Privacy Policy

This Privacy Policy is published by Real Kube LLC, a Virginia limited liability company, with a business mailing address at 329 David Dr, Winchester, VA 22602. Real Kube LLC operates the Tech Pathway Scorecard, the Tech Career Blueprint, the Tech Pathway Accelerator, the All-Access Implementation Membership, and related career-planning and learning products (collectively, the "Service").

For privacy questions or requests: info@theuntaughtrules.com.

For all other support, including billing and refunds: support@theuntaughtrules.com.

Postal address: Real Kube LLC, 329 David Dr, Winchester, VA 22602.

This policy describes how Real Kube LLC collects, uses, shares, and retains personal data when you use the Service — including the public TechPath Scorecard assessment, career explorer pages, account registration, learning portals, resume and job-search tools, checkout, and community features. It applies to visitors, registered users, and paying customers. It does not apply to third-party services we link to (Stripe checkout, GoHighLevel community spaces, scheduling tools); those services have their own privacy policies.

Assessment data: Your responses to TechPath Scorecard questions, the computed pathway scores, identified strengths, skill gaps, and recommended seven-day action. We store these in an AssessmentAttempt record linked to your account.

Profile data: Your selected primary and secondary pathways, weekly study hours, target timeline, work-location preference, hands-vs-desk preference, customer-facing preference, current job, prior industry, career concerns, transferable skills, and evidence gaps. Stored in a UserProfile record.

Account data: Your name and email address, provided at registration or via Google OAuth. Your password is stored as a hashed value by the authentication provider; we never see or store the plain-text password.

Payment identifiers: Stripe customer ID, checkout session ID, payment intent ID, subscription ID, and invoice ID. We do not store credit-card numbers, CVV codes, or full payment-card details — those are handled exclusively by Stripe.

Resume and career data: Resume content, target roles, target companies, cover letters, job-application records (company, role, URL, status, notes), networking contacts, and interview notes that you create.

Uploaded documents: Evidence artifacts and portfolio items you upload (files stored as URLs). These may contain personal information you include in them.

Marketing attribution data: UTM parameters, landing page, referring domain, Meta Pixel browser ID (_fbp), Meta Click ID (_fbc), and Google Analytics client ID — captured from your browser to attribute purchases and measure advertising effectiveness.

Usage and technical data: Pages visited, events triggered (assessment started, offer viewed, checkout begun, purchase completed), IP address (received by the server), browser type, and device type. This data is used for analytics and security.

Audit data: Records of administrative actions (access to user records, entitlement changes, billing adjustments, data exports, data deletions) stored in an immutable audit log.

We receive data from three sources:

• Directly from you — when you complete the assessment, fill in your profile, create a resume, upload evidence, or enter a job application.
• Automatically from your browser — cookies, local storage, session storage, and server logs that record pages visited and events triggered.
• From third-party services — Stripe provides payment identifiers and transaction status; Google provides your name and email if you sign in with Google; GoHighLevel provides fulfillment and CRM status.

We process your data for the following purposes:

• Calculating and displaying your personalized career assessment results.
• Creating and managing your account, profile, and learning progress.
• Processing payments, managing subscriptions, and granting product access (entitlements).
• Delivering learning content, labs, projects, and community access.
• Providing AI-assisted features (resume drafting, cover-letter generation, career positioning) when you have given AI-use consent.
• Synchronizing contact information with our CRM (GoHighLevel/CCM) for onboarding and customer communication.
• Measuring marketing effectiveness and attributing purchases via analytics and advertising platforms.
• Maintaining security, preventing fraud, and keeping an audit trail of administrative actions.
• Complying with legal obligations.

The Service uses cookies, local storage, and session storage. A detailed inventory is available in our Cookie Policy.

• Strictly necessary — authentication tokens, Stripe checkout, security, and core page function. These load without consent.
• Optional analytics (Google Analytics 4) — browser cookies (_ga, _ga_*) and server-side Measurement Protocol events. These are consent-gated: the scripts do not load and no events are sent until you grant analytics consent.
• Optional advertising (Meta Pixel) — browser cookies (_fbp, _fbc) and server-side Conversions API events. These are consent-gated: the scripts do not load and no events or advertising identifiers are sent until you grant advertising consent.
• Local storage — stores your theme preference, sidebar state, consent choice, and anonymous assessment progress (7-day TTL) on your device.
• Session storage — stores marketing attribution data and purchase-event deduplication keys for the duration of your browser session.

