MindPath’s data practices, written to be readable. We collect only what we need to deliver your courses, process payments securely (we never store cards), and keep the platform safe.
Joyora LIMITED is the corporation that owns, controls, and operates this website and store, doing business as MindPath, and is the data controller for the purposes of this Policy.
1. Introduction
This Privacy Policy explains what personal information Joyora LIMITED (the “Company”, doing business as MindPath) collects, how we use and protect it, and the rights you have. It applies to mindpathcourse.org, email communications, and support channels.
2. Information We Collect
We collect only what is necessary: account details (name, email, authentication identifiers), payment information handled by our processor (we do NOT store card numbers or CVVs — these are transmitted directly to Stripe), course telemetry (module progress, lab submissions, quiz scores, certificate timestamps), support correspondence, technical signals (IP, user agent, crash logs), and cookies (see Cookie Policy).
3. How We Use Data
To provision course seats and certificates, provide support, send operational email (receipts, course updates), improve curriculum via anonymized engagement analysis, prevent abuse, and enforce the Terms. We never use your data to train generative AI models without your explicit, separate consent.
4. Payment Processing
All payments are processed by Stripe, Inc. (“Stripe”), a PCI DSS Level 1 certified Service Provider audited annually by an independent Qualified Security Assessor — the highest level of PCI compliance. Joyora LIMITED does not collect or store full card numbers, CVVs, or authentication secrets; these are transmitted directly from your browser to Stripe over TLS and never reach our servers.
We receive only minimal reconciliation metadata from Stripe: card brand (e.g., Visa, Mastercard), the last four digits of the card, issuer country, expiration month and year, and Stripe’s charge identifier. Please review Stripe’s Privacy Policy at https://stripe.com/privacy for complete payment-data handling, including Stripe’s role as an independent data controller of the payment authentication data it collects.
5. Third-Party Providers
Joyora LIMITED uses a small number of carefully selected processors to deliver the service:
- Stripe, Inc. (USA) — payment processing, fraud prevention, and subscription billing; governed by Stripe’s Services Agreement and Privacy Policy
- Transactional email provider — receipts, course updates, and operational messages
- Cloudflare — network security and content delivery
- An analytics provider (with cookie consent) — aggregated usage analytics
- Crash reporting — with personal data redacted
Each processor is bound by a data-processing agreement and uses your data only to deliver the specific function we have contracted them for.
6. Data Sharing
MindPath does not sell, rent, or trade your personal information. We share data only to deliver the service (as described), when required by law, or with explicit consent. In the event of a merger/acquisition, you will be notified before personal data is transferred.
7. Data Retention
Active account data: for the life of the account. Receipts and billing records: 7 years. Support correspondence: up to 3 years. Anonymized engagement analytics: indefinitely. Deletion requests are processed within 30 days; backups are purged on their regular rotation.
8. Your Rights
You may: access your data, correct it, request deletion, receive a machine-readable copy (portability), opt-out of non-essential email, withdraw consent. Email [email protected] with enough info to identify your account; we respond within 30 days.
9. International Data Transfers
Joyora LIMITED operates from Hong Kong and uses processors in the US (including Stripe, Inc.) and the EU. Payment-related personal data is transferred to and processed in the United States by Stripe. Transfers rely on appropriate safeguards including Standard Contractual Clauses and equivalent mechanisms recognized under the applicable data-protection law.
10. Children’s Privacy
MindPath is not directed at children under 13 and does not knowingly collect their data (COPPA). Users 13–17 require parental consent per the Terms.
11. Data Security
TLS 1.2+ for data in transit (including data passed to Stripe), AES-256 at rest on primary databases and backups, least-privilege access with MFA, annual penetration testing, and continuous automated monitoring. Payment card data is handled exclusively by Stripe, which is certified annually as a PCI DSS Level 1 Service Provider — the highest level of PCI compliance — and never reaches our servers.
12. Breach Notification
In the event of a personal-data breach likely to result in risk to your rights, MindPath will notify affected users and relevant supervisory authorities within 72 hours.
13. Changes to This Policy
Material changes are announced by email or dashboard notice at least 14 days before taking effect.
14. Contact and Data Protection Officer
Questions? Email [email protected]. Our Data Protection Officer can be reached at [email protected]. Registered office: Joyora LIMITED, 20th Floor, Leighton Centre, 77 Leighton Road, Causeway Bay, Hong Kong.
Questions about this document? Email [email protected]. We designed this document to be readable. If anything is unclear, reach out — we'll revise it.