Privacy Policy

1. Who is responsible for your data

Bounce The Mix is operated by Francisco Alexandre Teodoro Teixeira, who is the data controller for what's described in this policy. See the legal identity note at the bottom of this page for contact and registration details.

Send questions or requests to info@bouncethemix.com or through our Contact page.

2. What we collect

Account data: your name, email and password, stored as a one-way hash and never in plain text. If you sign in with Google, we receive your name, email and profile image from that account. If you sign in with Apple, we receive an identifier Apple creates for our site, your email and, only the first time, your name; if you choose "Hide My Email", Apple gives us a private address (ending in @privaterelay.appleid.com) that forwards our emails to your real inbox, so the emails we send you pass through Apple. We also keep, encrypted, the key Apple gives us for your sign-in, only so we can ask Apple to end the link when you unlink Apple or delete your account.

Purchase and service data: order details, service briefs, reference tracks and files you upload, your subscription and plan status, mentor-session bookings, and payment metadata from Stripe. We never see or store your full card number. It also includes track-feedback requests: the link and notes you send and the mentor's answer. If you review a product or rate a mentor, on the site or in the app, your rating and comment are public: product reviews show your account name and profile photo, mentor reviews only your first name. You can delete your review at any time; if you delete your account, it stays without your name or photo.

Reactions on News articles: if you react to an article while signed in, we keep which article, which reaction you chose and when. The article only shows how many people chose each reaction, never who. You can change or take back your reaction at any time.

Communications: whatever you submit through our Contact form or newsletter sign-up, messages you send in the platform's service or mentor chat, messages you send to our assistant or support chat, on the website or in the app, and, when recording is on, the video and audio of private sessions with a mentor. It also covers emails you send to our team's addresses (for example support@ or hello@bouncethemix.com): your address and name, the subject, the message and its attachments.

Cart reminders: if you leave products in your cart without paying, we may email you up to two reminders, about 2 hours and about 24 hours later; the second may include a discount code to enter in your cart. If you're signed in, we use your account email, unless you've turned off “News & offers” in your email settings. On our campaign pages you can buy without an account: we then ask for your email in the cart, fill it in for you on the payment page and use it for these reminders. If you tick the box not to receive news and offers when you go to pay, or that address belongs to an account that turned these emails off, or has unsubscribed, we send nothing. Every reminder has a one-click unsubscribe link, and they stop as soon as you buy.

Marketing emails: we send news about our own products, offers and Academy news (a) to people who joined our newsletter and confirmed their email, and (b) to customers who bought from us, unless they refused when paying or later. If you have an account but never bought anything and didn't join the newsletter, we don't send you these. You may still get emails about something you started yourself: the cart reminders above, a note before and when a plugin trial ends, and, if you saved products to your wishlist, an email when one of them gets cheaper. To choose which of these emails to send you and when (for example a note when you haven't bought anything for a while), we use what you bought, when and how much you spent, your Academy plan, plugins you tried without buying, what you saved to your wishlist, when you created your account, whether you're on the newsletter, the language of your account and the country in your account details. Some of these emails include a personal discount code. Who gets one is decided automatically, from the same information and the rules our team sets for that email (for example, customers who haven't bought anything for a while). It doesn't change the prices we show you: the code is an extra discount you can choose to use, it works only once and only signed in to the account with the address we sent it to, and nobody gets more than one every 6 months (Section 5). We send at most two marketing emails a week. The links in them pass through our site, so we know an email was clicked and whether an order followed within 7 days (we don't record who opens an email: a small image in it only counts how many times it was opened in total), and our email provider tells us whether each one was delivered, bounced or marked as spam. If in 12 months you haven't clicked any of them, bought anything or signed in, we stop sending them until you do one of those or join the newsletter again. You can stop these emails at any time: with the link at the bottom of each one, by turning off “News & offers” in your email settings, or by ticking the box when you pay.

Free trial by email: on a phone, a campaign page can email you the link to start a plugin's free trial on your computer. We send that one email only, and nothing else follows from it. We keep the address for 30 days, as a record of your request and to stop repeated requests to the same address, then delete it.