Server-side processing follows your saved consent. After a verified purchase, server-side GA4 Measurement Protocol events are sent only when you granted analytics consent at checkout, and server-side Meta Conversions API events are sent only when you granted advertising consent. Your consent choice is captured as an immutable snapshot on your payment record and never overridden by a later retry.

Necessary processing does not depend on optional consent. Payment processing, fraud prevention, authentication, and fulfillment (entitlement creation, access granting, billing notices) proceed regardless of your analytics or advertising consent choices. You will always receive the products you purchased and the billing notices you need, even if you reject all optional tracking.

We use Google Analytics 4 (Measurement ID G-8GQ9JH6LFL) to understand how visitors use the Service. GA4 collects page views, events, session duration, and an anonymized client identifier. GA4 data is sent to Google's servers.

We also use the GA4 Measurement Protocol to send server-side purchase events to Google Analytics after a verified payment. These server-side events include a transaction ID, product key, and purchase amount, but do not include assessment answers or resume content.

We additionally use Base44 Analytics, the platform's built-in analytics, to track events such as assessment starts, pathway selections, and entitlement creation.

We use Meta Pixel (Pixel ID 1304775894926806) in the browser to measure ad effectiveness and retargeting. The Meta Pixel fires PageView, ViewContent, InitiateCheckout, Lead, and Purchase events on relevant pages.

We also use the Meta Conversions API (CAPI) to send server-side purchase events to Meta after a verified payment. These events include a hashed email address, Meta browser ID (_fbp), Meta Click ID (_fbc), product key, and purchase amount for ad attribution and deduplication with browser Pixel events.

Your data supports targeted advertising. Meta uses the data we send to show you relevant ads on its platforms and to measure the effectiveness of our advertising campaigns. We do not sell your personal data to Meta; we share it as a data processor for ad measurement.

The TechPath Scorecard generates career-pathway recommendations based on your self-reported answers. The scoring engine matches your responses to weighted factors for five entry-level tech career pathways. The results are informational and educational. They do not guarantee employment, salary, certification success, or employer acceptance.

We store your assessment answers, computed scores, identified strengths, skill gaps, and recommended seven-day action in an AssessmentAttempt record. This data is used to personalize your experience and improve the scoring engine.

When you register, we collect your email address and a password (stored as a hash by the authentication provider). If you register with Google OAuth, we receive your name and email from Google. Your name is used to personalize results and communications; your email is used for account login, results delivery, payment receipts, and CRM synchronization.

Payments are processed by Stripe. When you initiate a checkout, we create a PaymentRecord that stores the Stripe customer ID, checkout session ID, subscription ID, invoice ID, and payment amount in cents. Stripe handles all credit-card data directly — we never receive or store your card number, CVV, or full card details.

Payment identifiers are used to manage your subscription, process renewals, handle refunds, and grant product access. We store the payment environment (test or live) to ensure test payments never create production access.

After a verified purchase, we synchronize your contact information (name, email, and product details) with our CRM, GoHighLevel / Content Creator Machine (CCM). This allows us to send onboarding emails, workflow communications, and customer support messages. CCM is a third-party service with its own privacy practices.

We send CCM the following data: your email, name, Base44 user ID, Stripe customer ID, product key, pathway slug, payment plan, purchase status, access status, membership status, billing interval, current period end, and the CCM workflow type. We do not send CCM your assessment answers, resume content, or payment-card data.

We share data with the following third-party processors:

• Base44 — hosting, authentication, database, and application platform. Receives all data you submit to the Service.
• Google — Google Analytics 4 (page views, events, client ID), Google OAuth (name, email for sign-in), and Gmail (results email delivery).
• Meta / Facebook — Meta Pixel (page views, events, browser ID) and Meta Conversions API (hashed email, purchase data for ad attribution).
• Stripe — payment processing. Receives your email, payment method, and billing details.
• GoHighLevel / CCM — CRM and customer communication. Receives your contact information and product data after purchase.

Each processor has its own privacy policy governing how it handles your data. We encourage you to review their policies.

We share your data with the third-party processors listed above for the purposes described. We do not share your data with any other third parties except:

• When required by law, court order, or legal process.
• To protect the rights, property, or safety of Real Kube LLC, our users, or others.
• In connection with a merger, acquisition, or sale of all or part of our business.

We do not share your assessment answers, resume content, or uploaded documents with advertising or analytics platforms.

