review session recordings, and develop new programs and resources.
- Measure our advertising. Track which ads and pages drive opt-ins and purchases, build custom and lookalike audiences, and exclude existing buyers from acquisition campaigns.
- Keep things secure and lawful. Detect and prevent fraud, abuse, chargebacks, unauthorized sharing of paid materials, and violations of our Terms of Use.
- Meet our legal obligations. Keep accounting and tax records, respond to lawful requests, and establish or defend legal claims.
4.1 Legal bases (EEA, UK, and Switzerland)
Where the GDPR applies, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Delivering programs and products you purchased | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and enforcing payment plans | Performance of a contract; legal obligation |
| Transactional and service emails | Performance of a contract |
| Marketing emails and newsletters | Consent (Art. 6(1)(a)), withdrawable at any time |
| Analytics, session recording, and advertising cookies | Consent where required |
| Strictly necessary cookies | Legitimate interests (Art. 6(1)(f)) |
| Improving our Services and developing new offers | Legitimate interests |
| Fraud prevention, security, and enforcing our terms | Legitimate interests |
| Bookkeeping, tax, and record retention | Legal obligation (Art. 6(1)(c)) |
| Using your testimonial or likeness in marketing | Consent, or performance of a contract where your signed Client Agreement grants it |
5. Who we share your information with
We do not sell your personal information for money.
We share personal information with the following categories of recipients:
5.1 Service providers and processors
| Provider | Purpose | Data involved |
|---|---|---|
| Kajabi | Course hosting, checkout, member accounts, email marketing, forms | Name, email, purchase history, course progress |
| Payment processors (including Stripe and PayPal, as offered at checkout) | Payment processing, subscriptions, refunds, disputes | Billing details, card data, transaction records |
| Klaviyo and other email tools | Email marketing and automation | Name, email, engagement and purchase data |
| Netlify | Website hosting for elysecollat.com | IP address, request logs |
| GoDaddy | Domain registration and DNS | Domain records |
| Google (Google Analytics 4, Google Ads) | Website analytics and advertising measurement | Pseudonymous identifiers, usage data, IP address |
| Meta Platforms (Facebook and Instagram) | Advertising, conversion tracking, custom audiences | Pseudonymous identifiers, hashed email, event data |
| Hotjar / Contentsquare | Session recording, heatmaps, on-site surveys | Pseudonymous usage data, anonymized recordings |
| Zoom | Live coaching calls and recordings | Name, email, audio, video, chat |
| Slack | Community and client support | Name, email, messages, files |
| Scheduling tools | Booking coaching and discovery calls | Name, email, time zone, booking notes |
| E-signature provider (BoldSign) | Executing client agreements | Name, email, signature, IP address, signing timestamp |
| Google Workspace | Email, documents, file storage | Any data contained in correspondence and documents |
| Creative analytics tool (Motion) | Analyzing 1:1 client ad account performance | Client ad account and creative performance data |
| Team contractors and assistants | Admin, marketing, and delivery support under written confidentiality obligations | Only what is needed for their role |
| Accountants and legal advisors | Tax, compliance, and legal advice | Financial and contract records |
This list reflects our stack as of the effective date and may change. We require service providers to protect your information and to use it only for the purposes we specify.
5.2 Other disclosures
- Legal and safety: where required by law, subpoena, or court order, or to protect our rights, property, or safety, or that of others
- Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy
- With your consent: any other disclosure you direct or approve
5.3 Sharing for advertising
We use advertising and analytics technologies, including the Meta pixel and Google Analytics, that transmit identifiers and behavioral data to those platforms. Under the CCPA as amended by the CPRA, and under several other US state privacy laws, this activity may be treated as "sharing" personal information for cross-context behavioral advertising, and in some interpretations as a "sale."
We do not receive money for it, but you have the right to opt out. See Section 11.3.
