PRIVACY POLICY for the Dashboard (app.365reset.com)
Last updated: May 12, 2026

1. Who We Are

365reset ("we," "us," or "our") is operated by Jennifer Humphries, based in Canada. We provide a personal reset program and member dashboard ("the Dashboard") at app.365reset.com.

For questions about this policy or your data, contact us at: 📧 [email protected]

2. Scope

This policy applies to personal information collected through:

The 365reset membership program and community (365reset.com, portal.365reset.com)

The 365reset Dashboard (app.365reset.com)

Email and SMS communications we send you

Forms you submit through our platform

3. What Information We Collect

Information you give us directly:

Name, email address, and phone number (provided at signup or through our CRM)

Password (stored as a one-way hash — we cannot read it)

Daily health and wellbeing data you enter in the Compass check-in: sleep hours, energy level, mood, vitals (blood sugar, blood pressure, heart rate, meals, water), and activity completions

Personal goals, milestones, and reflections you write in the Dashboard

Your self-assessed position across six life sectors (financial, career, emotional, mental, physical, spiritual)

Communication preferences (notification settings, preferred contact time and method)

Information collected automatically:

IP address (used only for rate limiting and security — not stored long-term)

Device type and browser type (standard server logs — not tied to your account)

Information we do NOT collect:

Payment information (handled entirely by our third-party payment processor — we never see your card details)

Location data

Biometric identifiers

Social media credentials

4. How We Use Your Information

We use your information to:

Provide and operate the Dashboard and your member account

Deliver your 365reset program: Compass check-ins, Reset Path tracking, goals, and courses

Send you program communications: morning check-in nudges, mid-week support messages, daily content (chair yoga, meditation), and Hub session replays — only for the delivery types you opt into

Notify you by email when your account is created or when you request a sign-in link

Allow Jenn (the program founder and your coach) to track member progress and provide support

Improve the program based on aggregate, anonymised patterns

Meet our legal obligations

Legal basis under GDPR:

Contract performance — to deliver the 365reset program you enrolled in

Legitimate interests — to operate and improve the service, and to send program communications directly related to your membership

Consent — for optional communications (chair yoga SMS, meditation email) where you have actively opted in; you may withdraw consent at any time in Settings

Legal basis under PIPEDA (Canada): We collect, use, and disclose your personal information only with your knowledge and consent, or as permitted by law. Your consent is obtained at signup and when you opt into specific features.

5. Who We Share Your Information With

We do not sell your personal information. We share it only with the following service providers who help us operate the program:

Provider

Purpose

Location

FEA Create / Go High Level (GHL)

CRM, member contact record, SMS and email delivery, automation workflows

United States

Render.com

Web hosting and database hosting

United States (Oregon)

Google

Calendar integration (if you connect it), Google Health integration (if you connect it), Sheets export for Jenn's internal tracking

United States

Resend

Transactional email delivery (sign-in links, welcome emails)

United States

All providers are contractually required to protect your data and use it only to provide services on our behalf.

We may also disclose your information if required by law, such as in response to a court order or legal process, or to protect the rights and safety of our members.

6. How We Protect Your Information

Encryption at rest: Your email address, name, and phone number are encrypted in our database using AES-256 encryption before storage

Encryption in transit: All data transferred between your device and our servers uses TLS (HTTPS)

Access controls: Only your account can access your personal data; admin access is restricted and logged

Token security: Authentication tokens are short-lived and rotated on every use

Audit logging: Significant actions on your account (sign-in, data export, account deletion) are logged

Rate limiting: Our API is protected against brute-force and abuse

No method of transmission or storage is 100% secure. We take commercially reasonable steps to protect your information but cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as your account is active. If you delete your account, your personal data is removed from our active systems. Backup data may be retained for up to 90 days in automated backup systems before permanent deletion.

Audit log entries may be retained for up to 2 years for security and legal compliance purposes.

8. Your Rights

Regardless of where you live, you have the following rights regarding your personal information:

Under Canadian law (PIPEDA) and GDPR:

Right to access — request a copy of all personal information we hold about you

Right to rectification — ask us to correct inaccurate information

Right to erasure ("right to be forgotten") — request deletion of your account and personal data

Right to data portability — export your data in a machine-readable format (available in the Dashboard under Settings → Export my data)

Right to withdraw consent — for optional communications, turn them off at any time in Settings; for full withdrawal of consent to processing, you may delete your account

Right to object — object to certain types of processing

Under GDPR (EU/EEA residents specifically):

Right to restrict processing — ask us to limit how we use your data

Right to lodge a complaint — you may complain to your national data protection authority if you believe we are processing your data unlawfully

To exercise any of these rights, email us at [email protected] with the subject line "Privacy Request." We will respond within 30 days. For identity verification, we may ask you to confirm the email address on your account.

Your Dashboard also provides self-serve tools:

Export your data: Settings → Export my data

Delete your account: Settings → Delete my account

Opt out of communications: Settings → Daily Content or Nudge Preferences

9. International Data Transfers

Our service providers are based in the United States. When your personal data is transferred outside of Canada or the European Economic Area, we rely on:

Standard contractual clauses or equivalent mechanisms required by applicable privacy law

Our service providers' compliance with US-EU Data Privacy Framework and equivalent standards where applicable

10. Children's Privacy

The 365reset program and Dashboard are intended for adults. We do not knowingly collect personal information from anyone under the age of 16. If we learn we have collected information from a child under 16, we will delete it promptly.

11. Third-Party Links and Integrations

Our Dashboard contains links to third-party services, including the 365reset member portal (portal.365reset.com) powered by FEA Create. When you click through to those services, their own privacy policies apply. We are not responsible for the privacy practices of third-party platforms.

12. Cookies

The 365reset Dashboard (app.365reset.com) uses a single httpOnly cookie to maintain your login session (a secure refresh token). This is a strictly necessary cookie — it is required for the app to function and is not used for tracking or advertising.

The main 365reset website (365reset.com) may use cookies for analytics and marketing. Those are managed separately.

13. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify you by email and update the "Last updated" date at the top of this page. Continued use of the Dashboard after notification constitutes acceptance of the updated policy.

14. Contact Us

For any privacy questions, data requests, or concerns:

📧 [email protected]  Jennifer Humphries, 365reset, Canada

This policy is intended to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the EU General Data Protection Regulation (GDPR). If you have questions about your rights under a specific law, please contact us directly.