Technical and usage data: your IP address, used for security and fraud prevention and, if you accepted marketing cookies, sent to Meta together with a purchase (Section 8), browser and device type, pages visited, the website or tagged link a visit came from (counted as daily totals, and noted on what you do on that page, Section 8), and the cookie categories in Section 8, only once you've made a choice in the cookie banner. If you use our mobile app, we also keep a record of each phone or tablet signed in to it, to protect your account: the system (iOS or Android) and its version, the name the device has in its settings (it often includes your first name), the app version, when it signed in and when it was last used, and the last IP address it connected from. In the app, under "Devices signed in", you can see these devices (without the IP addresses) and sign any of them out. If you allow notifications in the app, we also keep the address Apple (iPhone) or Google (Android) gives the app to deliver them to that device, and whether you want the "Activity" ones; it is deleted when you sign out on that device or turn notifications off, in the app or in your phone's settings (in that case, the next time you open the app). Notifications show on your phone, also on the lock screen, with a title and a short text (Section 6 says what they can contain). In the app you can turn off the "Activity" ones (chat messages, announcements and new content); the others (payments, sessions, projects and your account) can't be turned off in the app, but your phone's settings let you turn any notification off or hide its text on the lock screen. To warn you when someone signs in to your account from a browser or phone we haven't seen on it before, we also keep, for each browser and phone you sign in from, a short description (for example "Chrome · macOS", or your phone's name followed by "· App"), when it was first and last used to sign in, and a one-way hash of a random code kept on that device: in a browser, a necessary cookie (Section 8) that stays there after you log out, so we recognise the browser next time, until 400 days after your last sign-in from it or until you clear your cookies; in our app, a random id the app keeps on the phone. This record holds no IP address or location. We do this to keep your account secure (legitimate interest, Section 3). The app also sends us crash and error reports through Sentry: the error and where in the app it happened, the phone model, the system and app versions, and the screens and requests made just before it (without their content). They don't include your name, email or account, or anything you typed, and we use them only to fix problems. Each time the app opens, it asks Expo's servers whether there is an update; Expo sees your IP address, the system and app versions and a random code for this installation.

Free trial checks: each plugin has one free trial per person. When you ask for a trial, an automatic check looks for signs of a repeated trial. We keep its result (started, started and flagged for our team, or refused), a score and the signals behind it, such as how many other accounts used the same browser or IP address, or that the account was created less than an hour before. For this we use one-way hashes made with a secret key of ours (codes from which the original can't be read) of the key in the security cookie described above, of your IP address and, when a trial is activated in the plugin, of the random installation id the plugin keeps on your computer. We compare the browser and installation hashes only with other accounts' trials of the same plugin; for the IP address we also count trial requests for any plugin in the last 24 hours and sign-up attempts in the last hour from that address. A request may be refused, or a trial put on hold until our team looks at it; contact us and a person on our team will review it. This is our legitimate interest in preventing abuse of free trials (Section 3). The IP hash is deleted after 90 days; the rest is kept while your account exists and, after you delete it, on the anonymised account, so a repeated trial can still be recognised.

Become a Provider, mentor, staff member or partner and we also collect identity, billing and, where it applies, tax data. Payout details specifically get extra protection: encryption, a two-factor confirmation, and a waiting period before a change takes effect.

3. Why we're allowed to use it

We process your data to perform our contract with you: creating your account, fulfilling an order or service, running your subscription or session. We also process it to meet a legal obligation, keeping invoices for the period Portuguese tax law requires, because you've consented to it (newsletter, analytics and marketing cookies, withdrawable any time), or because we have a legitimate interest that doesn't override your rights: keeping the platform secure, stopping fraud, improving the service from aggregated usage.

Cart reminders (Section 2) rely on our legitimate interest in helping you finish a purchase you started; you can object at any time with the link in each email, and we won't send them again. A free trial link is sent because you asked for it. Linking an order to the campaign page, headline and ad it came from (Section 8) relies on our legitimate interest in knowing which of our campaigns work, and is used only in our own figures. When an order uses a partner's code, typed in the cart or applied by the partner's link, we record that code on the order to give you the discount (our contract with you) and to pay the partner their commission (our legitimate interest in paying the people who bring us customers); the partner sees only the amount of the sale and the date. A mentor's referral link and where your visit came from are saved in your browser only with your consent (Section 8); linking your account to that mentor and paying their commission then rely on our legitimate interest in paying the mentors who bring us members. Recording where your account, trials, free trial link requests, newsletter sign-ups and purchases came from (from that cookie or, before you make a cookie choice, from the address of the page you did it on), counting visits by source as daily totals and asking how you heard about us rely on our legitimate interest in knowing which of our campaigns work. A friend's invite is kept so that you and your friend get the credit the programme promises (our contract with you, Terms of Service, Section 6). Marketing emails to customers who bought from us rely on our legitimate interest in telling our customers about our own similar products, as Portuguese law allows (Lei 41/2004, article 13.º-A): you're told when you pay and can refuse there, and every email lets you unsubscribe in one click. The newsletter relies on your consent. Noting which of our marketing emails reached you, whether each one was delivered, bounced or marked as spam, whether you clicked a link in them and whether a Store order followed within 7 days, and counting how many times each email was opened in total, without recording who opened it (Section 2) relies on our legitimate interest in knowing which of our emails work, in sending you no more than two a week and in no longer emailing people who don't react. We use it only in our own figures. You can object at any time (Section 9): as every link in these emails works this way, if you object we stop sending you marketing emails. Checking free trial requests and activations for a repeated trial (Section 2) relies on our legitimate interest in preventing abuse of free trials; the check is automatic, and a refusal or a hold is reviewed by a person on our team if you contact us.

