Privacy Policy

Last updated: November 12, 2026

Key points at a glance

A quick overview comes first; sections 1 to 25 then go through every point in full.

• Controller: decisions about your personal data are made by Bidcrest Group LLC, a limited liability company organized in Wyoming, United States. Privacy requests go to contact@bidcrestgroup.com, with "Privacy request" in the subject line.
• What we hold: details you give when you buy and when you contact us. Proof that you accepted our Terms, and that your access reached you and was then used. Logs, timestamps, your IP address and facts about your device and browser, along with usage data and any message you write to us. Product pages add cookies, pixels and similar technologies, and these wait for your acceptance in every case where the law makes consent a condition.
• Why we hold it: without it we could not sell or deliver a product, bill you, manage a subscription or process a cancellation, refund or withdrawal. To reply to you, stop fraud, comply with the law and resolve complaints, payment disputes and chargebacks. And, with your consent wherever the law asks for it, to measure our advertising and put it in front of relevant audiences.
• Who gets it: companies providing services to us; banks and card networks; our payment processor, which for some uses (fraud prevention among them) decides for itself as an independent controller; and advertising platforms, once you have accepted their technologies if consent is legally needed. Should you dispute a payment, the acquiring bank, the card network and your card issuer receive our evidence, which our processor forwards to them.
• How long: 10 years for tax records. Records proving what you bought, that it reached you and that it was used: the whole relationship plus 5 years after it ends, extended while any dispute or claim remains open. The complete schedule is in section 14.
• Your rights: these vary with the place you live. They cover seeing your data, having it fixed or erased, limiting its use, getting a copy, objecting, taking back a consent and complaining to a data protection authority.

1. The controller of your data

Bidcrest Group LLC ("Bidcrest Group", "we", "us", "our"), a Wyoming limited liability company in the United States, is the controller: we decide how the personal data covered by this Policy is used.

Our principal office, where letters can also be sent, is located at 8200 NW 41st Street, 2nd Floor, Doral, FL 33166, United States.

Privacy questions and requests belong at contact@bidcrestgroup.com; please write "Privacy request" as the subject. Anything about an order, your access, billing, cancelling, a refund or a withdrawal goes to support@bidcrestgroup.com.

No data protection officer has been designated at Bidcrest Group, so anything you would otherwise put to such an officer goes to the privacy address above.

This Policy covers each of our "Services", a word we use for every way you deal with us. That means browsing our website and product pages, buying our products, working in our web apps and member areas, and any message between you and us, whichever side writes first.

Reading this Policy does not mean you consent to anything; it is here to inform you. Where we do need consent, for instance for optional cookies, we ask for it on its own.

Some personal data is used by our payment processor for purposes it sets itself, in the role of independent controller; see section 5.

2. The personal data we hold

Here are the kinds of personal data we may have about you. A few of them arise only when you do something in particular, and those entries say so.

• Contact details: how to reach you, meaning your name, your email address and any other contact information you volunteer.
• Purchase records: the product and plan you bought, its price, currency, tax and purchase date. Also the type of payment method and card brand, your card's expiry date and last four digits, your billing country, any billing address details the payment page requests, whether the payment succeeded and the identifiers of each transaction.
• Abandoned checkout records: if you begin a purchase and stop before paying, our payment processor passes us a record of that attempt. It may hold the email address you typed in.
• Complete card details: the full card number and the security code go onto our payment processor's page, where you type them, and are not kept in our systems.
• Login and product data: the details you log in with, and what happens inside a product. That covers content you create, the settings and preferences you choose and how far you have got (lessons and tasks you have finished, or resources you have saved, for example).
• Acceptance proof: which version of our Terms and policies you agreed to, the wording on screen and the boxes you ticked before paying, the date and time, the IP address and browser you used, and the page and language involved.
• Delivery proof: when your access went live and every time it was used afterwards, logged by our own servers down to each login (date, time, IP address, browser), plus any message from us about your access.
• Technical data: for every request, our access and activity logs keep the date and time, the IP address and the rough location it points to, your browser and its version, operating system, kind of device, language, time zone and the page you arrived from.
• Activity data: what you do in our products, which pages, screens, features and content you open or use, and how long each session lasts.
• Ad and attribution data: which ad you came from, together with ad click identifiers, the identifiers held in cookies and pixels, and any UTM tags or other campaign parameters in the link you used. On any page where the law makes this subject to consent, none of it is gathered before you consent.
• Email delivery data: for each message we write to you, whether it went out and whether it was delivered.
• Choices log: your cookie decisions (date, time, source and the version of the wording shown), consents you have since taken back, and the language you choose on our website.
• Request records: what you asked for in each cancellation, withdrawal, refund or privacy request, how it reached us and when. How these requests work is set out in section 11.
• Support correspondence: your messages to us, our answers, and the date of every exchange.
• Processor-collected data: device, browser and activity information that our payment processor gathers so it can stop fraud and authenticate payments (see section 5).

