Privacy Policy
This policy explains what personal data SuaveIQ collects, why we collect it, how we store and protect it, and the rights you have over it. We wrote it in plain language. If anything is unclear, email hello@suaveiq.com and we will rewrite it until it is.
1. Who we are
SuaveIQ is a digital coaching platform for men aged 18 to 35, focused on confidence, social fluency, and authentic connection. The site, the program, the AI coach, and the simulator are owned and operated by AE Capital Group LLC.
For the purpose of data protection law, the data controller is:
- AE Capital Group LLC
- A limited liability company organized under the laws of the State of New Mexico, USA
- New Mexico Secretary of State filing number 3223894
- 8206 Louisiana Blvd NE, Ste A #9433, Albuquerque, NM 87113, United States
- Privacy contact: hello@suaveiq.com
Throughout this policy, "SuaveIQ", "we", "us", and "our" refer to AE Capital Group LLC operating the SuaveIQ service.
2. Data we collect
Data you give us directly
- Account information: email address, first name, password (stored hashed, never readable to us).
- Quiz and onboarding answers: age bracket, relationship status, struggles, your written context. This is the data that lets the coach personalize sessions.
- Coach conversations: the messages you send to the AI coach, including the simulator scenes you run. Stored to provide the service and to remember your context across sessions.
- Module exercise notes: kept locally in your browser (not on our servers) unless you explicitly save them.
Data collected automatically
- Usage data: the pages you visit, the time of visit, the referrer, basic browser metadata. Used to improve the product and detect abuse.
- Approximate location: country and city derived from your IP address by Cloudflare. We never store your full IP. The last segment of an IPv4 address (and the last 80 bits of an IPv6) is dropped before we save anything.
- Activity: when you complete a lesson, send a coach message, run a simulator scene, mark a mission complete. Used to compute your Confidence Index, your streak, and your progress.
Data we do not collect
- We do not collect your government ID, your phone number, your address, your photo (unless you choose to upload one in the future), or your social media handles.
- We do not use facial recognition, biometric scanning, or any form of behavioral profiling beyond the metrics shown to you on your dashboard.
- We never store your full IP address.
3. Why we collect it
- To run the service you signed up for (account, coaching sessions, simulator, modules, missions, progress tracking).
- To personalize the coach using your onboarding answers, so sessions are calibrated to you.
- To send you the emails you asked for (welcome guide, weekly digest, founder note, password reset, account confirmations).
- To improve the product based on aggregate usage patterns.
- To detect abuse, fraud, and security threats.
4. Legal basis
Where the EU GDPR or equivalent laws apply, we rely on the following lawful bases:
- Performance of a contract for everything required to deliver the service you signed up for.
- Legitimate interest for product analytics, security monitoring, and aggregate usage data, balanced against your reasonable expectations of privacy.
- Consent for marketing pixels (Meta, Google) and any non-essential cookies. You give it via the cookie banner. You can withdraw it at any time by clearing your cookies or by using the dashboard settings (when available).
5. Who we share data with
We share the minimum needed to operate the service. We never sell your data. The processors we currently use are:
- Cloudflare (United States and global edge): hosting, DNS, traffic routing, bot protection, KV storage of user records and conversations, edge functions.
- Brevo (European Union, France): transactional emails (welcome, password reset, weekly digest, quiz results) and marketing list management.
- Anthropic (United States): the AI model that powers the coach and the simulator. Conversations with the coach are sent to Anthropic to generate responses. We do not include your real name in those requests when avoidable.
- Stripe (United States and global, when payment is enabled): payment processing for subscriptions. We never see or store your full card number.
- Meta and Google (only if you accepted marketing cookies): advertising attribution and conversion tracking.
- Microsoft Clarity (only if you accepted marketing cookies): anonymized heatmaps and session recordings of how visitors use the site, so we can spot UX problems and improve the product. Sensitive form fields and email inputs are masked. No nominal data is sent.