4. How we use it

To run your account, fulfil orders and service requests, run your Academy subscription and mentor sessions, process payments and payouts, answer support requests, keep the platform secure, meet our legal and tax obligations, remind you about products left in your cart and send a free trial link you asked for (Section 2), see which of our ads and campaign pages lead people to look at, add to the cart and buy our products, and which links, posts, websites and campaigns bring the people who create an account, try a plugin, ask for a trial link, join the newsletter or buy (Section 8), pay mentors a commission on Academy subscriptions that came through their link and give the credit a friend's invite promises (Section 8), and send newsletter emails if you've subscribed and, if you've bought from us and haven't refused, emails about our products and offers (Section 2). We don't sell your data. Choosing which of our emails to send you (Section 2) is automatic, but we never make a decision about you based solely on automated processing that has legal or similarly significant effects on you.

We also use what you've bought from us in the last 12 months to recognise regular customers and thank them, for example with store credit. Our system counts this automatically every night from how much you paid (minus refunds, including payments returned to you after a card dispute), how many purchases you made, products you bought soon after they came out, the parts of the site you bought from (Store, Academy, services, private sessions), your paid Academy months and the friends you invited who made a purchase. This count never changes the price you see or what you can buy, any reward, such as store credit, is decided and approved by a person on our team, and only our team sees the result. It relies on our legitimate interest in thanking regular customers; you can object at any time by writing to us (Section 9), and we'll stop counting for you and delete the result. Separately, we may send you a thank-you email for having ordered from us several times, as one of our marketing emails (Section 2); it doesn't use this count, and you can stop it like any of them.

5. How long we keep it

We keep personal data only as long as its purpose needs, or as long as the law requires, whichever is longer:

