Privacy Policy

This policy explains what personal information Empulso Corp collects through byondheroic.com and the BYOND/HEROIC services, why we collect it, who we share it with, and the choices you have. We keep it in plain language because a policy nobody reads protects nobody.

01Who we are

byondheroic.com is owned and operated by Empulso Corp, a corporation organized under the laws of the State of Delaware, United States ("Empulso Corp", "BYOND/HEROIC", "we", "us", "our"). BYOND/HEROIC is a brand operated by Empulso Corp.

For the purposes of the EU and UK General Data Protection Regulation, Empulso Corp acts as the data controller for the personal information described in this policy.

Registered address: 16192 Coastal Highway, Lewes, Delaware 19958, United States
Contact for privacy matters: hello@byondheroic.com

02Information we collect

Information you give us directly

• Contact and enquiry data. Name, email address, company name, role, country, and anything else you choose to write when you use the application form, request a quote, or email us.
• Booking data. After you purchase a Founder Dependency Audit, you choose a slot on a Google Calendar appointment booking page. That page is hosted by Google and collects your name, email address, time zone and any answers you give when booking.
• Billing data. Billing name, billing address, company details, tax identifiers and the last four digits and card type of your payment method. We never receive or store your full card number. Payment card details go directly to our payment processor.
• Engagement data. If you become a client, the information you share with us during the engagement: business documents, org charts, process descriptions, metrics, meeting notes and similar working materials.
• Marketing preferences. Whether you have opted in to receive emails from us, and your interaction with those emails.

Information collected automatically

• Usage and device data. IP address (often truncated or pseudonymized), browser type and version, operating system, device type, screen size, referring URL, pages viewed, time on page, clicks, and approximate location derived from IP address at city or country level.
• Cookies and similar technologies. Small files and identifiers placed on your device. Full detail is in our Cookie Policy.

Information from third parties

• Publicly available professional information, for example a LinkedIn profile or a company website, when we are evaluating fit for an engagement or responding to an enquiry.
• Referral information when an existing client or partner introduces you to us.
• Aggregated analytics and payment status information from the service providers listed in section 05.

03How we use your information

Purpose	Categories used
Responding to enquiries and scheduling calls	Contact data, booking data
Delivering the services you engage us for, including the Audit, Advisory Partner, Right Hand and Workshops	Contact data, engagement data, billing data
Processing payments, invoicing, accounting and tax compliance	Billing data, contact data
Operating, securing and improving the website	Usage and device data, cookie data
Understanding which content and pages work, in aggregate	Usage and device data, analytics cookies
Sending emails you asked for, and occasional relevant updates to existing clients	Contact data, marketing preferences
Preventing fraud and abuse, and enforcing our Terms of Service	Usage data, billing data, contact data
Meeting legal, regulatory and record keeping obligations	Any of the above, as required

We do not use your information to train artificial intelligence models for third parties, and we do not sell your personal information.

04Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases under the GDPR:

• Contract. To take steps at your request before entering an agreement, and to perform the services once you engage us.
• Legitimate interests. To operate and secure the site, to understand aggregate usage, to respond to business enquiries, and to communicate with existing clients about services they already use. We balance these interests against your rights and expectations.
• Consent. For non-essential cookies, for marketing emails to people who are not clients, and for anything else where we ask you first. You can withdraw consent at any time without affecting processing carried out before withdrawal.
• Legal obligation. For tax, accounting and other record keeping duties.

05Who we share information with

We share personal information with a small set of service providers who process it on our behalf, under contract, and only for the purposes we specify. We do not sell personal information to anyone.

