This policy explains what personal data ACG Foundation collects when you use this website, contact us, request a consultation or buy our services, and what we do with it. We collect only what we need to answer you and deliver your work. We do not sell your data.
1. Who is responsible
ACG Foundation, based in Morocco, is the controller of the personal data described here. Contact for anything about your data: hello@acg.foundation.
When you pay, Whop processes your payment as payment processor. Whop is responsible for the payment data it collects under its own privacy policy, and shares order details with us (such as your name, email, what you bought and payment status) so we can deliver the service.
2. What we collect
| When | What |
|---|---|
| You fill in the contact form, the plan form or request a consultation | Your name, email, business name, phone or WhatsApp (optional), country, industry, the services you're interested in, budget and launch timing, whether you have a logo or domain, your website or social links (optional), what you tell us about your business, and how you heard about us (optional). If you build a plan, the services and billing period you chose. |
| You pay | Your name, email, what you bought, the amount, billing country and payment status, from Whop. We never receive your full card number; card data is handled by Whop and its payment partners under PCI DSS. |
| We work for you | Content, files and account access you give us to deliver the service, our emails and call notes, and records of what we delivered. |
| You browse this site | Technical data our host Cloudflare processes to serve and protect the site: IP address, approximate country, browser type and request logs. We use the country to tell you if online checkout isn't available where you are. We don't use analytics, advertising or tracking cookies (see our Cookie Policy). |
Please don't send us sensitive data (such as health information or government ID numbers). We don't need it.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Answering your request, preparing a plan and price, booking a consultation | Steps you ask for before a contract |
| Delivering the services you bought, kickoff and delivery emails, support | Contract |
| Accounting, tax and legal record-keeping | Legal obligation |
| Handling refunds, disputes and chargebacks, preventing fraud and spam, keeping the site secure | Legitimate interests |
| Showing your work in our portfolio | Your consent, which you can withdraw at any time |
We only send you emails about your request or your order. We don't send marketing emails unless you ask for them, and every marketing email would include a way to unsubscribe.
4. Who processes it for us
- Whop: payment processing, receipts, subscriptions and refunds.
- Cloudflare: website hosting, security, and the database where we store your requests and orders.
- Resend: sending our emails to you and order notifications to us.
- Our email and video-call providers: to correspond with you and hold Zoom (or similar) calls.
- Platforms you ask us to set up: for example your domain registrar, hosting, Google Business Profile or social media accounts, under your own account with them.
These providers process data only on our instructions or under their own terms as independent controllers (as Whop does for payments). We share data with authorities only when the law requires it, and with professional advisers (such as an accountant) under confidentiality.
5. International transfers
We are based in Morocco, and our providers operate in several countries, including the United States and the EU. When your data moves between countries, we rely on the safeguards our providers offer, such as the European Commission's standard contractual clauses or an adequacy decision.
6. How long we keep it
- Requests that don't become orders: up to 12 months, then deleted.
- Orders, invoices and payment records: as long as tax and accounting law requires (usually up to 10 years).
- Project files and access details: while you are a client and up to 12 months after, unless you ask us to delete them sooner. We delete passwords you shared as soon as the work is done.
- Hosting logs: kept by Cloudflare for a short period under its own policy.
7. How we protect it
We use encrypted connections (HTTPS), access controls and providers with strong security practices. Only the people working on your project see your data. If a data breach puts your rights at risk, we will tell you and the relevant authority as the law requires.
8. Your rights
Depending on where you live, including under the EU and UK GDPR and Morocco's Law 09-08, you can ask us to:
- access the personal data we hold about you, or receive a copy in a portable format;
- correct it, or delete it (unless we must keep it by law);
- restrict or object to how we use it, including withdrawing consent at any time;
- not be subject to decisions based solely on automated processing (we don't make any).
Email hello@acg.foundation. We reply within 30 days and may ask you to confirm your identity. You can also complain to your local data protection authority (in Morocco, the CNDP).
9. California residents (CCPA/CPRA)
In the last 12 months we collected the categories of data listed in section 2: identifiers (name, email, phone), commercial information (services bought), internet activity (technical logs) and business information you provided, for the purposes in section 3. We do not sell or share personal information for cross-context behavioural advertising, and we don't use or disclose sensitive personal information. You have the right to know, delete and correct your data and not to be discriminated against for using these rights. Email us to make a request; an authorised agent may request on your behalf with your written permission.
10. Children
Our services are for businesses and adults. We don't knowingly collect data from anyone under 16. If you think a child has sent us data, email us and we will delete it.
11. Changes
We may update this policy as our services or the law change. We'll post the new version here with a new date and, for significant changes, email clients.