Privacy policy

1. Who we are

Lstand is run by Celestel Enterprises LLC, a company based in the United States. In these pages "we", "us" and "our" mean Celestel Enterprises LLC, and "you" means the person who makes an account or buys the course.

Email: celestelincorporation@gmail.com. There is also a contact form.

For the purposes of European and United Kingdom data protection law, Celestel Enterprises LLC is the controller of the personal data described on this page.

2. What we collect

We collect what the course needs to work and nothing for advertising.

When you make an account

• Your first name and email address.
• Your password, stored only as a salted hash. We cannot read it.
• Whether you ticked the box for emails about new lessons, and the dates you joined, confirmed your email and last signed in.
• If you use Google sign-in: your email address, your name and the account identifier Google gives us. We never see your Google password and we ask for nothing else from your Google account.

When you sign in

• A record of each signed-in device: a scrambled copy of the sign-in token, the time, and the browser description your browser sends (for example "Chrome on Windows").
• A short-lived count of wrong password attempts for an email address, together with the internet address (IP) they came from, so guessing can be stopped. It is deleted within two days.

When you watch lessons

• Which lessons you started, the second you stopped at, and which ones you marked as finished. This is how the course keeps your place.

When you buy

• You pay on Stripe's own page. Your card number, expiry date and security code go to Stripe and never reach us.
• Stripe sends us a purchase record: the amount and currency, the email you paid with, Stripe's payment and checkout identifiers, and whether the payment was later refunded or disputed.

When you write to us or join the email list

• Contact form: your name, email address and message.
• Email sign-up: your email address, the page you signed up on, the date, and the exact consent wording you agreed to.

Collected automatically

• Cloudflare, which hosts the site, keeps basic request logs for every website it serves: IP address, browser type, the page asked for and the time. We use your IP address to slow down password guessing and to check for bots. After a wrong password, the IP address is kept with the email address in a short-lived counter and removed within two days. We do not store it anywhere else.
• A short admin log of account events, such as "access granted", "access removed" or "account deleted", with the email address and time.

What we do not collect

• No analytics scripts, advertising pixels or social media trackers.
• No card details.
• No precise location, contacts or anything from your device beyond what a browser sends to every website.

3. Why we use it, and the legal basis

European and United Kingdom law asks us to name a legal basis for each use. Here they are.

• To carry out our contract with you. Making your account, signing you in, unlocking the course when you pay, keeping your place in the lessons, sending receipts, sign-in codes and password resets, handling refunds and answering your questions.
• To meet a legal duty. Keeping purchase records for tax and accounting.
• For our legitimate interests, where they do not override yours. Keeping the site secure, stopping password guessing and shared logins, answering contact messages from people who are not members, and keeping a record of disputes and deletions.
• With your consent. Emails about new lessons and updates. The box is unticked by default and you can take your consent back at any time (see email from us).

We do not make decisions about you by automated means that have a legal or similar effect, and we do not build profiles for advertising.

4. Who we share it with

We do not sell your personal information, and we do not share it for advertising. We use a small number of companies to run the site. Each gets only what it needs.

• Stripe takes the payment. Stripe receives your email address and payment details, and uses its own cookies on its checkout page to prevent fraud. Stripe's privacy policy.
• Cloudflare hosts the site and the database, so everything listed under what we collect is stored on its systems. When the bot check on the sign-up and contact forms is turned on, Cloudflare also runs that check in your browser. Cloudflare's privacy policy.
• Vimeo streams the lesson videos. To play a video your browser connects to Vimeo, which sees your IP address and browser type. We load the player with Vimeo's do-not-track setting turned on, which tells Vimeo not to track your viewing or set its analytics cookies. We do not send Vimeo your name or email. Vimeo's privacy policy.
• Resend delivers our emails when email sending is turned on. It receives your email address and the content of the message. Resend's privacy policy.
• Google, only if you choose Google sign-in. Google learns that you signed in to Lstand. If you sign in with email and password, Google receives nothing from us. Google's privacy policy.

Apart from these, we share personal data only in two cases:

• when a law, court order or government request requires it, and then only what is required;
• if the course is sold to or merged with another company. The new owner must keep to this policy, and we will tell members before their data moves.

5. Where your data is processed

We are in the United States, and the companies listed under who we share it with process data in the United States and in other countries where they have servers. If you live in the European Economic Area, the United Kingdom or Switzerland, this means your data leaves your country.

