Privacy

Last updated: 28 October 2026

What we collect, why, who helps us handle it and what you can ask us to do. We never sell your data.

Who is responsible

The controller of your personal data is ROAS HACK LLP, a limited liability partnership registered in England and Wales, no. OC451746, registered office 27 Old Gloucester Street, London WC1N 3AX, United Kingdom, trading as Brains over Bots. Email: hello@brainsoverbots.com.

What we collect

• When you sign up for the free session: your email, your name if you give it, the session time you pick, your time zone and the campaign you came from (the tags in the link you clicked) and, if you fill it in, the optional form after you sign up: your country, company and job title, what you find hardest about AI (pick or write it) and a question for the live Q&A.
• When you buy: your name, email, country and billing details, your company name and VAT number if you give them, and what you bought. The campaign you came from and the button you used travel to Stripe with your order. Card and payment details go to Stripe, or to Klarna or Clearpay if you pay with them. We never see or store your card details. The checkout page keeps the email you type in your browser’s session storage until you pay or close the tab. Payment is processed by Stripe.
• In the course: your Kajabi account, which modules you open, and the questions you post in the course chat or ask in the live Q&As.
• If you enter our prize draw or video competition: what your public post shows (your handle, the link, the caption and the view count). If you win: your name, your country and the email or account you write to us from. Details are on the prize draw page.
• When you email us or message our assistant: your message and our reply. On Telegram, Facebook Messenger and Instagram (and on WhatsApp, if we connect it) our AI assistant answers at once and hands you to a person on the team when you ask or when it can’t help; it sees what you write in the chat.
• Technical data: our hosting and network providers keep short server logs (IP address, browser, time) to keep the site running and secure.
• Unless you switch cookies off: the pages you see, what you click, your device and browser, and the ad that brought you, through the tools listed under Cookies. Unless you switch advertising off, our server also passes your IP address and browser type to Meta and TikTok with a sign-up, a checkout, a purchase or joining the live session, and keeps the ad click details and a scrambled visitor id of a checkout visit for 14 days, or after a reservation until the balance is paid (at most 120 days), so a payment made later can be matched; then they are deleted.
• Our own analytics database: the pages you see and what you do on them, with your IP address, device, browser, rough location and the campaign that brought you; for a sign-up, a purchase or a refund also your email, name and phone as you gave them, and the emails we send you and whether you opened them. It stays in the EU and helps us see which marketing works and prevent fraud.

Why, and on what legal basis

• To run the free session and the course you signed up for, and to send you the emails that go with them: to perform our contract with you.
• To take payments, keep accounts and send invoices: our legal obligations.
• To keep the site secure and prevent fraud, to see which campaigns bring people to the site, and to plan the sessions with your optional answers: our legitimate interests.
• To run the prize draw and the video competition you entered and give out the prizes: to perform the terms of that promotion.
• To send you news, such as when the next cohort opens: your consent. You can unsubscribe in any email.
• To measure visits and our ads with cookies and similar tools: our legitimate interest in knowing which ads work. You can switch them off at any time in Cookie settings.

Who helps us

These providers handle data for us, only as far as they need to:

• Stripe (payments), and the payment methods you pick at checkout. Depending on your country, the checkout can offer PayPal, Billie, Revolut Pay, Link, Klarna and Clearpay, Apple Pay and Google Pay; the one you use gets your payment details and the order. Stripe keeps payment records as long as the law requires.
• Brevo (all our email about the free session and the course: your sign-up, reminders, your receipt and the news you asked for). In the EU. Kept as described under “How long we keep it”; you can unsubscribe in any email.
• Anthropic (the AI model behind our assistant: it gets the messages you send the assistant, so it can answer). In the US. We keep the chat for 30 days, in Cloudflare’s storage, then it is deleted.
• Telegram and Meta (Facebook Messenger and Instagram, and WhatsApp if we connect it): the apps you use to message our assistant. They carry your messages under their own privacy policies. Our team reads and answers these chats in a private Telegram group.
• YouTube (Google): the live room of the free session streams on YouTube. If you watch it, YouTube’s own privacy policy applies to what it collects. Google processes data in the US, among other places.
• Kajabi (the course platform: your account, the modules you open and your posts in the course chat). In the US. Kept while you have access and up to 12 months after.
• Hetzner (hosting, in Germany). Our customer records (Twenty, the CRM we run ourselves on our own server there: who signed up, what they bought, the questions they asked us) and our analytics database (ClickHouse, also in Germany) live there. Kept for 12 months after your course access ends, or for the periods under “How long we keep it”.
• Cloudflare (network and security, and the databases, D1 and KV, where we store sign-ups, orders and support chats). Kept for the periods under “How long we keep it”.
• Zoho (our own team email, in the EU).
• Unless you switch them off in Cookie settings: Google (Analytics and Ads), Meta (Facebook and Instagram ads) and TikTok.