• Account and profile data: while your account is active, and afterwards only what's needed to meet a legal obligation, until you request deletion (Section 9). A link to sign in with Google or Apple is kept while your account exists and removed when the account is deleted; you can also unlink Apple yourself in your settings, and in both cases we ask Apple to end the link on its side. When Apple hides your email and we ask whether you already have an account, what Apple sent us is kept only while we wait for your answer (up to 10 minutes) and is then deleted automatically.
• Security records: the record of each device signed in to our app, kept while you use the app on it and deleted 30 days after you sign out there or end it from "Devices signed in", and in any case no later than 90 days after the app was last used on it; the address for the app's notifications on that device, deleted when you turn them off or sign out there, and at the latest together with that device's record; one-time sign-in steps, the codes we email to confirm your address when you create an account in the app (stored only as a hash, with the address they were sent to and the device details described in Section 2), and links from the app to the site, all deleted within 2 days of expiring; the list of browsers and phones you've signed in from, used to spot a new one: each entry is deleted 400 days after the last sign-in from it, except the most recent one, which we keep while your account exists so a new sign-in can still be recognised. When your account is deleted, the app records and this list go straight away.
• Free trial checks (Section 2): the hash of your IP address is deleted 90 days after the request; the result, with its score and signals, and the browser hash stay while your account exists and, after deletion, only on the anonymised account, without your name or email, so a repeated trial can still be recognised. The installation hash is kept with the record of the computer where the trial was activated and deleted with it, one year after the plugin is deactivated there (until then, also on the anonymised account).
• Account restrictions: if our team blocks or bans an account under our Terms (Section 21), we keep whether it's temporary or permanent, the dates, the reason our team wrote and who applied it, to enforce it and answer questions about it, while your account exists. If you delete your account, this record stays only on the anonymised account, without your name or email. We don't block the IP addresses of customer accounts.
• Crash and error reports from the app: deleted by Sentry at most 90 days after they are received.
• Orders, invoices and payment records: 10 years, the period Portuguese tax law sets for commercial records, even after you delete your account.
• Payout details (the account holder's name, the IBAN with the BIC and any address you add, or the PayPal email; the bank and PayPal details are kept encrypted) and the billing details shown on payment statements: kept while your account exists, and deleted when it is deleted. The details used for each payment stay with that payment's record (see above). If you're a partner, deleting your account switches your codes off for good; your commissions, and the codes used on past orders, stay with those payment records.
• Service request files, demos, finals, chat attachments: 30 days after completion or cancellation, then deleted permanently.
• Recordings of private sessions with a mentor: deleted 90 days after the session; only our administrators can access them.
• Recordings of live group masterclasses: kept in the Academy library while it's offered, for subscribers whose plan includes that masterclass, and visible to our mentors and team. Your video and voice appear only if you turned your camera or microphone on after the notice shown before joining; the name you use in the room may show. Deleting your account doesn't remove a recording already made: ask us and we'll take the recording down or replace it with a version without you. The mentor who hosts the masterclass appears in the recording under their mentor agreement, and the recording stays in the library until we take it down.
• Messages in a session's chat: kept while the accounts exist; deleting your account deletes the messages you wrote, except a copy of a message someone reported to our team, which stays with that report (see Chat reports, below). Our team may read them for safety and to resolve disputes.
• Chat reports: if you report a chat or a message in our app, we keep the reason, your note, your account, email and role, the other person's name and, if you reported a message, a copy of it with its author's name and time. Only the members of our team who handle reports read them, to look into the problem and act under our Terms (Section 21). We delete a closed report 12 months after our team's last change to it; until then a reported message stays in its report, even if its author deletes it or their account. If you delete your account, your email is removed from your reports. The other person isn't told who reported them.
• Conversations with our assistant and support chat, on the website or in the app: kept to answer you and to improve the assistant's answers. If you're signed in, the conversation is linked to your account, included in your copy of your data and deleted when your account is deleted. A conversation with a person on our team is deleted 7 days after it ends, and images you send in it after 2 days. Questions the assistant couldn't answer are also kept, without your name or account, so we can add better answers. When our assistant writes an answer with OpenAI to the first question of a visitor who isn't signed in, we keep that answer (never the question) for up to 7 days, with nothing that links it to you or your conversation, so that anyone who asks the same question gets it without OpenAI being asked again. We don't keep it when the question includes an email address or a long number, such as a phone number, or says who you are (for example “my name is…”); if you wrote your name in it, the answer may repeat it, and it is then only given to someone who asks with that same name.
• Emails to our team: to protect our team from phishing and fraud (our legitimate interest), every email we receive is checked automatically. We read the sender checks (SPF, DKIM, DMARC) and the spam and virus checks made by the service that receives our mail, and we look up the sender's domain and the domains of up to 20 links in the email on SURBL, a public list of phishing and malware domains (only the domain names, such as example.com, never your address or the message). An email that fails these checks, or comes from a sender our team blocked, goes to our inbox's trash and is deleted for good after 30 days; if you have an account with us or we have written to you, a failed check only marks your email as possible spam for our team. Files attached to emails are deleted after 30 days. When our team blocks a sender (by hand, or automatically after reports from two people on the team), we keep that address or domain, who blocked it and when, until it is unblocked, so that their emails keep being caught; if you delete your account, a block on your address stays. Our team's reports that an email was phishing (the sender's domain, or the sender's address for providers such as Gmail and for people we know) are deleted after 90 days, or sooner if the team marks that email as not spam.
• Newsletter and marketing emails: we email you until you unsubscribe (from any of these emails), turn off “News & offers” in your account settings or refuse when paying; we also stop by ourselves after 12 months without a reaction (Section 2). Your newsletter sign-up stays on file so that the emails start again if you come back.
• Record of who each of our email campaigns went to (your address and name, when it was sent and our email provider's reference for that email), used only to finish a send that stopped halfway without emailing anyone twice: deleted 30 days after the campaign was sent (a send left unfinished is closed after 30 days), and straight away when you delete your account.
• Automated email sequences (for example after a purchase, or when you haven't bought anything for a while): we keep your address and name, which sequence, which step you're at and when, while the sequence runs and for up to 12 months after it ends, so that you don't get the same sequence again too soon; if you were already in the group when a sequence was switched on, we only note that, so you don't get it, until you leave the group. Deleted straight away when you delete your account.
• Personal discount codes in our marketing emails: which code was sent to which address, from which email and when, so that it only works for you and nobody gets more than one every 6 months: deleted 6 months after it was sent, and straight away when you delete your account (an order you used it on keeps the code, like any other order).
• Which marketing emails reached you and whether you clicked a link in them (the links pass through our site; we don't record who opens an email), whether each one was delivered, bounced or marked as spam (our email provider tells us), with our email provider's reference for that email, and an order you paid within 7 days of a click: kept 12 months after the email was sent or after your last click in it, whichever is later, then deleted (only totals per email stay, with nobody's name), and straight away when you delete your account. We use it for our own figures, to keep to at most two marketing emails a week, and to stop emailing people who haven't reacted in 12 months.
• Do-not-email list: if you unsubscribe, ask us to stop, or an email to you bounces or is reported as spam, we keep your email address and the reason on a list of addresses we must not send marketing to, for as long as we send marketing emails, only so that we never email you again by mistake.
• Purchase activity used to thank regular customers (Section 4): counted again every night from the last 12 months, keeping only the latest result; the record of changes is deleted after 24 months; both are deleted as soon as you object, and when your account is deleted.
• Email typed in a campaign page's cart, or to get a free trial link: deleted 30 days later, and when you delete your account. If you buy from that cart, it stays with that order's record (see above).
• Record of which News article emails went to which address (the address, the article and when), used only so that no one gets the same email twice: deleted 30 days after that email went out, and straight away when you delete your account.
• Reactions on News articles: kept while your account exists and the article is online; included in your copy of your data, and deleted when you take them back, when the article is removed or when your account is deleted.
• Analytics and advertising tools (Section 8): each tool keeps what it collects under its own rules. Microsoft Clarity keeps session recordings for 30 days (up to 9 months for a recording we mark and for a small sample Microsoft selects) and click and heatmap data for 9 months. Changing your choice in Cookie Settings stops any further collection.
• Details kept to tell Meta about a purchase (IP address, browser user agent, Meta cookies, the public page you paid from): until they are sent, and never more than 30 days.
• Details kept to tell Google Analytics about a purchase (the ids from its cookies): until they are sent, and never more than 30 days.
• Mentor referral links and friend invites (Section 8): the cookies for as long as stated there; the link between your account and the mentor or friend whose link you used, while your account exists. If you delete your account, the link to the mentor is deleted; the record of commissions on your subscriptions and of an invite's credit stays only on the anonymised account, without your name or email, so commissions and credit already earned can still be accounted for.
• Where your account, trials and purchases came from, and your answer to “How did you hear about us?” after signing up (Section 8): kept while your account exists, included in your copy of your data and deleted when your account is deleted. An answer you give after paying is kept on that order, with its record (see above). For a newsletter sign-up or a free trial link, the source is recorded without your address or account. Visit totals by source hold no personal data.
• Cookie consent choice: 6 months, then we ask again.