3. How personal data gets to us

Personal data reaches us from five places.

• You, directly: through your purchases, your use of our products, the forms you fill in and the messages you write.
• Your device and browser: while you browse our website or use our products, automatic logs pick up technical data and activity data.
• Our payment processor: if a payment is disputed, the dispute information banks and card networks give it; records of abandoned checkouts; whatever you type on its payment page (name, email address, billing country or address); your card's brand, expiry date and last four digits; and the payment status with its transaction identifiers.
• Our email delivery provider: whether a message from us reached you or bounced.
• Advertising platforms: statistics on how our ads perform and details of the ad you came from, such as a click identifier, which reach us, where consent is legally required, only after you have accepted their technologies.

4. Why we use data, and on what legal basis

In the table, each purpose is paired with the data it relies on and with its legal basis under the EU General Data Protection Regulation (GDPR).

We are happy to explain any of these legitimate interests in more detail if you ask.

5. Paying us: the processor's role and fraud checks

Payments are collected for us by one or more third-party payment processors, whose name appears on the secure payment page and on the receipt. The seller is Bidcrest Group LLC, which stays responsible for your order, its delivery, customer support and any refund.

You key in your payment details yourself, on the processor's secure payment page. Alongside that, we pass the processor some transaction and customer details (for instance the amount, your name, email address, billing country and IP address), and it combines these with the data it gathers itself.

Beyond transaction data, the processor collects information on every device that connects to its services. It notes, for example, whether card details were typed or pasted, how the mouse moved and how long the page stayed open, as well as the IP address and the characteristics of the device and browser.

Cookies and similar technologies on the payment page are one of its collection tools, used to detect fraud, to authenticate and to analyse the performance of its services.

The processor relies on this information to:

• run its services for us, keep them going and make them better;
• spot fraud and stop it;
• authenticate payments;
• meet its own legal duties, such as anti-money-laundering rules, sanctions and identity verification.

Its fraud signals are built from all the businesses it works with. They also reflect how we react to payments it marks as possibly fraudulent, for example whether we refund or block them.

Its own privacy notice, not this Policy, governs all these activities, since here the processor acts as an independent controller. The notice is linked from the payment page, or ask us and we will point you to it.

When your card issuer authenticates a payment, for instance through 3-D Secure, it receives basic transaction and device information to do so.

A partner payment gateway that operates through our payment processor receives what it needs to process any payment it handles.

Payment methods kept on file. A subscription can only renew if your payment method is on file, so our payment processor keeps it; performing the subscription requires this. We, for our part, keep a record of your authorization of renewal charges.

Without a subscription, storing a payment method to make later purchases faster is up to you, and if you opt in, the processor holds it. You may take that choice back at any time by writing to support@bidcrestgroup.com, after which the stored method is deleted.

Express checkout. The express checkout option on the payment page is a service of our payment processor and follows its own terms and privacy notice. Should you save your payment details with it, it places cookies on the payment page so that it can recognise you next time.

