Privacy Policy

1. Who we are and what this covers

Elliott AI Foundry LLC, a US company registered in Maryland, is the data controller for 28daystoai.com and the waitlist processing described here. Contact support@28dap.com. Postal address: Elliott AI Foundry LLC, 1451 Rockville Pike, Ste 250 PMB 206, Rockville, MD 20852, United States.

This policy covers this public website, waitlist, related inquiries and marketing communications about 28 Days to AI. The separate learning app and community have additional data flows that must be explained in their own notices. This website policy does not claim that browsing creates an app account or enables every feature of 28 Day Action Plan(TM).

2. What we collect

When you join the waitlist, we require your first name, last name, email address, phone number and selected phone country. We store your phone number in international format. We also record your separate choices for email updates, WhatsApp and SMS, with a server timestamp for each channel you opt into and the form source. The form sends this information to our signup endpoint, which validates it and saves it in our Supabase waitlist database. We also hold signup timing and operational records generated by the database. No payment card, health information, coursework or AI conversation is requested by this website's waitlist.

Hosting and security systems receive technical request information, such as IP address, request time, requested page, browser/device information and security events, to deliver and protect the site. If you contact us or book an appointment, we process the contact information and content you provide. Please do not send sensitive information that is unnecessary for your request.

3. Why we use information and legal bases

We use waitlist information to record your interest and send the program and launch updates requested at signup. Where required, we rely on consent for marketing and optional data sharing. We use legitimate interests for proportionate website delivery, security, abuse prevention and responding to ordinary inquiries, balanced against your rights. We use contract only for processing genuinely necessary for a requested service or pre-contract step, and legal obligation where law requires records or disclosure.

You can browse without joining the waitlist. The required contact fields save your place and support signup validation and abuse prevention. You can save your place without opting into any marketing channel. We use your email or phone for optional updates only on the channels you select. Consent to optional marketing is not a condition of buying a service. We do not sell waitlist information or share it with advertisers for their own marketing.

4. Email and your choices

Joining the waitlist saves your place and sends a signup confirmation. Launch and program marketing updates require the separate, initially unchecked email box. SMS and WhatsApp each require their own separate, initially unchecked box; accepting terms or joining the waitlist does not enroll you in those channels. See our Messaging Terms for channel descriptions, frequency and STOP/HELP instructions. You may unsubscribe using the link in a marketing email or contact support@28dap.com. We retain a minimal suppression record where necessary to honor an opt-out. Unsubscribing from marketing does not by itself cancel a separately purchased membership or essential service messages.

We use Resend, Inc. to send 28 Days to AI marketing emails. Resend processes recipient email addresses, message content, delivery information, and unsubscribe or suppression records on our behalf. We use email engagement metrics to understand interest and improve our own communications, not to sell recipient information. Click tracking is enabled on our updates.elliottaifoundry.com sending domain: links may pass through Resend so a click can be associated with a recipient and message. Open tracking is currently disabled on that domain. If open tracking is enabled in the future, we will provide the applicable notice and obtain consent where required; that feature uses a small image to record an opening event and is not a reliable measure of whether someone read the email. Delivery, bounce and unsubscribe records may still be processed regardless of engagement tracking. Contact support@28dap.com for information or to opt out. Using email metrics does not mean zero data retention.

5. Providers and processing locations

Vercel Inc. hosts this static website through a worldwide delivery network. Your first connection may pass through an edge server in or near your country. The website includes a serverless signup endpoint that processes the submitted contact information and consent choices. Worldwide delivery does not promise that every request or log is processed in one location.

Supabase Inc. stores waitlist contact information, channel choices and consent timestamps in the United States on Amazon Web Services infrastructure in Ohio. This website's form uses the app project in us-east-2. Amazon Web Services, Inc. is the underlying infrastructure provider for that storage, rather than a separate direct integration for this form.

We use customer email and calendar services, including Google, to handle inquiries and bookings where used. These services may involve international processing under their terms; no fixed Google storage location is promised. Email delivery providers process addresses, message content and necessary delivery/opt-out records to send requested communications.

