THE SSCA METHOD
Privacy notice
Last updated 12 July 2026. This notice covers the public funnel, member account and private payment sandbox on sscamethod.com.
Who controls the data
The controller is the Institute of Projective Drawings, Budapest, Hungary. For privacy requests, email dr.vass.zoltan@gmail.com. This is the currently monitored contact address; a dedicated privacy mailbox will replace it only after that mailbox is verified.
What we process and why
| Data | Purpose and legal basis | Typical retention |
|---|---|---|
| Name, email, profession, optional use case, quiz answers/score, landing variant and UTM fields | Deliver the requested resource and, only with explicit consent, send SSCA Method teaching, webinar and enrolment updates. Consent may be withdrawn at any time. | Until unsubscribe/withdrawal or deletion, subject to suppression records needed to honour the withdrawal. |
| Account name/email, bcrypt password hash, session version, access entitlements and reset-token fingerprint | Create and secure the member account and deliver authorised content. Contract preparation/performance and legitimate security interests. | For the life of the account, then deleted or anonymised unless a legal retention duty applies. |
| Sandbox order product, amount/currency, time, Braintree test transaction ID, idempotency key and accepted sandbox-terms version | Test checkout and semester access. These are not real purchases or charges. | Until the sandbox test is cleaned up or the test account is deleted. |
| Security counters derived from email/IP, request time and technical logs | Prevent abuse, diagnose faults and protect accounts. Legitimate security interests. | Short operational period where supported; the present sandbox store is being replaced before real payments. |
| Cookieless page-view event: landing variant, limited campaign field and time | Measure funnel conversion without identifying a visitor. | For the launch measurement period, then aggregated or deleted. |
| Necessary session cookie and local consent/sandbox-test settings | Keep a member logged in and remember choices. The session cookie is necessary; optional advertising storage requires consent. | Session expiry or browser/site-data deletion. |
| Meta advertising event | Measure advertising only after the visitor selects Accept. | Under Meta's retention terms and the visitor's browser controls. |
Processors and transfers
- Vercel: site hosting, serverless functions and Edge Config member/sandbox storage.
- SalesAutopilot: the dedicated English mailing list and consent fields.
- Resend: requested-resource, account, reset and sandbox receipt emails.
- Braintree/PayPal: card UI and sandbox transaction processing. Real payment processing is disabled.
- Cloudflare: temporary encrypted video/PDF transport from the private media host.
- Meta: advertising measurement only after consent.
- Google and other static-asset CDNs: fonts or scripts on some legacy mirrored pages; they may receive ordinary request metadata such as IP address and user agent.
Providers may process data outside the EEA/UK using their applicable transfer safeguards. We do not sell personal data.
Emails and withdrawing consent
Requested-resource emails are sent by Resend while the lead record is also stored in the dedicated English SalesAutopilot list. With consent, Resend schedules three short English teaching messages over the next nine days. Their identifiers are stored under a pseudonymous key in Edge Config so the remaining messages can be cancelled. Marketing emails include an unsubscribe link and one-click unsubscribe header. Unsubscribing cancels scheduled messages, updates SalesAutopilot and, where an account exists, its local marketing preference. Essential security, account and sandbox-transaction messages are not marketing.
Your rights
Depending on the applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier lawful processing. You may also complain to your data-protection authority.
Members can view basic account data and request account deletion at the account page. Buyers' legally required accounting records would need to be retained separately before real payments launch; real payments are currently disabled.
Cookies and optional measurement
The public funnel works if Meta measurement is declined. Accept and Decline must be equally available. Clear this site's browser storage to reset the local choice.
Current launch status: the public site is an early-access funnel and Braintree is a private sandbox. A separate approved offer, contract, payment/privacy review and production data store are required before real-money enrolment.