We use any personal data that express checkout passes to us for your transaction and things connected with it, like refunds, disputes and chargebacks; for anything beyond that, we need your agreement.

6. When a payment is disputed

When a payment is disputed, reversed or reported as unauthorised, we answer using the information described in our Privacy Policy. This covers records of your order, of your acceptance of our Terms and policies, of the delivery of your access and of your access to and use of the product (such as IP addresses, device and browser details, timestamps, access and activity logs and support messages). We pass it, through our payment processor, to the acquiring bank, the card network and your card issuer.

Our answer may also draw on purchases of yours that came earlier and were never disputed, including their IP address, device and browser information and email address. Order details we share with dispute-resolution services run by the card networks can include the same, whether a dispute has been opened yet or is already under way.

To prove delivery, we point to the records of when your access became available and of each time it was used, our server log of every login among them, plus any message from us about your access.

Card networks, card issuers, acquiring banks, our payment processor and we ourselves exchange information with one another, in every direction, to authorize payments and to settle refunds, disputes and chargebacks.

What makes this lawful is our legitimate interest in fighting fraud and in the establishment, exercise or defence of legal claims. Even after you ask for deletion, we may hold on to the data this needs until the relevant dispute and limitation periods have run out (see section 14 and section 15).

If you want to query a bill or dispute a payment, our Terms of Service describe how.

7. Automated risk screening

Every order goes through an automated risk assessment. It combines our payment processor's own scoring with risk rules we set ourselves, for example rules about countries or about repeated payment attempts.

It weighs up how the payment form was completed, the payment details, the billing country, the IP address and the characteristics of your device and browser.

For a single payment, the outcome can automatically trigger a block, a hold pending review, or a request that your card issuer carry out extra authentication.

Before we put you on a block list, end your access or refuse to deal with you in future, a person on our team reviews that decision; the automated assessment is never enough on its own.

Do you think a decision about a payment or about your access is wrong? Write to support@bidcrestgroup.com. A person on our team will look at it again, and you can set out your view and challenge the decision.

We use the results of our payment processor's fraud checks for payment handling and fraud prevention, and for nothing else; marketing is never one of those uses.

8. What we store in your browser

Websites leave small files called cookies in your browser. Pixels (tiny images or bits of code that report to a provider), identifier-carrying links and your browser's local storage work in a similar way.

Institutional pages

Our cancellation and withdrawal pages, the order confirmation page, the accessibility statement, the legal notice, our policies, the support and contact pages, the product overview and the home page together make up what we call institutional pages.

These pages set no cookies and run no advertising pixels or analytics tools. They also fetch no fonts or scripts from third-party servers.

The only thing they keep is two local storage entries in your browser, and those appear only if you choose a language or dismiss the language suggestion bar:

Neither entry has anything to do with analytics or advertising. Any suggestion of another language version comes from a check of your browser's language setting that runs inside the browser and saves nothing.

Product pages and the products themselves

Not all technologies on product pages are strictly necessary. Think of advertising pixels, analytics tools, scripts that store campaign parameters or video players that measure viewing.

Where the law makes such technologies subject to consent, they wait until you have made your choice and run only with your consent. The consent tool on those pages lets you accept or refuse them and come back to change your answer whenever you want.

A product page may also carry our payment processor's payment button or form. In that case the processor sets strictly necessary cookies there, to secure payments and prevent fraud.

Progress and settings inside our web apps and member areas are kept in strictly necessary local storage. Any other technology there that legally requires consent runs only after you give it.

The payment page

The payment page lives on our payment processor's own domain and uses the processor's own cookies and similar technologies. The processor uses them to detect fraud, to authenticate, to analyse how its services perform and to recognise express checkout customers who come back. You can read about them in the processor's privacy notice, which that page links to.

Your browser controls

Cookies and local storage can be cleared from your browser settings at any time; if you clear the language entries, our pages go back to suggesting a language version.