6. Who we share it with

Only the providers the platform actually needs: Stripe for payments, including PayPal; for payouts to mentors, Providers and partners, our bank or PayPal, which receive the name and the IBAN or PayPal email on file; our hosting, database and file-storage providers, to run the site and store your files and downloads securely; our video-call provider for mentor sessions; Google and Apple, if you choose to sign in with them, to confirm who you are (Section 2), and Apple also to forward our emails to you if you hide your email with Apple; Apple and Google, to deliver the app's notifications (they receive what the notification shows: its title and a short text, which can include a person's first name, for example yours in a notification to your mentor or Provider, a date and time, the name of a project, product, service or track, the first lines of a chat message or of a review's comment, or, for our team, the sender's name and the subject of an email; plus the number of unread notifications and a reference that opens the right screen in the app. Amounts, gift codes and email addresses are left out, and account and security alerts show only their title); our email provider, for every email we send you, including the newsletter and our emails about products and offers, and to receive the emails you send to our team; SURBL, a public list of phishing and malware domains, which only receives domain names when we check an email we receive (Section 5) and is not engaged by us under a contract; and, only once you've accepted analytics or marketing cookies, the tools in Section 8. The providers that run the platform for us are contractually bound to protect your data and use it only for what we've engaged them for. The analytics and advertising tools in Section 8 (Google, Microsoft, Meta and TikTok) also decide how they use what they collect, under their own privacy policies. When it is switched on, our virtual assistant uses OpenAI (United States) to write some of its answers. OpenAI receives your recent messages in that chat and, if you are signed in and your question may be about your own account, a short summary of it: for example your plugin licences and activated computers, your plan, credits, next private session (with the mentor's public name), requests, recent orders or balance. For mentors and Providers, a summary of their own work and balance goes with every answer written with OpenAI. It never receives your name, email, address or payment details from your account; what you write in the chat goes as you wrote it, so don't write personal details your question doesn't need. The current list is below.

To protect our website and its forms (such as sign-up, contact and the waitlist) from automated abuse we use Cloudflare Turnstile. It checks technical signals from your browser and your IP address, and Cloudflare handles that data under its Turnstile Privacy Addendum.

The external providers that receive personal data, and what for.