Provider	What it does	Data involved	Status
Cloudflare	Website hosting, content delivery and security	IP address, request metadata, security cookies	In use
Web3Forms	Receives and forwards submissions from the application form on this site	Everything you type into the form: name, email, company, and your answers	In use
Google Calendar appointment schedules	Hosts the booking page where you choose a slot after purchasing the Audit	Name, email address, time zone, booking responses	In use
Google Analytics	Aggregate website analytics	Pseudonymous identifiers, usage and device data, truncated IP	Not yet in use
Stripe	Payment processing, subscriptions and invoicing	Billing data, payment card data (collected directly by Stripe), transaction data	In use
Substack	Sending and managing email communications	Name, email address, engagement with emails	In use
Google Workspace	Email, documents and file storage used to deliver engagements	Contact data, engagement data	In use

We may also disclose information: to professional advisers such as lawyers and accountants under duties of confidentiality; to authorities where we are legally required to do so, or to establish, exercise or defend legal claims; and to a buyer or successor in the event of a merger, acquisition or sale of assets, in which case we will notify you before your information becomes subject to a different privacy policy.

06International transfers

Empulso Corp is based in the United States and works with clients and providers in several countries. Personal information may therefore be transferred to and processed in the United States and other jurisdictions whose data protection laws differ from those in your country.

Where we transfer personal information out of the EEA, the United Kingdom or Switzerland, we rely on an appropriate safeguard, generally the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum where applicable, or on your explicit consent or contractual necessity where those apply. You can request a copy of the relevant safeguard by writing to hello@byondheroic.com.

07How long we keep information

Category	Retention period
Enquiries that do not become engagements	Up to 24 months from last contact
Client engagement records and deliverables	Duration of the engagement plus 6 years
Billing, invoicing and tax records	7 years, or longer where law requires
Marketing contacts	Until you unsubscribe, plus a suppression record so we do not contact you again
Analytics data	14 months at event level, then aggregate only
Server and security logs	Up to 12 months

When a retention period ends we delete the information or irreversibly anonymize it.

08Your privacy rights

California residents

If and to the extent that the California Consumer Privacy Act, as amended by the CPRA, applies to Empulso Corp's processing of your personal information, you may have the right to:

• Know the categories and specific pieces of personal information we collect, use and disclose, and request a portable copy.
• Delete personal information, subject to applicable exceptions.
• Correct inaccurate personal information.
• Opt out of any sale or sharing of personal information.
• Limit certain uses of sensitive personal information, where applicable.
• Exercise your privacy rights without unlawful discrimination.

We do not sell personal information or use it for cross-context behavioral advertising.

If any of our activities are legally treated as a sale or sharing of personal information, you may submit an opt-out request through our Cookie Settings or by contacting us.

You may use an authorized agent to submit a request. We may request reasonable evidence of the agent's authority and information necessary to verify your identity before completing the request.

If you are in the EEA, the UK or Switzerland

You have the right to access your personal information, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concern first.

Everyone else

Wherever you are, you can ask us for a copy of your information, ask us to correct or delete it, or ask us to stop sending you email. We apply these rights broadly rather than checking whether your jurisdiction requires it.

How to exercise your rights

Write to hello@byondheroic.com with the request and enough detail for us to identify you. We respond within 30 days, or 45 days for California requests where an extension is permitted and we notify you. We do not charge a fee unless a request is manifestly unfounded or excessive.

09Cookies and tracking

We use strictly necessary, analytics and functional cookies. Visitors from the EEA and the UK are asked for consent before any non-essential cookie is set. Full detail, including the specific cookies and how to control them, is in our Cookie Policy.

Where required by applicable law and supported by our consent-management technology, we process recognized Global Privacy Control signals as opt-out requests. We do not currently respond to Do Not Track browser headers, because there is no agreed standard for how they should be interpreted.

10Security

We use encryption in transit across the site and our tools, access controls limited to people who need the information, multi factor authentication on business accounts, reputable providers with their own security programs, and periodic review of who has access to what.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we do commit to notifying you and any relevant authority without undue delay if a breach affecting your personal information occurs, as required by applicable law.

11Children

Our services are business to business and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

12Third party links

The site links to other websites, including LinkedIn and mavicarrasco.com. We are not responsible for the privacy practices of sites we do not operate. Read their policies before providing information.

13Changes to this policy

We may update this policy to reflect changes in our practices or the law. The date at the top always shows the current version. If a change is material we will give notice on the site and, where we hold your email address and the change affects you, by email. Continued use of the site after an update means you accept the revised policy.