9. Advertising on our product pages

Our ads appear on third-party platforms, for example social networks and search engines, but no advertising technology runs on our institutional pages.

When you visit a product page, the platforms' pixels there tell them about the visit, passing on things like the pages you view, the ad you clicked, cookie identifiers, browser information and your IP address.

The pixels send nothing at all, where consent is legally required, until you have said yes to advertising technologies in the consent tool. The point is to measure our ads' results and reach relevant audiences with them.

From our servers, advertising platforms may also receive these purchase details:

• the purchase, sent as an event along with how much it was and in which currency;
• a hashed (coded) version of your email address;
• your IP address and information about your browser;
• identifiers for advertising found in your browser.

Those transfers, like any use of hashed customer email addresses to build or exclude ad audiences, take place only with your consent where the law demands it. Paying through the payment page's express checkout service changes one thing: these transfers then need your agreement, always.

Two kinds of information never go to advertising platforms: anything about your health or from which your health could be inferred, and the outcome of our payment processor's fraud checks.

For the collection of data by a platform's pixels on our pages, and for its transmission to the platform, the platform and we act as joint controllers; the duty to inform you and to obtain any consent needed lies with us.

From the moment the data reaches the platform, its further processing is the platform's own responsibility and falls under its privacy notice. You may exercise your rights against either of us, and on request we will share the essence of how this is arranged.

You can take back a consent whenever you like. Either write to contact@bidcrestgroup.com or open the consent tool again on the page where you gave it. Processing that took place before you withdrew is not affected.

10. Emails about your purchase, and your right to object

We may use the email address given at checkout to write to you about your purchase, your access or a request you made. If you write to us, we reply.

Each consent, and each withdrawal of one, goes into a record. That record captures when it happened (date and time), through what (for instance a form or the consent tool), which version of the wording you saw and, for a form, your IP address.

11. What our request forms collect

We offer two online functions: one to cancel (“Cancel contracts here”) and one to withdraw (“Withdraw from contract here”). Your name, email address, the product or subscription involved, the dates and options you pick and any order reference or comments you add all come to us.

On top of that, each request receives its own reference number, and we log the date and time it was made, the page language, and the IP address and browser details of the device that sent it.

With this data we carry out your request and keep a record of it. Consumer law obliges us to do this, and it is also part of performing your contract with us; those are the two legal bases.

Keeping a hashed (coded) form of the IP address for no more than one hour lets us limit repeat submissions and protect the forms against abuse, which is our legitimate interest in form security.

Sometimes the page opens your email app in place of the form; the email that results is handled exactly as a form request would be. Cancellation and withdrawal requests you choose to send us by email or by post are handled in the same way.

These records may matter in a payment dispute or a legal claim. For that reason each request is stored alongside the evidence of your purchase, for the period given in section 14.

12. Sharing personal data with others

Only as far as the purposes in this Policy require it, personal data is passed to these categories of recipients:

• Payment processors and payment service providers that supply payment and financial services, any partner payment gateway operating through our payment processor included. They process payments, refunds and subscriptions and help prevent fraud. In some of these purposes they are independent controllers (details in section 5).
• Banks and card networks: the acquiring bank, your card issuer, and the card networks' dispute-resolution services, whether the networks run these themselves or have them run by others. They use data to authorize payments and to handle refunds, disputes and chargebacks, and before or during a dispute this can include the order details covered in section 6. When there is a dispute, our payment processor is the channel through which our evidence gets to them.
• Service providers acting on our instructions, which host our website, web apps and member areas, store data, provide our customer support tools and, whenever we write to you as section 10 describes, deliver that email. They may use personal data only as we tell them to.
• Advertising, analytics and attribution providers, subject to your acceptance wherever consent is legally required. Section 9 explains that we share joint controllership with them for data their pixels collect.
• Professional advisers: when we need advice, go through an audit or deal with a legal claim, our lawyers, accountants or auditors may see the data concerned.
• Courts and public authorities: if the law requires disclosure, or if we must establish, exercise or defend a legal claim, data may go to a court or authority, including the tax authorities.
• A buyer or successor taking over all or part of our business through a merger, sale or transfer.

