Privacy Policy

Effective date: September 17, 2026

Modern Holistic Academy ("MHA," "we," "us") provides online educational programs and related student services. This policy explains the information processed when you visit the site, purchase a program, use the student portal, request support, or receive a certificate. The operator responsible for a purchase is the seller identified on your checkout receipt or other purchase record.

Information we collect

Depending on how you use the service, we may process:

• Account and contact information: email address and, if you choose to provide it, the name used on your certificate.
• Purchase information: Stripe checkout-session, payment-intent and customer identifiers, amount paid, refund status, purchased add-ons and campaign-attribution fields. We do not store your full payment-card number in the MHA student database.
• Learning records: lesson completion, quiz attempts and scores, final-assessment attempts, certificate status and course entitlements.
• Support information: the email address, category and message you submit through the contact form.
• First-party analytics: an anonymous browser identifier, page path, referral/campaign parameters, selected checkout option, transaction reference where applicable, and events such as page views, checkout starts, purchases and course interactions.
• Optional advertising measurement: if you consent and Meta measurement is enabled, advertising events can include the page or event source, event type, anonymous browser identifier in hashed form, browser/device and network information, Meta browser/click identifiers where available, and purchase or checkout value. MHA's Meta conversion integration is not designed to send your course-account email address to Meta.
• Technical and security information: information necessarily processed by our hosting, security and network providers to deliver and protect the service.

How we use information

We use information to provide purchased access, authenticate students, save progress, score assessments, issue and verify certificates, process refunds, respond to support and privacy requests, secure the service, prevent abuse, comply with legal obligations, keep business records, understand how the site and checkout funnel perform, and—only where optional marketing measurement is enabled with consent—measure whether advertising leads to site visits, checkout or purchases.

Payments

Payments are processed by Stripe. Stripe receives the payment and billing information needed to complete the transaction and operates under its own privacy terms. MHA receives transaction identifiers and payment status needed to activate access, administer purchases and refunds, and reconcile reporting.

Transactional email

We use Resend to deliver transactional messages such as secure sign-in links. Your email address and the message content necessary for delivery are processed for that purpose.

Hosting and database services

The website, application logic and student database use Cloudflare services. Cloudflare may process technical information needed to serve, secure and operate the service.

First-party analytics and local storage

MHA uses first-party analytics to measure page visits, checkout activity and other product events. The browser stores an anonymous visitor identifier and campaign-attribution information in local storage so events in one visit can be connected to later checkout activity. The authenticated student session uses a secure HTTP-only cookie.

The first-party analytics system is separate from optional advertising measurement and continues to operate if you decline Meta marketing measurement. It is used for MHA's own product and funnel reporting and is not designed to create a cross-site advertising profile.

Optional Meta Pixel and Conversions API measurement

If Meta advertising measurement is configured, MHA presents a marketing-measurement choice before loading the Meta Pixel in your browser or sending consent-gated events through Meta's Conversions API. If you accept, MHA may measure standard advertising events such as page views, checkout starts and purchases.

Meta may set or read browser identifiers such as _fbp or _fbc and may receive event-source URL, browser/user-agent and network information, a hashed anonymous MHA visitor identifier, event identifiers used for browser/server deduplication, and relevant checkout or purchase value. Browser and server copies of the same advertising event use a shared event identifier so the advertising platform can treat them as one event rather than two.

You can decline optional marketing measurement without losing course or checkout access. To revisit your choice, use Marketing choices in the site footer. Removing the choice causes the consent prompt to be shown again; choosing Decline prevents MHA from intentionally sending new consent-gated Meta events from that browser. Clearing browser storage can also remove your saved choice.

Meta operates under its own terms and privacy practices. Advertising and privacy rules vary by jurisdiction, and additional rights or controls may apply where you live.

Public certificate verification

If you earn a certificate, the certificate verification page is designed to be publicly accessible to anyone who has the certificate ID. It may display the recipient name you selected, certificate ID, course title, issue date and final score. A refunded or revoked certificate is no longer verified publicly.

Legal bases and regional rights

Where privacy law requires a legal basis, processing may be necessary to perform a contract with you, comply with legal obligations, protect legitimate interests such as service security and product operation, or rely on consent where consent is required. The basis can vary by activity and jurisdiction. Optional Meta advertising measurement described above is designed to be consent-gated by MHA.

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or information about how your personal information is used, and in some jurisdictions to object to or opt out of certain processing. These rights can have exceptions, including where information must be retained for legal, tax, fraud-prevention, dispute, or security purposes.

California privacy

If California privacy law applies to MHA and to your information, applicable rights may include rights to know, delete, correct, and obtain information about certain disclosures, and rights concerning sale or sharing of personal information. Optional advertising measurement can involve disclosures to an advertising platform that may be treated differently under applicable state law. MHA therefore provides an on-site marketing-measurement choice in addition to the privacy-request process described below.

Retention

We retain information only as long as reasonably necessary for the purposes described above, including providing lifetime course access, maintaining learning and certificate records, resolving support matters, meeting accounting or legal obligations, preventing fraud, and handling disputes. Different records may therefore have different retention periods. We may retain limited records after deletion or refund where reasonably necessary for legal, security, accounting, or fraud-prevention purposes.

Security

We use measures intended to protect the service, including secure session cookies, hashed authentication tokens, restricted student routes and service-provider security controls. No online service can guarantee absolute security.

International processing

Our service providers may process information in countries other than the country where you live. Where applicable law requires safeguards for international transfers, the responsible parties are expected to use legally recognized transfer mechanisms or other appropriate safeguards.

Children

The service is not designed as a children's educational service. If you are not legally able to enter into the purchase agreement in your jurisdiction, a parent or legal guardian must handle the transaction and any required consent.

Exercise your privacy rights

Submit a privacy request through our contact form. We may need to verify identity before disclosing, changing, or deleting account-specific information. You may also have the right to complain to the privacy or data-protection authority that applies where you live.

Changes to this policy

We may update this policy as the service, vendors or legal requirements change. The effective date above will be updated when material revisions are published.