This marketing page does not integrate OpenRouter, Anthropic, Resend sign-in codes or Sentry session replay. We collect separate SMS and WhatsApp opt-ins for the programs described in our Messaging Terms. Those terms describe Twilio and, for WhatsApp, Meta as delivery providers. The signup endpoint sends Resend only the recipient email address, signup source and signup time for confirmation; it does not send Resend names, phone numbers or consent choices. It does not submit your waitlist email to AI models. Those features must not be inferred from a different app's infrastructure. Skool is separate; joining this waitlist does not automatically send app content to Skool.

6. International visitors and transfers

Your waitlist information is sent to and stored in the United States wherever you live. Worldwide website delivery and communications providers can also process technical or communication data in other countries.

For transfers subject to EEA restrictions, we rely on applicable Standard Contractual Clauses or the EU-US Data Privacy Framework where the particular recipient is certified and the processing is covered. Other arrangements apply where required for UK or Swiss transfers. Contact us for information about the safeguards relevant to your data. We do not claim that every provider, or Elliott AI Foundry LLC, is certified under that framework.

7. Retention

We keep waitlist information while it is needed to provide requested program updates, until you withdraw or request deletion, or until the waitlist is discontinued. We periodically review whether continued retention is necessary. We keep correspondence long enough to resolve your inquiry and any associated lawful recordkeeping needs. Minimal suppression records can remain to honor marketing opt-outs.

Technical logs and backups follow the applicable provider settings and purpose. Where information must remain for a legal obligation, security investigation or legal claim, access is restricted and retention is limited to that need. Deletion from active systems may precede expiry of restricted backups. Contact us for the retention information applicable to a particular record.

8. Your rights

Where applicable, you may access, correct or delete your personal information; request restriction or object to processing; obtain or transfer information in a portable format; withdraw consent without affecting earlier lawful processing; and complain to your local data protection authority. These rights depend on applicable law and lawful exceptions.

Send requests to support@28dap.com. We respond to GDPR requests within one month. If a legally permitted extension is needed, we explain it within the first month. We use proportionate identity verification, ordinarily without a fee, subject to lawful exceptions. We do not make solely automated decisions producing legal or similarly significant effects through this website.

9. Cookies and security

The reviewed website code does not set advertising cookies, use browser storage for tracking, or load an analytics or advertising integration. Hosting and security services can process technical information needed to deliver the site. We will assess consent requirements and update this notice before adding optional tracking. Browser settings may help manage storage and cookies.

We use encrypted connections and access controls appropriate to the processing. No system is absolutely secure. A configuration such as a monitoring tool's PII setting would not by itself prove that all reports are free of personal information.

10. Health information and younger members

The program is educational, not medical or mental health care. This website does not ask for health information. Do not include sensitive health information in waitlist submissions or ordinary correspondence. A future feature that processes special-category health data needs an appropriate legal basis and explicit consent where relied on, not an assumption that typing information supplies consent.

The service is intended for adults 18 and older and ages 13 to 17 with parental or guardian permission. It is not offered to children under 13. A parent or guardian may contact us about participation or privacy; we consider their authority and the young person's rights. If you believe an underage child supplied information, contact us so we can investigate and take appropriate action.

11. Disclosures required by law

We may disclose information when lawfully required or necessary for a legitimate security or legal response, with appropriate safeguards. We do not disclose a waitlist address to other members or make it a public profile.

12. Changes and contact

We will revise the date when this notice changes and provide additional notice or obtain consent where required. A policy update does not itself authorize a new optional use. Contact support@28dap.com, or write to Elliott AI Foundry LLC, 1451 Rockville Pike, Ste 250 PMB 206, Rockville, MD 20852, United States.

Live provider disclosures

• Vercel trust center
• Supabase subprocessors
• Resend subprocessors
• Google Workspace subprocessors

These live resources describe provider arrangements; their downstream lists may change.