We will tell you, on request, exactly which recipients have received your data.

13. Data sent outside your country

Being organized in the United States, we process personal data there, and we transfer it to service providers located both in the United States and in other countries.

There are countries without an adequacy decision, and personal data covered by EU or Swiss data protection law may be sent to them. Each such transfer rests on one of these, as applicable:

• certification of the recipient under the Data Privacy Framework (EU-U.S. or Swiss-U.S. version);
• contracts based on Standard Contractual Clauses;
• any other appropriate safeguard available under the law.

Write to contact@bidcrestgroup.com for the list of countries we transfer personal data to, or for a copy of the safeguards in place.

14. How long we keep data

We keep personal data no longer than the purposes in this Policy need it, following this schedule:

For these periods, our relationship is over on the day your last subscription or access period finishes. If you never bought anything, the periods run from your last contact with us or from your last consent choice. When a period runs out, we delete the data or make it anonymous.

15. What deletion leaves in place

A deletion request makes us erase your personal data and end any marketing use of it, except for one set of records that the law obliges us to keep or that we need to establish, exercise or defend legal claims.

Four kinds of proof are covered, alongside the history of your requests: proof of your purchase, of the Terms and policies you accepted, of the delivery of your access, and of how you accessed and used the product. It stays for the periods listed in section 14.

Both our legal obligations and the possible need to establish, exercise or defend legal claims (payment disputes and chargebacks among them) are the reason we hold it.

For as long as we hold this evidence, its use is limited to those purposes. Our answer to your request will list the data we have kept and explain why.

16. How we look after your data

You type your card details on an encrypted (HTTPS) payment page operated by our payment processor, a company certified under the Payment Card Industry Data Security Standard (PCI DSS). Our own systems never keep your full card number or security code, and we will never ask for card details by email.

Connections to our website and products are encrypted (HTTPS). Within our company and among our service providers, only those whose work requires personal data can access it, and each service provider is bound to protect what it handles for us.

Whenever our products or our replies mention your card, all they show is its brand and last four digits.

No way of transmitting or storing data can be made fully secure. We are legally bound to report certain personal data breaches, namely those likely to put your rights at risk, and we report them to you and to the competent authorities as the law requires.

17. What you can ask of us in the EEA and Switzerland

In the European Economic Area or Switzerland, the law gives you these rights:

• Access: a copy of your personal data, and confirmation of whether we process any at all.
• Rectification: getting wrong data corrected and the gaps in incomplete data filled.
• Erasure: your data deleted, within the limits set out in section 15.
• Restriction: in certain situations, such as during our check of a correction you requested, limits on how your data is used.
• Portability: a structured, commonly used, machine-readable copy of the data you supplied, for you or, where technically feasible, sent straight to another company.
• Objection: to direct marketing at any time, and to processing based on our legitimate interests on grounds relating to your particular situation (more in section 10).
• Withdrawing consent: any consent, at any time, without making the processing done before then unlawful.
• Automated decisions: the right not to be subject to a decision with legal or similarly significant effects for you that rests solely on automated processing, and, for such a decision, to have a person review it, to state your view and to contest it (section 7).

If you live in France, you also have the right to tell us what should happen to your personal data after your death.

There is no charge for exercising these rights. Write to contact@bidcrestgroup.com with "Privacy request" as the subject, or send a letter to our principal office. The only information we will ask of you is what we need to confirm that the request is yours.

Expect our answer within one month; complex or numerous requests can stretch that by up to two further months, in which case we tell you within the first month and give our reasons.

Anyone we disclosed your data to is told about a correction, deletion or restriction you obtained, unless that turns out to be impossible or would take disproportionate effort. Ask, and we will name them.