6. Cookies, tracking, and your choices
6.1 What we use
- Strictly necessary cookies that keep you logged in, hold your cart, and secure checkout
- Analytics cookies (Google Analytics 4, measurement ID G-X5JR1XCWVK) that tell us how our pages perform
- Behavior analytics (Hotjar / Contentsquare, site ID ff0cb53c0fed8) that record anonymized sessions and build heatmaps
- Advertising cookies and pixels (Meta pixel ID 28285593884461799, Google Ads tags) that measure conversions and build audiences
- Email tracking pixels that record opens and clicks
6.2 How to control them
- Browser settings: most browsers let you block or delete cookies. Blocking strictly necessary cookies may break checkout and course access.
- Google Analytics: install the Google Analytics Opt-out Browser Add-on.
- Meta: adjust your ad preferences in your Facebook or Instagram settings.
- Industry opt-outs: optout.aboutads.info and youronlinechoices.eu.
- Email: click "unsubscribe" in any marketing email.
- Cookie banner: where we display a consent banner, you can change your choices there at any time.
6.3 Do Not Track and Global Privacy Control (CalOPPA)
California Business and Professions Code section 22575(b)(5) requires us to tell you how we respond to Do Not Track signals.
Do Not Track (DNT): there is no industry standard for how sites should respond to DNT browser signals. We currently do not respond to DNT signals.
Global Privacy Control (GPC): we treat a GPC signal received through your browser as a valid request to opt out of the sale and sharing of personal information for that browser and device, as required by California law.
6.4 Third-party tracking (CalOPPA)
Third parties, including Meta and Google, may collect personally identifiable information about your online activities over time and across different websites when you visit our Services. We do not control this activity beyond the choices described above.
7. International transfers
We are based in the United States and our service providers are located primarily in the United States. If you access our Services from the EEA, the UK, Switzerland, Australia, Canada, or elsewhere, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.
Where we transfer personal data out of the EEA or the UK, we rely on:
- The European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, incorporated into our agreements with service providers, or
- The EU-US Data Privacy Framework and its UK Extension, where the recipient is certified, or
- Your explicit consent, or the necessity of the transfer to perform our contract with you
You may request a copy of the relevant safeguards by emailing hello@elysecollat.com.
8. How long we keep your information
| Data | Retention period |
|---|---|
| Email subscriber records | Until you unsubscribe, plus up to 24 months of inactivity, then deleted or anonymized |
| Customer and transaction records | 7 years from the transaction, for tax and accounting purposes |
| Signed client agreements | 7 years from the end of the engagement |
| Course and membership account data | For the duration of your access, plus 24 months. Lifetime-access products are kept while that access remains available |
| Zoom recordings of coaching calls | Up to 12 months after the end of your program, unless you request earlier deletion |
| Slack community messages | For the life of the workspace, subject to our Slack plan's retention settings |
| Client business and ad account data | For the duration of your engagement, plus 12 months |
| Website analytics and session recordings | Up to 14 months (Google Analytics), up to 12 months (session recordings) |
| Support correspondence | 3 years |
We may keep information longer where required to resolve a dispute, enforce our agreements, or comply with law.
9. How we protect your information
We take reasonable and appropriate measures to protect personal information, including:
- HTTPS/TLS encryption across our website and checkout
- Payment card data handled entirely by PCI-compliant payment processors; we never see or store full card numbers
- Password management through a business password manager with role-based vault access
- Two-factor authentication on business-critical accounts
- Least-privilege access for contractors, with written confidentiality agreements
- Prompt revocation of access when an engagement or contract ends
No method of transmission or storage is completely secure. We cannot guarantee absolute security, and you share information with us at your own risk. If we become aware of a data breach affecting your personal information, we will notify you and any relevant regulator as required by law.
10. Children
Our Services are intended for adults operating a business. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, email hello@elysecollat.com and we will delete it.
We do not knowingly sell or share the personal information of consumers under 16 years of age.
11. Your privacy rights
11.1 Everyone
Regardless of where you live, you can:
- Unsubscribe from marketing emails using the link in any email
- Ask us to update or correct your information
- Ask us what information we hold about you
- Ask us to delete your information, subject to our legal retention obligations
Email hello@elysecollat.com to make a request. We will respond within 30 days, or sooner where the law requires it.
