Last updated 14 October 2026. What we collect, why, who helps us, and how to take any of it back. Written to be read.
The short version
- We collect what you give us (your email, a form, a booking, an account) and the little a website needs to run safely.
- We never sell your data and we don’t build advertising profiles.
- Statistics, marketing pixels and embedded videos only run after you allow them in the cookie banner.
- You can see, correct, export or delete your data at any time by writing to us.
Who is responsible
Extended Universe (extendtheuniverse.com) is run by Mike Masters, based in Malta. We are the “controller” of the personal data described here: we decide why and how it is used.
Questions or requests about your data: mike@extendtheuniverse.com. We answer within one month.
What we collect and why
For each use we name the legal basis the GDPR asks for. Consent can be withdrawn at any time. Contract means we need it to give you what you asked for. Legitimate interest means a reasonable, expected use we have weighed against your rights.
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Email and first name you enter for the free guide, the free training, new posts or course news | To send what you asked for and the email series that goes with it. We see whether our emails are delivered, opened and clicked, so we know what helps. | Consent | Until you unsubscribe (one click in every email), then removed within 30 days |
| Account details: name, email, password (stored hashed, never readable), your progress | To give you a login, the members area and your courses | Contract | While the account exists; deleted within 30 days of closing it |
| Members Portal application: name, email, country, city, work situation, your answers | To review your application, as the form explains | Steps before a contract, at your request | 12 months if not accepted; for the membership if accepted |
| Booking a call: name, email, what you’d like to talk about, the time you picked | To hold the call and send both of us a calendar invite | Contract | Up to 24 months after the call |
| Messages, wall messages and refund requests you send through the site | To read and answer them | Legitimate interest | Up to 24 months after the conversation ends |
| Orders and payments (when the shop and paid courses are open): name, email, billing and shipping address, what you bought | To take payment, deliver, give refunds and keep accounts | Contract; legal obligation for tax records | As long as tax law requires, otherwise until the order is complete |
| Security data: IP address, browser, pages requested, time; the automatic bot check on our forms | Keeping the site safe, stopping spam and abuse, fixing errors | Legitimate interest | Up to 30 days, unless needed to investigate an attack |
We don’t make automated decisions about you that have legal or similar effects.
Cookies and similar storage
Some things are stored in your browser. The law treats cookies, local storage and similar tools the same way, so we list them together. The banner lets you reject everything optional as easily as accept it, and you can change your mind any time from Cookie settings at the bottom of every page. Your choice is kept for 12 months. If your browser sends Global Privacy Control, marketing stays off.
| Category | What | Why | Lasts |
|---|---|---|---|
| Strictly necessary | Your cookie choice, light/dark theme, login cookies | Remember your choices and keep you logged in | 12 months / until cleared / session or 14 days with “remember me” |
| Strictly necessary | Cloudflare Turnstile (on forms) | Checks, mostly invisibly, that a real person and not a bot is sending the form | For the check only |
| Functional | Small notes in your browser (hidden things you’ve found on the site, visit counts) | Optional extras | Until you clear them |
| Statistics | Google Analytics (through Google Site Kit) | Counts visits and pages, so we know what is useful | Up to 13 months, set by Google |
| Marketing | Meta (Facebook) pixel | Measures whether our posts and ads on Meta bring people here | Up to 90 days, set by Meta |
| Embedded media | YouTube (youtube-nocookie.com) | Plays a video only after you press play and allow it | Set by Google |
Our fonts and icons are hosted on our own server, so no font service sees your visit.
Who we share it with
Only with the services that help us run the site, each bound by data processing terms, and only what they need:
- Hostinger (web hosting, servers in the Netherlands): stores the site and its database.
- Resend (email delivery, sent from the EU, Ireland): our email list, the email series and the emails the site sends (bookings, accounts, notifications).
- Cloudflare (Turnstile bot check): sees your IP address and browser signals when you send a form.
- Google: Analytics only with your consent; YouTube only when you play a video.
- Meta: the pixel only with your marketing consent.
- Payment providers (such as Stripe and PayPal), only when you buy something. We never see or store your full card number.
- Printful (merch printing and shipping), your name and shipping address, only for merch orders.
- Authorities, only when the law requires it.
We moved our email list from MailerLite to Resend in October 2026. MailerLite no longer receives new data.
We never sell or rent your personal data, and we don’t “share” it for cross-context behavioural advertising as California law defines it.
Transfers outside Europe
Some of these services (Resend, Cloudflare, Google, Meta, payment providers, Printful) are based in or use providers in the United States. Transfers are covered by the EU-US Data Privacy Framework where the provider is certified, or by the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the safeguards.
Your rights
Wherever you live, you can ask us to:
- see the data we hold about you and get a copy, also in a portable, machine-readable form;
- correct anything wrong or incomplete;
- delete it, unless we must keep it (for example tax records);
- restrict or object to a use based on legitimate interest, and object to direct marketing at any time;
- withdraw consent at any time (the unsubscribe link in every email, Cookie settings), without affecting what happened before.
Write to mike@extendtheuniverse.com. We may ask you to confirm it’s you. It’s free, and we answer within one month.
Complaints. You can complain to the data protection authority where you live or work. Ours is Malta’s Information and Data Protection Commissioner (idpc.org.mt). We’d appreciate the chance to fix it first.
If you live outside the EU
UK and Switzerland: this policy follows the UK GDPR and Switzerland’s data protection act too. North Macedonia and the Western Balkans: the same rights apply under your national GDPR-style laws. United States: depending on your state, you can know, access, correct and delete your data and opt out of its sale or targeted advertising. We do neither, and we honour Global Privacy Control. Everywhere else: we apply the same rights to everyone.
Children
This site is not meant for children under 16, and we don’t knowingly collect their data. If you think a child has given us data, write to us and we’ll delete it.
How we protect it
Encrypted connections (HTTPS) everywhere, passwords stored only as hashes, access limited to the people who need it, regular backups, and bot and spam protection on every form.
Changes to this policy
When something important changes, we update this page and the date at the top. If the change affects how we use the data you already gave us, we’ll tell you by email first.