Privacy Policy

We collect information in three categories:

Information you give us directly

• Name and email address (required for any account)
• Mailing address, phone number, and credentials (for certified specialists and bookstore customers)
• Payment information (processed by Stripe — we never see your full card number)
• Profile content you choose to publish (bio, photo, languages, location for certified specialists)
• Messages you send through our community, support email, or contact forms
• Course progress, quiz responses, and certificate completion data (for certification students)

Information we collect automatically

• IP address, browser type, device type, operating system, referring URL, and pages viewed (standard web logs)
• Cookies and similar technologies for authentication and to remember preferences
• Anonymized error and performance data via Sentry to keep the site healthy

Information from third parties

• Stripe sends us payment confirmation and billing-status events (we never receive your full card number).
• If you create an account through a magic-link email, we identify you by the email address on the link.

• To provide the service. Account creation, login (via magic link — we never store your password), processing payments, fulfilling book orders, delivering certification training and certificates.
• To communicate with you. Service emails (receipts, tracking, login links, course updates), and — only with your permission — newsletters and marketing.
• For our certified specialists. Public profile listings in our directory (/find-a-specialist) so people seeking grief recovery support can find you. You control whether your profile is public.
• For community spaces. When you post in The Grief Commons or other community surfaces, your name and content are visible to other members and to TGRM moderators. Direct messages are private and anonymized through participant tokens; we do not read DMs in normal flow.
• To improve the service. Aggregate analytics, error reports, and search-relevance learning. None of this identifies you personally.
• To comply with the law. Tax records, legal process, fraud prevention, and protection of our users.

We do not sell your personal information. We share it only with service providers we use to operate the business, and only as needed for them to do their job:

• Stripe — payment processing
• Resend — transactional email delivery
• Supabase — database hosting
• Vercel — website hosting
• EasyPost — shipping label generation for bookstore orders
• Bunny Stream — video hosting for course content
• Sentry — error monitoring (anonymized)
• GoHighLevel (GHL) — CRM and marketing automation
• Anthropic — for AI assistants where you explicitly use them

We may also disclose information if required by law, in response to valid legal process, or to protect the safety of our users, the public, or the company.

In the event of a merger, acquisition, or sale of all or part of our business, your information may be transferred as part of that transaction. We will notify you before that happens.

We use cookies for authentication (so you stay logged in), to remember preferences, and for basic analytics. We do not use cookies for cross-site advertising or behavioral targeting. You can disable cookies in your browser, but parts of the site will not work without them (notably login and checkout).

Regardless of where you live, you can:

• Request a copy of the personal information we hold about you
• Correct inaccurate information
• Delete your account and associated data
• Opt out of marketing emails (every email has an unsubscribe link)
• Object to or restrict certain processing

If you live in California, the EU, or the UK, you have additional rights under the California Consumer Privacy Act (CCPA), the General Data Protection Regulation (GDPR), or the UK Data Protection Act, including the right to data portability and the right to know what we do with your information. You can exercise any of these rights by emailing [email protected].

We do not knowingly sell or share personal information with third parties for cross-context behavioral advertising.

We keep your account data for as long as your account is active. When you close your account, we delete your profile and non-financial records within 90 days. We retain financial and tax records (orders, invoices, payment confirmations) for seven years to comply with US tax law.

We protect your data with industry-standard practices:

• Magic-link authentication with no passwords stored anywhere
• Encrypted connections (HTTPS) site-wide with HSTS enforcement
• Database access governed by row-level security policies
• Payment data handled exclusively by PCI-compliant Stripe — we never store card numbers
• Continuous error monitoring via Sentry to catch problems quickly

No system is 100% secure. If we ever discover a data breach involving your information, we will notify you in accordance with applicable law.

Our services are intended for adults (18 and over). We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, contact us immediately and we will delete it.

We are based in the United States. If you access our services from outside the US (including the UK, EU, or Canada), your information will be transferred to and processed in the US, which has different data protection laws than your country. By using our services, you consent to that transfer.

We may update this Privacy Policy from time to time. Material changes will be announced on this page with an updated “Last updated” date. For significant changes that affect how we use your data, we will also notify you by email.

Questions about this policy? Email [email protected] or write to:

The Grief Recovery Institute, Inc.
9030 N Hess Street, #582
Hayden, ID 83835
United States