Each processor is contractually bound to protect your data. We can provide the list of subprocessors and their privacy commitments on request.
6. Cookies and tracking
We use a small number of cookies and similar technologies. They fall into two categories.
Strictly necessary
- Session cookie (
sv_session): keeps you logged in. Required to use the member space. - Admin session (
sv_admin): only present for admin users. - Local preferences: small values stored in your browser (such as a session ID for tracking events on your visit) used to make the product work consistently.
Optional
- Marketing pixels (Meta Pixel, Google Tag): only loaded if you accepted marketing cookies. They help us measure how our ads convert and reach men who would benefit from the program. You can refuse them and the product still works fully.
- Microsoft Clarity: only loaded if you accepted marketing cookies. Records anonymized heatmaps and session replays so we can see where the site is hard to use. Form fields and emails are masked, no nominal data is captured.
The cookie banner gives you a clear yes or no choice on the optional category. Your preference is stored locally and applied to every page.
7. How long we keep your data
- Account data: kept as long as your account is active. If you ask us to delete your account, we delete your record within 30 days.
- Coach conversations and onboarding: kept as long as your account is active so the coach remembers your context. Deleted with your account.
- Visit and event analytics: 60 to 90 days then automatically deleted.
- Backups: may persist for up to 30 days after deletion before they cycle out.
- Legal records (if any): retained as required by applicable law (typically up to 10 years for accounting, less for everything else).
8. Your rights
Wherever you live, you can ask us to:
- Access the data we hold about you.
- Correct any inaccurate data.
- Delete your data (the right to be forgotten).
- Export your data in a machine-readable format.
- Restrict or object to certain processing.
- Withdraw consent for any processing based on consent.
To exercise any of these rights, email hello@suaveiq.com from the address on your account. We respond within 30 days. We will never charge you for a request or retaliate against you for making one.
California residents (CCPA / CPRA)
If you are a California resident, you have specific rights under the California Consumer Privacy Act as amended by the CPRA:
- Right to know what personal information we collect, why, and who we share it with. This policy describes all of it.
- Right to delete the personal information we hold about you.
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing. We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising in the CCPA sense. There is nothing to opt out of, but if that ever changes we will provide a clear "Do Not Sell or Share My Personal Information" control.
- Right to limit use of sensitive personal information. We do not use sensitive personal information for any purpose other than providing the service you asked for.
- Right to non-discrimination for exercising any of these rights.
To make a CCPA request, email hello@suaveiq.com. We verify the request against the email on your account before acting on it. An authorized agent may submit a request on your behalf with written permission.
EU, UK and other regions
If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority. Because AE Capital Group LLC is established in the United States, personal data of EU/UK users is processed in the United States. We rely on appropriate safeguards and process only the minimum data needed to run the service.
9. Security
We protect your data with industry-standard practices:
- HTTPS on all pages, no exceptions.
- Passwords hashed with PBKDF2 SHA-256 (100,000 iterations, per-user salt). We never see your real password.
- Sessions secured with HttpOnly Secure cookies, SameSite Lax.
- API keys and secrets stored as Cloudflare Pages secrets, never in the codebase.
- IP addresses anonymized at intake (last segment dropped) before any storage.
- Access to user records limited to what the service requires.
No system is perfectly secure. If we discover a data breach affecting you, we will notify you and any required authority without undue delay, in line with applicable breach-notification law.
10. Children
SuaveIQ is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has signed up, email hello@suaveiq.com and we will delete the account.
11. Changes to this policy
We may update this policy as the product evolves. Any change is posted here with a new effective date. If a change materially affects your rights, we email all members 14 days before it takes effect.
12. Contact
For any privacy question, request, or complaint, contact the data controller, AE Capital Group LLC, at hello@suaveiq.com, or by mail at 8206 Louisiana Blvd NE, Ste A #9433, Albuquerque, NM 87113, United States. We answer.