• Apple (Sign in with Apple), IE — "Continue with Apple" sign-in, Apple's email relay when you hide your email with Apple (it forwards our emails to your inbox), and delivering our app's notifications to iPhones (Apple Push Notification service).
• Cloudflare (R2, Stream, Turnstile), US — Storage of files and profile pictures, delivery of service files, Academy lesson videos, and bot protection on sign-up.
• Daily.co, US — Embedded video calls for private sessions with a mentor and live group masterclasses. A room is created per session or masterclass and closed after it. Private-session recordings, when switched on, are deleted after the retention period; masterclass recordings stay with Daily while they are in the Academy library.
• Expo (EAS Update), US — Delivers updates to our mobile app: each time it opens, the app checks Expo's servers for a newer version.
• Google (Sign-In), US — "Continue with Google" sign-in.
• Meta (Ads Insights, Pixel, Conversions API), IE — Ad performance reporting, and ad measurement with the Meta Pixel on our public pages (pages viewed, viewing a product, service or course, adding to the cart and starting checkout; on campaign pages, also the purchase) and, when you pay, our server tells Meta about the purchase (Conversions API), only once a visitor accepts marketing cookies.
• Microsoft Clarity, US — Session recordings and heatmaps of how the site is used (clicks, scrolling, mouse movements; what is typed into forms is never recorded), only once a visitor accepts analytics cookies. Microsoft also processes this data as a controller.
• OpenAI, US — Writes some of the answers of our virtual assistant, on the website and in the app, when that option is switched on. It receives the recent chat messages and, if you are signed in and your question may be about your own account (always for mentors and Providers), a short summary of it (for example plugin licences, plan, credits, next private session, requests, recent orders or balance), never your name, email, address or payment details.
• Resend, US — Sends our emails: confirmation links, password resets, order and service notifications, the newsletter if you subscribed, and emails about our products and offers to customers who haven't refused them. It tells us whether each of our marketing emails was delivered, bounced or marked as spam. We don't use its open or click tracking: clicks on links in our marketing emails are counted by our own site, and opens only as a total per email, without recording who opened.
• Sentry, DE — Crash and error reports from our mobile app, so we can fix problems. No name, email or account is sent.
• Stripe, US — Payments for the Store, Services and Academy subscriptions (cards, wallets, PayPal). We never see or store full card numbers.

7. Where your data is stored

Our servers, database and file storage for downloads and service files sit in the EU/EEA. Some of the third-party tools below may process data outside it under their own compliance framework, such as the EU-U.S. Data Privacy Framework or standard contractual clauses. We only use a provider outside the EU/EEA where it offers an equivalent level of protection.

8. Cookies

We use three categories of cookies: Necessary (always on, needed for login, account security, your cart and the discount code in it, whether you typed it or opened a partner's link, the invite from a friend's link, and basic site function, including one that recognises a browser you've already signed in from, also used to check free trial requests (Section 2), and lasts 400 days from your last sign-in), Analytics (Google Analytics, Microsoft Clarity for session recordings and heatmaps, and our own note of where you came from; only if you accept them), and Marketing (Meta Pixel, TikTok Pixel and similar ad tools, which tell the ad platform the pages you view and when you look at a product, add it to the cart or start paying, so we can measure our ads, the permission for Google to use a purchase sent to Google Analytics in its advertising (Section 8), and our own note of the mentor whose link you opened, so they can earn a commission; only if you accept them). Analytics and Marketing cookies don't load until you accept them. Change your choice any time from "Cookie Settings" in the footer.

Our campaign pages (addresses starting with /lp/) also set one cookie of their own, never shared with anyone: btm_lp, kept for 7 days from your last visit to one of these pages. A campaign page stays open before and after its offer, at the normal price, so the cookie is set then too; if the page is removed, the cookie is deleted on your next visit to another page of our site. It holds which campaign page you came from, which version of its headline you saw and, if you came from one of our ads, which ad it was (the utm_content value in the ad's link). It lets you keep seeing the same headline, takes a cancelled payment back to that page, applies the page's discount at checkout only while its offer is running (we check this on our server when you pay; the discount is never stored in your browser), and counts an order for that page, headline and ad in our own figures. While a campaign page's discount is running, a code you had entered earlier (cart_coupon cookie) is removed, so the price on the page is the price you pay; outside the offer, your code stays. The page also counts visits, carts and checkouts as totals without identifying you, keeping a note in your browser only for the current visit so that a visit is counted once. When you go to pay from a campaign page, a second cookie of ours, btm_lp_order, kept for 24 hours, remembers that order so that, once you've paid, its thank-you page can show it without the order number ever appearing in the page address.

When a campaign is running, a strip at the top of our pages shows it. If you close it, we keep one necessary cookie of our own, never shared with anyone: btm_campaign_bar. It holds only the code of the campaign you closed, nothing that identifies you, and lasts until that campaign ends, so the strip stays hidden in this browser until then. It is set only when you close the strip; clearing your cookies brings the strip back.

