I do not sell your personal information, and I do not share it with third parties for their own marketing. I disclose personal information only to service providers who process it on my behalf, in the following categories:

• Website platform — site, funnel, and email system (systeme.io)

• Form and survey tools — application forms (Tally)

• Data storage — working files and client folders (Google Drive, personal account); client and engagement records (Notion)

• Scheduling — booking calls (Cal.com), which collects your name, email, and any answers you give when booking

• Communication tools — call and messaging platforms used during engagements, such as Zoom, Google Meet, or WhatsApp

• AI-assisted work tools — I may use AI tools, such as those provided by Anthropic or OpenAI, to help prepare client deliverables. This can involve processing business information you provide in your application or engagement. I do not use these tools to make automated decisions about you.

• Professional advisers — accountants, lawyers, or insurers, where necessary for running the business

• Payment processors — when you pay by card or through a payment platform, I commonly use Wise, Payoneer, and PayPal and may use another reputable provider we agree on. In every case, your payment details are collected and processed by that provider under its own privacy policy and never pass through my systems.

• Bank transfer — if you pay by direct bank transfer, the transaction runs between your bank or transfer service and mine. I receive only what your bank passes on: the amount, the date, and your name or reference. I do not receive or store your account details, and I don't share the transaction record with anyone except my accountant and where tax law requires.

Client account access. If you become a client and grant me access to your accounts, analytics, or tools, I use that access only to deliver the engaged services, keep credentials confidential, and relinquish access when the engagement ends. I may also disclose personal information where required by law.

If Hey Sarsa is ever involved in a merger, acquisition, financing, or sale of assets, personal information may be shared or transferred as part of that transaction, subject to applicable law.

Hey Sarsa operates from the Philippines, and my service providers are located in other countries, including the United States. If you are in the EU, UK, EEA, or another jurisdiction with data transfer rules, your personal information will be transferred outside your jurisdiction. Where required, I rely on appropriate safeguards for these transfers, such as my providers' standard contractual clauses and data processing agreements. My own handling of personal information is also subject to the Philippine Data Privacy Act of 2012.

I keep personal information as long as needed to provide my services and as required by law. For example, application details while I am considering or delivering your Outside View or engagement, contact details while you remain subscribed to my emails, and billing records for as long as tax and accounting laws require. When information is no longer needed, I delete or anonymize it.

I use reputable service providers with their own security programs, keep any credentials you share in a password manager rather than in email or notes, use two-factor authentication on accounts that support it, and remove my access when an engagement ends.

No method of transmission or storage is completely secure, so nobody can promise absolute security and I won't pretend otherwise. What I can promise is that if a security incident affects your personal information, I'll tell you promptly and plainly what happened, what's affected, and what I'm doing about it, and notify the relevant authorities where the law requires it.

Depending on where you live, you may have the right to:

• access, correct, delete, or receive a copy of your personal information

• object to or restrict certain processing

• withdraw consent at any time, and

• opt out of marketing emails through the unsubscribe link in any marketing email or by contacting me.

To make a request, email hey@heysarsa.com. I'll verify your identity and respond within the time required by applicable law. These rights are honored where your country's or state's privacy law grants them, and you will never be treated differently for exercising them. You also have the right to complain to your local data protection authority.

United States state laws, including California. In the last 12 months I have collected the following categories of personal information: identifiers (name and email address), customer records information (name, email, and billing address), and coarse geolocation (inferred from IP address). I collect them for the purposes in Section 3 and disclose them only to the service providers in Section 6. I do not sell personal information and do not share it for cross-context behavioral advertising. Residents of California and other states with privacy laws may exercise the rights above by email.

Canada (PIPEDA and Quebec Law 25), Australia (Privacy Act), and New Zealand (Privacy Act 2020). Residents of these jurisdictions may exercise the access and correction rights those laws provide by email.

The Site is not directed to anyone under 18, and I do not knowingly collect personal information from children. If you believe a child has provided me personal information, contact me and I will delete it.

The Site may link to third-party websites, such as my payment providers. Their privacy practices are governed by their own policies, which I encourage you to read.

I may update this policy from time to time. The "Last updated" date at the top shows the current version, and material changes will be posted on this page. Continued use of the Site after changes take effect means you accept the updated policy.

Hey Sarsa, Philippines

Email: hey@heysarsa.com