Where the law requires a safeguard for that transfer, we rely on the ones our providers offer, such as the European Commission's standard contractual clauses, the United Kingdom's addendum to them, or the provider's certification under the EU-US Data Privacy Framework. Email us if you would like to know which one applies to a provider.

6. How long we keep it

• Your account and lesson progress: until you delete the account. You can do that yourself on your account page, and it takes effect straight away.
• Sign-in records: until you sign out, or 30 days, whichever comes first. Only the newest 4 devices are kept.
• Wrong-password counts, email codes and reset links: removed within a couple of days of expiring.
• Purchase records and the admin log lines that go with them: 7 years, because tax and accounting rules require it. These stay even if you delete your account, and they include the email you paid with.
• Contact messages: 2 years.
• Email sign-ups: until you unsubscribe.
• Cloudflare request logs: kept by Cloudflare for a short period under its own policy. We do not copy them.

7. Your rights

Wherever you live, you can:

• see and change your name and email preferences on your account page;
• delete your account yourself on the same page;
• email us for a copy of the data we hold about you, or to have a mistake fixed.

We answer within 30 days and we do not charge for it. We may ask you to write from the email address on the account, so that we do not hand your data to somebody else.

If you live in the European Economic Area, the United Kingdom or Switzerland

You have the right to:

• get a copy of your personal data, and have it in a format you can take elsewhere;
• have it corrected or deleted;
• ask us to limit how we use it, or object to a use that rests on our legitimate interests;
• take back your consent to marketing email at any time. This does not affect emails already sent;
• complain to the data protection authority where you live. In the United Kingdom that is the Information Commissioner's Office. We would like the chance to put things right first, so please email us.

If you live in California

• You can ask what personal information we have collected about you, ask for a copy, ask us to correct it and ask us to delete it.
• We do not sell or share personal information, as California law defines those words, and we have not done so in the past 12 months.
• We do not use sensitive personal information for anything beyond running your account.
• We will never treat you differently for using these rights.

To use any of these rights, email celestelincorporation@gmail.com.

8. Do Not Track and Global Privacy Control

Some browsers can send a Do Not Track or Global Privacy Control signal. We do not track you across other websites or over time at all, and we do not let other companies do so through this site. So the site behaves the same whether your browser sends one of these signals or not: there is nothing to switch off.

9. Cookies

We set only the cookies needed for signing in. They are strictly necessary, which is why you do not see a cookie banner. There are no analytics or advertising cookies.

On a local test copy of the site the same cookies are named session and oauth. If you block these cookies you can still read the site, but you cannot sign in.

Pages run by other companies can set their own cookies under their own policies: Stripe on its checkout page, Google on its sign-in page, and the Vimeo player as far as its do-not-track setting allows.

If we ever add analytics or advertising tools, we will update this page and ask for your consent first where the law requires it.

10. Email from us

• Service emails: the code to confirm your address, password resets, your purchase confirmation and important notices about the course or these policies. You get these because you have an account.
• News emails: new lessons and updates. You get these only if you ticked the box, which starts unticked, or joined the email list. Every one has an unsubscribe link and our postal address. You can also untick the box on your account page. We act on an unsubscribe straight away, and always within 10 business days.

We do not buy email lists and we do not pass your address to anybody for their marketing.

11. Children

The site is for adults. You must be 18 or older to make an account. A parent or guardian can buy the course and supervise a younger person, but the account is the adult's. We do not knowingly collect personal data from anyone under 18. If you believe a child has made an account, email us and we will delete it.

12. Security

• The whole site is served over HTTPS.
• Passwords are stored as salted hashes (PBKDF2 with SHA-256), never as text.
• Sign-in tokens are stored only in scrambled form, so a copy of the database could not be used to sign in as you.
• You can end every other session from your account page, and changing your password does it for you.
• Ten wrong passwords in 15 minutes from one internet address stops sign-in from that address for that email until the 15 minutes are up. Resetting your password clears it.
• Card payments are handled by Stripe alone.

No website can promise perfect security. If we learn of a breach that puts your data at risk, we will tell you and the authorities as the law requires.

13. Changes to this policy

When we change how we handle data, we update this page and the date at the top. If the change is significant, for example a new provider that receives your data or a new kind of cookie, we will tell members by email or with a notice on the site before it takes effect.

14. Contact

For anything about your data, you can reach Celestel Enterprises LLC by email at celestelincorporation@gmail.com or through the contact page. We aim to answer within 2 business days, and complete data requests within 30 days.

See also the terms and the refund policy.

This page explains how Lstand works. It is not legal advice for you or your business. Questions about it: email celestelincorporation@gmail.com or use the contact page.