Legal
Privacy Policy
Last updated: 7 September 2026
1. Who handles your data
Paul Syng, based in Toronto, Ontario, Canada, is responsible for the information collected through kit.ceo. Questions or requests: ask@pablo.ceo.
2. What we collect
Your name and email when you create an account, take the Nerve test or contact support. Your answers to the Audit and Advisor questions, plus the reports produced from them. Payment records from Stripe — we never see or store your full card number. Basic usage data such as pages visited and steps completed, so we can see where people get stuck.
3. Why we use it
To give you access, produce your reports, send your invoice and the emails tied to your purchase, answer support requests, and improve the product. We send marketing email only to people who asked for it, and every one of those has an unsubscribe link.
4. Who else processes it
We use a small number of service providers to run the Kit: Supabase for the database, accounts and file storage; Stripe for payments; Resend for email delivery; Mailchimp for the newsletter list; Meta for advertising measurement; Rewardful for the affiliate programme; and independent analysis models that process your answers to generate reports. They handle data only to provide these services.
5. Cookies and tracking
We use cookies and similar storage to keep you signed in, remember your progress, and measure how the site performs and where visitors come from. You can clear or block cookies in your browser, though parts of the dashboard will not work without them.
6. How long we keep it
Account and report data is kept while your account is active, so you can return to your work. Records required for tax and accounting are kept as long as the law requires. Ask us to delete your account and we will remove your data apart from those records.
7. Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Email ask@pablo.ceo and we will respond.
8. Where data is stored
Our providers operate servers in Canada, the United States and Europe, so your information may be processed outside your country.
9. Security
Access is protected by authentication and database-level rules that limit each account to its own records. No system is perfect, so tell us straight away if you think something is wrong with your account.
10. Children
The Kit is for business use and is not intended for anyone under 18.
11. Changes
We may update this policy. The date at the top shows the current version.