A partner's link (an address starting with /p/) sets one cookie of our own, never shared with anyone: btm_partner. It holds only the partner's discount code, the time you opened the link and a signature that stops it being altered, nothing that identifies you. Its only job is to apply that code to your Store order during that visit, as if you had typed it in the cart. It is a session cookie, deleted when you close the browser, and we ignore it 2 hours after you opened the link even if your browser keeps it (some browsers restore it with your previous session). If you buy with the code, the partner earns a commission on that order, just as when a code is typed by hand: the partner sees the amount of the sale and the date, never who bought or what. Entering another code in the cart, removing the code, or opening one of our campaign pages while its own discount is running ends it.

A mentor's referral link (an address starting with /r/) sets one cookie of our own, never shared with anyone, and only if you have accepted marketing cookies: bounce_ref. It holds the mentor's referral code, the time you opened the link and a signature that stops it being altered, and is kept for 90 days; opening a mentor's link again replaces it and starts the 90 days over. If you haven't made a cookie choice yet, the code waits in the page address and is saved only if you accept marketing cookies on that page. If you're signed in when it is saved, or you create an account, check out as a guest or subscribe to the Academy while you have it, we link your account to that mentor. If you subscribe to the Academy within 90 days of opening the link, the mentor earns a commission on every payment of that subscription for as long as it lasts. A subscription you start later is credited to the mentor whose saved link you opened in the 90 days before it, if there is one, and otherwise to the mentor credited with your most recent earlier subscription, with no end date, as long as that mentor can still earn commissions. The mentor sees how many subscriptions came through their link and, for each payment, its date, its amount and their commission, never your name or anything that identifies you. Saving the cookie relies on your consent; linking your account to the mentor and paying their commission rely on our legitimate interest in paying the mentors who bring us members, and you can object at any time (Section 9). Turning marketing cookies off deletes the cookie; a link already made with your account stays unless you object.

A friend's invite link (an address with ?cref= followed by a code) sets one necessary cookie of our own, never shared with anyone: bounce_cref. It holds only your friend's invite code and is kept for 30 days, so that if you create an account in that time you get the welcome store credit the invite offers once your email is confirmed, and your friend gets theirs after your first paid order (Terms of Service, Section 6). We then record which account invited yours, to give you both the credit the programme promises; your friend sees only the dates and the state of each invite, never your name. While the programme isn't running, the cookie does nothing.

If you accept analytics cookies, we keep one cookie of our own, never shared with ad platforms: bounce_utm, kept for 30 days after your latest arrival from a link or another website. It notes where your visit came from: the utm_source, utm_medium, utm_campaign and utm_content values of a tagged link (for example from one of our ads, posts, ManyChat messages or emails), whether the link carries the code Google, Meta, TikTok or Microsoft add to a link clicked in their ads or apps (we only note which of them, never the code itself), the website you came from (only its address, such as instagram.com), the first page you opened and when. A later link with utm values replaces these; a visit without them (for example from Google or Instagram) replaces them only if what is noted has none either, and a link without them from an email replaces nothing already noted. The first arrival stays noted next to the latest. If you haven't made a choice yet, nothing is saved in your browser: the values wait in the page address and are saved only if you accept analytics cookies on that page. When you create an account, start a free trial, ask for a free trial link, sign up for the newsletter or pay, we record where you came from on that account, trial, request or purchase, so our own reports show which links, posts and campaigns work; when you pay, the utm values also go on your order, subscription or purchase of session credits and stay with that record (Section 5), and for Academy subscriptions they also go to Stripe with the payment, so the subscription keeps them (Section 6). Saving the cookie relies on your consent; recording where you came from relies on our legitimate interest in knowing which of our campaigns work. Turning analytics cookies off deletes the cookie; what we already recorded stays unless you object (Section 9).

Without that cookie, if you haven't made a cookie choice yet (never after you refuse analytics cookies), we still learn where an account, a free trial, a free trial link request, a newsletter sign-up or a purchase came from when you do it on the page a link opened, while that page's address still carries the link's utm values or the code Google, Meta, TikTok or Microsoft add to a link clicked in their ads or apps (we only note which of them it was, never the code). Your browser sends that address to us with the request, as it does on every page of our site; nothing is stored in your browser for this. A trial or a purchase with nothing of its own counts under the source of your account's sign-up. We also count visits that arrive from a link or another website, by the kind of source (for example Instagram, Google or another website) and the link's utm_source, utm_campaign and utm_content values, only as totals per day: no cookie, and we keep nothing that identifies you or your browser. In the 14 days after you sign up we may ask you how you heard about Bounce The Mix, until you answer or choose “Not now”; answering is optional, and “Other” lets you write a few words. Your answer and where your account, trials and purchases came from are kept with your account, and our team sees them in our reports and on your customer record. All of this relies on our legitimate interest in knowing which of our campaigns work and is never shared with ad platforms; you can object at any time (Section 9).