11.2 EEA, UK, and Switzerland (GDPR)
You have the right to:
- Access your personal data and receive a copy
- Rectification of inaccurate or incomplete data
- Erasure ("right to be forgotten") in certain circumstances
- Restriction of processing in certain circumstances
- Data portability, to receive your data in a structured, machine-readable format
- Object to processing based on legitimate interests, and to object to direct marketing at any time
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not carry out such automated decision-making.
- Lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner's Office. In the EEA, a list is available at edpb.europa.eu.
We do not charge for these requests unless they are manifestly unfounded or excessive.
11.3 California (CCPA as amended by the CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, disclose, and share, including the categories, sources, purposes, and recipients
- Access a copy of the specific pieces of personal information we hold about you
- Delete personal information we collected from you, subject to exceptions
- Correct inaccurate personal information
- Opt out of the sale or sharing of your personal information for cross-context behavioral advertising
- Limit the use and disclosure of sensitive personal information. We do not collect or use sensitive personal information for purposes that trigger this right.
- Non-discrimination for exercising your rights. We will not deny you services, charge different prices, or provide a different level of quality because you exercised a privacy right.
Categories of personal information collected in the last 12 months:
| CCPA category | Collected | Disclosed for a business purpose | Sold or shared |
|---|---|---|---|
| A. Identifiers (name, email, IP, online identifiers) | Yes | Yes | Yes (advertising) |
| B. Customer records (Civ. Code 1798.80: name, address, phone, payment info) | Yes | Yes | No |
| C. Protected classifications | No | No | No |
| D. Commercial information (purchases, products considered) | Yes | Yes | Yes (advertising) |
| E. Biometric information | No | No | No |
| F. Internet or network activity (browsing, search, ad interaction) | Yes | Yes | Yes (advertising) |
| G. Geolocation data (approximate, from IP) | Yes | Yes | No |
| H. Audio, visual, electronic (call recordings, session recordings) | Yes | Yes | No |
| I. Professional or employment information (business, revenue range, role) | Yes | Yes | No |
| J. Education information | No | No | No |
| K. Inferences (segments, interests, buyer stage) | Yes | Yes | Yes (advertising) |
| L. Sensitive personal information | No | No | No |
Sources, purposes, and recipients for each category are described in Sections 3, 4, and 5.
We have not sold personal information for monetary consideration in the last 12 months. We have shared identifiers, commercial information, internet activity, and inferences with advertising platforms for cross-context behavioral advertising, as described in Section 5.3.
To opt out of sale or sharing: email hello@elysecollat.com with the subject line "Do Not Sell or Share My Personal Information," or send a Global Privacy Control signal from your browser, which we honor automatically.
Authorized agents may submit requests on your behalf with written permission signed by you. We may ask you to verify your identity directly.
Verification: we verify requests by matching the email address you contact us from against our records, and may ask for additional information for access or deletion requests.
Shine the Light (Cal. Civ. Code 1798.83): California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures.
11.4 Other US states
If you are a resident of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, or another state with a comprehensive consumer privacy law, you may have rights to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling.
Where your state's law provides an appeal process, you may appeal a denied request by replying to our decision. If your appeal is denied, you may contact your state Attorney General.
We may not meet the applicability thresholds in every one of these states. Where we do not, we still make a good-faith effort to honor these requests.
11.5 Australia
If you are in Australia, the Australian Privacy Principles under the Privacy Act 1988 (Cth) may apply to how we handle your personal information. You may request access to and correction of your personal information by emailing hello@elysecollat.com, and you may complain to the Office of the Australian Information Commissioner if you are not satisfied with our response.
12. Third-party links and platforms
Our Services link to third-party websites, tools, and platforms, including affiliate or partner links where we may earn a commission. We do not control those third parties and are not responsible for their privacy practices. Review their policies before providing personal information.
13. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top. If we make material changes, we will notify you by email or by a prominent notice on our website before the change takes effect. Your continued use of the Services after the effective date means you accept the updated policy.
14. How to contact us
Questions, requests, or complaints about this policy or your personal information:
Email: hello@elysecollat.com
We aim to respond to all privacy requests within 30 days.