Some of them process data outside the UK and the EU, for example in the US. Where they do, the transfer is covered by UK or EU adequacy decisions, the EU’s standard contractual clauses or the UK’s international data transfer agreement.

How long we keep it

• Accounting records, including what you bought and the name and email it was bought with: six years, as UK law requires. We use this record to give and remove course access and to handle refunds.
• Your course account: while you have access, and up to 12 months after, so we can answer questions about your purchase.
• News emails: until you unsubscribe.
• Chats with our assistant on Telegram, Messenger and Instagram: 30 days.
• Free-session sign-ups: until 12 months after the session, unless you join the course.
• Our analytics database: the pages you see, your IP address and what the ad platforms answered, up to 25 months; sign-ups, joining the live session and email events, up to 13 months; payments, as long as the accounting records.

Cookies and your browser

Some things are always on, because the site needs them: Cloudflare, our network provider, may set a strictly necessary security cookie, and your browser remembers your cookie choice. While a page is open, it keeps a few things in your browser’s session storage, such as your score in the mistake hunt and the campaign you came from; they are deleted when you close the tab. Cloudflare Web Analytics counts visits and measures page speed without cookies.

Cookies for measurement and advertising are on from your first visit. You can switch them off at any time with Cookie settings, at the bottom of every page.

• Measurement (Google Analytics, by Google): counts visits, the pages you see and what you click, so we know what works. Cookies _ga and _ga_…, kept up to 2 years.
• Advertising (Google Ads, Meta, TikTok): tells these platforms which ad brought you and whether you signed up for the free session or bought the course, and lets us choose who sees our ads, including people similar to our visitors. Cookies _gcl_… (Google, 90 days), _fbp and _fbc (Meta, 90 days), _ttp and ttcsid… (TikTok, up to 13 months). When you sign up or buy, your browser and our server also send these platforms your email in hashed form (scrambled with SHA-256), so they can match the visit to an account they already have. They never get your address in plain text.
• Partner referral (part of advertising): if you came through a link from one of our partners, the cookie bob_pc keeps that link’s id for 30 days, so the partner is credited if you buy. It holds no personal data and is deleted when you switch advertising off. Such a visit goes to separate advertising accounts of ours, never mixed with our own ads, and, if the partner has connected them, also to the partner’s own Meta or TikTok accounts: your visit, a sign-up, a checkout or a purchase, with your email in hashed form. The partner uses that under its own privacy policy.
• Fraud check on sign-ups: when you register, the page works out a device identifier with the open-source FingerprintJS library, run from our own site (nothing goes to its maker). It goes only with your registration to our partner system, which uses it to spot many sign-ups from one device so partners are not paid for fake ones, and deletes it there after 30 days. A copy stays with your registration in our own analytics database for the same fraud checks and is deleted with it, at most 13 months after you register. It is not a cookie and is never used for advertising. Legal basis: our legitimate interest in preventing fraud.
• Bot check: our sign-up forms and our partners’ pages run Cloudflare Turnstile in its invisible mode, which looks at signals from your browser to tell people from automated scripts. You see nothing and it never stops you; the result (passed, failed or not run) is kept with your registration or the partner’s click in our partner system for the same fraud check. Cloudflare processes it as our service provider under its own privacy policy. Legal basis: our legitimate interest in preventing fraud.
• Visitor id and first visit (part of advertising): our own server sets bob_uid, a random id that lets Meta and TikTok link your visits, sign-up and purchase (sent scrambled; kept up to 400 days), and keeps _fbp, _fbc and _ttp for their usual lifetimes. The cookie bob_ft remembers how you first found us (the campaign or site, kept 90 days). Switching advertising off deletes them.

Once you switch them off, Meta and TikTok receive nothing more, and Google receives only signals without cookies, which it uses to estimate overall results (Google’s “consent mode”); the page address in them can carry the click id of the ad you came from. Google Tag Manager, which loads these tools, sets no cookies itself. When you switch them off, we delete the cookies this site set; cookies the platforms keep on their own websites stay under their control.

Google acts for us for Analytics and on its own account for Ads. For the data Meta and TikTok collect through their tools, we and each of them are joint controllers, and each also uses it under its own privacy policy. Google and Meta process data in the US, among other places; TikTok’s privacy policy says some of its staff outside Europe, including in China, can access data.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit or object to how we use it, or to move it to someone else. Where we rely on your consent, you can withdraw it at any time. Email hello@brainsoverbots.com.

If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk) in the UK, or to the data protection authority in your EU country.

Children

The course is for adults. We don’t knowingly collect data from anyone under 18.

Changes

If we change this page, we update the date at the top.