If you accepted marketing cookies when you went to pay, our server also tells Meta about the purchase once the payment is confirmed: the amount, the currency, which products or services you bought and a code that stops it being counted twice, together with your IP address, your browser's user agent, Meta's own cookies (_fbp, _fbc) and the public page you paid from. We never send your name, email or card details.

If you accepted analytics cookies when you went to pay, our server also tells Google Analytics about the purchase once the payment is confirmed: the amount, the currency, which products or services you bought and a code that stops it being counted twice, together with the ids from Google Analytics' own cookies (_ga and _ga_…), so the sale is linked to your visit. We never send your name, email, IP address or card details. This also applies to payments you start from your account, such as a service's payments. If you had also accepted marketing cookies, we tell Google it may use the purchase for its advertising (measuring and personalising ads); otherwise, or if you turn marketing cookies off before the payment is confirmed, we tell Google it may not.

If you accept analytics cookies, Microsoft Clarity shows us how people use our pages: it records clicks, scrolling and mouse movements as session recordings and heatmaps. What you type into forms is never recorded, and we have set Clarity to hide the text on the page as well. Clarity sets two cookies: _clck (kept for up to 1 year) and _clsk (kept for 1 day). Microsoft is also responsible for this data as a controller, under the Microsoft Privacy Statement (privacy.microsoft.com). None of the tools in this section runs in your account, on the sign-in pages or in our team's areas, and Clarity also stays off the cart, contact, sign-up and gift pages.

Some product and campaign pages, and some articles in our News section, show videos hosted on YouTube (Google) or Vimeo. When one of these videos loads, your browser connects to that service, which receives your IP address and technical data about your device under its own privacy policy, and may store data in your browser. At the top of our campaign pages and in News articles we use YouTube's privacy-enhanced mode (youtube-nocookie.com). In a News article nothing is loaded from YouTube until you press play: pressing play is what connects your browser to YouTube.

9. Your rights

Under GDPR, you can:

• Access the data we hold about you.
• Correct anything inaccurate or incomplete.
• Ask us to delete your data, subject to records we're legally required to keep, invoices for instance. If we still owe you money when you ask, such as a partner's commissions, a mentor's or Provider's earnings (including amounts still on hold) or a withdrawal being processed, we pay it first, with no minimum amount, and then delete the account: you ask for the withdrawal in your earnings area, and amounts on hold can be withdrawn as soon as their holding period ends; earnings frozen by an open card dispute wait until it closes. Before that, a mentor's upcoming private sessions take place or are cancelled, and a Provider's open projects are finished, passed to another Provider or cancelled.
• Ask us to restrict how we process your data in certain situations.
• Get the data you gave us in a portable format, or ask us to send it to another provider where that's technically possible.
• Object to processing based on our legitimate interest, direct marketing included, any time.
• Withdraw a consent you've given us, like analytics or marketing cookies, or the newsletter, without affecting what we did before you withdrew it.
• Complain to Portugal's data-protection authority, the CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt), or your own country's equivalent, if you think we've mishandled your data.

10. Children's privacy

Bounce The Mix isn't aimed at children. We don't knowingly collect personal data from anyone under 13, the digital age of consent set by Portuguese law (Lei 58/2019), without a parent or guardian's consent. If you think a child gave us data without that consent, tell us and we'll delete it.

11. How we protect your data

Passwords are stored as an irreversible hash, never in plain text. Two-factor authentication and passkeys are available, and required for some staff and payout-related roles. Payout bank and PayPal details are encrypted and shown masked. Access to personal data inside our own systems is limited to what each role needs. No system is 100% secure, but we watch for security issues and respond to them, and we'll tell you, and the CNPD where required, if a breach is likely to affect your rights. When your account is signed in to from a browser or phone we haven't seen on it before, we email you and send a notice to your account (and to our app on your other phones), so you can change your password if it wasn't you. In our app, what keeps you signed in is stored in your phone's secure storage (Keychain on iPhone, Keystore on Android); your password is never stored on the phone. Changing your password, or using "Log out from all devices" on the site, also signs you out of the app. If you turn on the app lock (Face ID, fingerprint or your phone's code; always on for our team, mentors and Providers), your phone does the check: we never receive biometric data.

12. Changes to this policy

We can update this policy as the platform or the law changes. The new version goes up here with a fresh "last updated" date. For a material change, we'll also try to email you beforehand.

13. Contact

Questions about this Privacy Policy can go through our Contact page.