Complaints to us about how we handle your personal data go to contact@bidcrestgroup.com, with "Privacy complaint" as the subject. We answer each complaint within 48 business hours, and in any event no later than 15 days after it reaches us. Our answer gives the complaint a reference number, and we let you know the outcome without undue delay.

You may also complain to a data protection supervisory authority, with no need to contact us first. Your country of residence, your place of work and the place of the alleged infringement are, in particular, where you may lodge it.

For instance: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in Germany, the data protection authority of your federal state; in Italy, the Garante per la protezione dei dati personali; in Spain, the AEPD; in France, the CNIL.

18. Additional notice under U.S. state laws

Certain U.S. states, California for one, ask privacy notices to give some extra information. Here it is.

• What we collect and who receives it: section 2 lists the categories of personal data we collect, and section 12 sets out the categories of third parties who receive it.
• Access, correction and deletion: send any such request to contact@bidcrestgroup.com, with "Privacy request" in the subject line.
• Do Not Track: we do not act on these browser signals, because no common standard for them exists. Our institutional pages do not follow you across third-party websites, and on product pages that use advertising technologies, you make your choices in the consent tool shown there.
• Third-party tracking: providers of the advertising or analytics technologies used on some product pages may, when you visit those pages, collect information about your online activities over time and across different websites. That collection needs your acceptance of those technologies in the consent tool first, wherever the law makes consent a requirement.
• Changes and effective date: section 24 explains how we tell you about changes. The effective date of this Policy is its "Last updated" date, at the top of the page.

19. Rights in other countries

Living outside the EEA, Switzerland and the United States, in Latin America for instance, you may have similar rights under your local law. Depending on the country, they may let you find out whether we process your personal data, see it, correct it, have it deleted, object, take it elsewhere (portability), withdraw consent and learn who receives it.

To use them, reach us through the same contact details. Your local data protection authority is there for you as well.

20. Required and optional information

No purchase can go ahead without your email address and payment details, because we need them to enter into and perform the contract and to issue the records the law requires; without them we cannot sell you the product or give you access.

Three fields on our online cancellation and withdrawal forms are required to process a request (name, email address, product concerned), and the remaining ones are optional.

Personal details for tailoring a product are optional (the product falls back to default settings without them), and so is every cookie that is not strictly necessary.

21. Age requirement

Only adults are the intended users of our Services, that is people of 18 or more, or of the higher age of majority where they live. They are not aimed at children, and we do not knowingly collect personal data from anyone under 18.

Think a minor has given us personal data? Please tell us at contact@bidcrestgroup.com and we will delete it. The only exceptions are records the law obliges us to keep and records we need to process a refund or answer a payment dispute.

22. Health-related information

Our products are educational; medical services are not something we offer. When you set up or use a product, and when you write to us, please do not share anything about your health.

Should some feature one day require such information, it would be used for that feature only, and only after you have given explicit consent.

Inside a web app or member area of ours, you will meet no advertising technology at all.

Your health is not something we pass on: no information about it, or from which it could be inferred, goes to advertising platforms or to our payment processor.

23. Other companies' websites

This Policy does not apply to websites and services of other companies that our Services may link to; their own privacy notices do, so please read them.

24. Updates to this Policy

Each new version of this Policy is published on this page under a fresh "Last updated" date. The version shown here has applied since November 12, 2026.

Customers also hear from us about any material change before it takes effect. A new purpose for your personal data is something you will hear about from us in advance, with a request for your consent where the law requires one.

Just ask us for any earlier version of this Policy you would like to read.

25. Contacting us about privacy

Write to us at the details below with questions about this Policy or to exercise your rights; a privacy request should carry the subject "Privacy request".

Bidcrest Group LLC
8200 NW 41st Street, 2nd Floor, Doral, FL 33166, United States
Privacy matters: contact@bidcrestgroup.com
Help with something you bought, including access, billing, cancelling, refunds and withdrawing: support@bidcrestgroup.com
Website: https://bidcrestgroup.com/