We do not sell your personal data. We do not rent or trade your personal data to third parties for their independent marketing purposes. The data we share with processors (Google, Meta, Stripe, GoHighLevel) is for our own service delivery, analytics, and advertising measurement — not for sale.

Yes. We use Meta Pixel and Meta Conversions API to measure and optimize advertising campaigns on Meta's platforms (Facebook, Instagram). Meta may use the data we share to show you relevant ads. You can opt out of targeted advertising by:

• Disabling the Meta Pixel in your browser (ad blockers, cookie blockers, or browser privacy settings).
• Adjusting your Meta ad preferences at facebook.com/ads/preferences.
• Submitting a privacy request to opt out of targeted advertising via our Privacy Request page.

We retain your data for as long as your account is active. When you request account deletion, we begin a 14-day grace period during which you can cancel. After the grace period, an admin permanently removes your in-app data (assessment attempts, profile, resumes, job applications, progress records, entitlements, and payment records).

Audit logs are retained indefinitely as an append-only security record. Audit logs contain actor IDs, action types, and timestamps — not your assessment answers or resume content. Even after account deletion, audit log entries referencing your user ID may persist for security and compliance purposes.

Payment records may be retained for as long as necessary to comply with tax and accounting obligations. Stripe retains its own records according to its policies.

Anonymous, aggregated data that cannot be linked back to you may be retained indefinitely for analytics and product improvement.

We take reasonable measures to protect your data, including:

• Row-level security (RLS) on all data entities — you can only read and modify your own records; admins can access records for support and review.
• Admin-only access to sensitive entities (audit logs, payment records, entitlements, lifecycle triggers).
• Immutable audit logging of all administrative actions.
• Server-side signature verification for all payment webhooks.
• Environment isolation (test data is separated from live production data).
• Password hashing managed by the authentication provider.

No system is perfectly secure. We cannot guarantee the absolute security of your data. If a data breach occurs, we will notify affected users and authorities as required by law.

You have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Correction — request that we correct inaccurate or incomplete data.
• Deletion — request that we delete your account and associated data.
• Portability — request an export of your data in a machine-readable format.
• Opt-out of targeted advertising — request that we stop sharing data with Meta for ad targeting.
• Consent withdrawal — withdraw consent for AI processing or marketing communications at any time.
• Appeal — appeal a decision we make about your privacy request.

To exercise any of these rights, visit our Privacy Request page or contact us at info@theuntaughtrules.com.

California (CPRA): California residents have the right to know what personal information is collected, request deletion, correct inaccurate information, opt out of the sale or sharing of personal information, and limit the use of sensitive personal information. We do not sell personal information. To exercise these rights, contact us at info@theuntaughtrules.com.

Virginia (VCDPA): Virginia residents have the right to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising and profiling. To exercise these rights, contact us at info@theuntaughtrules.com. We will respond within 45 days.

Other states: Residents of other states with consumer-privacy laws may have similar rights. Contact us for more information.

The Service is hosted in the United States and is primarily intended for U.S. users. If you access the Service from the European Union, the United Kingdom, or other regions with data-protection laws, you may have rights under the General Data Protection Regulation (GDPR) or the UK GDPR, including the right to access, rectification, erasure, restriction, portability, and objection.

We process personal data for the legitimate interests of providing the Service, fulfilling contracts, and complying with legal obligations. For questions about your GDPR rights, contact us at info@theuntaughtrules.com.

We have not yet completed a formal GDPR compliance assessment. If you require GDPR assurances, please contact us before using the Service.

The Service is not directed to children under 14. We do not knowingly collect personal information from children under 14. If you believe a child under 14 has provided us with personal information, please contact us at info@theuntaughtrules.com and we will delete it.

You can request deletion of your account and associated data at any time:

• From within the app: go to Privacy & Data → Delete your account & data. A 14-day grace period begins; you can cancel during this window.
• From the public Privacy Request page: submit a deletion request.
• By email: contact info@theuntaughtrules.com.

After the grace period, an admin permanently removes your in-app data. Your authentication account is removed by the platform provider. Audit log entries referencing your user ID may be retained indefinitely for security purposes. Stripe may retain payment records according to its own policies and legal obligations.

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page with a new "Last updated" date. If the changes are significant, we may also notify you by email or in-app message. Continued use of the Service after changes constitutes acceptance of the updated policy.

Prior versions of this policy are preserved and can be requested by contactinginfo@theuntaughtrules.com.

This Privacy Policy is effective as of September 22, 2026.