Privacy Policy

1. Overview

This policy explains how Megan Millington ("we," "us"), based in Toronto, Ontario, Canada, collects, uses and protects your personal information when you use meganmillington.com, purchase an offering, book a call, interact with us on social media, or join our email list. Megan Millington is the data controller of your personal information. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies to visitors from the European Economic Area or the UK, the GDPR.

2. What we collect

We collect: (a) contact details you provide, such as your name, email address and, where relevant, phone number; (b) booking details when you schedule a call; (c) purchase records, while full payment card details are handled by our payment processor and never stored by us; (d) messages you send us, including email and social media messages (along with your handle or profile information on that platform); (e) participation records for workshops, such as registration, attendance and chat questions, and meeting transcripts where a session is recorded or transcribed; (f) survey responses, where you choose to take part; and (g) basic technical data and cookies when you browse the Site.

3. How we use your information

We use personal information to deliver what you signed up for (coaching, workshops, replays, newsletters), to process payments, to respond to you, to send service messages about your purchases and bookings (such as confirmations, receipts and reminders), to send marketing emails where we have your consent, to keep simple records of leads and clients, and to improve our offerings. We do not sell your personal information.

4. Email and Canada's anti-spam law (CASL)

We send commercial emails only with your express consent (for example, when you subscribe or register) or where implied consent applies under CASL (for example, an existing customer relationship). Every marketing email includes our contact information and a working unsubscribe link, and unsubscribe requests are honoured promptly. Even after you unsubscribe from marketing, we may still send non-commercial transactional messages, such as receipts or access details for something you purchased.

5. Who processes your data for us

We use trusted third-party providers to run the business, which may store or process your information on our behalf: our website, CRM and email platform (Ivorey, built on HighLevel/LeadConnector, with email delivered via Mailgun), payment processing (Stripe), video sessions and recordings (Zoom), meeting transcription (Otter), scheduling (Calendly), event listings (Eventbrite), business email and documents (Google Workspace), and simple client tracking (Airtable). These providers may process data in the United States or other countries; where data leaves Canada it remains protected by our providers' contractual and security commitments, though it may be accessible to authorities under local law.

6. When we may disclose information

Beyond the service providers above, we may disclose personal information where the law requires or permits it, including to comply with a legal obligation or valid request from authorities, to establish or defend legal rights, to prevent fraud or abuse, or to protect someone's vital safety. If the business is ever sold, merged or reorganized, personal information may be transferred as part of that transaction, protected under terms consistent with this policy.

7. Cookies

The Site uses cookies and similar technologies for core functionality and basic analytics. You can control cookies through your browser settings; disabling them may affect parts of the Site.

8. Your rights

You may request access to the personal information we hold about you, ask us to correct it, withdraw consent to marketing at any time, or ask us to delete information we are not legally required to keep. EEA and UK visitors also have GDPR rights, including portability, restriction and objection, and our legal bases for processing are consent, contract performance and legitimate interests. To exercise any right, email [email protected]. If you are unsatisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (or your local supervisory authority in the EEA/UK).

9. Retention and security

We keep personal information only as long as needed for the purposes above or as required by law (for example, tax records), then delete or anonymize it. We use reasonable safeguards, including reputable providers, access controls and encryption in transit, though no method of transmission or storage is completely secure.

10. Children

The Site and offerings are for adults 18 and over. We do not knowingly collect information from anyone under 18; if you believe we have, contact us and we will delete it.

11. Changes and contact

We may update this policy from time to time; the current version will always be posted here with its effective date. Privacy questions: [email protected].