Privacy Policy

1The short version

The rest of this page is the detail behind those four sentences.

2Who is responsible

The data controller is Eldar Gezalov, trading as Blocs Master. For anything on this page — a question, a correction, a deletion request — write to [email protected] and it reaches me directly.

3What is collected, and why

Your account

When you create an account, whether free or paid, the site stores your name, your email address and a password. The password is stored as a one-way hash, which means it cannot be read back — not by me and not by anyone who obtained a copy of the database. Also recorded are which product groups you belong to, when you registered and when you last signed in.

This is held in the site's own database on the site's own hosting, using Sitelok, the membership software this site runs on. It is not held by a third-party membership platform, and it is not shared with one.

Your purchase

When you buy something, Paddle sends back the fact of the purchase — which product, which email address — so that your access can be unlocked. Card numbers, bank details and billing addresses stay with Paddle and never reach this site.

When you write to me

Support arrives as ordinary email, so your message and address sit in a mailbox like any other correspondence. Attachments and screenshots you send are kept only as long as they are useful for the thing you asked about.

Server logs

The web host keeps standard access logs — IP address, time, page requested, browser — as every web server does. They exist for security and for diagnosing faults, are not used to build any profile of you, and are rotated by the host on its own schedule.

4What is not collected

Worth stating plainly, because most sites cannot: there is no Google Analytics here, no Meta pixel, no advertising or retargeting tag, no session recorder, no heatmap tool, no chat widget and no cookie-consent banner — the last of which is absent precisely because there is nothing to consent to. Your card details never touch this site, and your personal data is never sold, rented or shared for anybody else's marketing.

5Cookies and browser storage

The site uses one cookie and two small pieces of browser storage. None of them tracks you across other websites.

• The Sitelok session cookie. Set when you log in, so the site knows it is you on the next page. It is what makes a login work at all, and it clears when you log out.
• bm-theme — remembers whether you chose the light or dark version of the site. Stored in your browser only.
• bm-progress — remembers which lessons you have watched, so a course can show a progress bar and a “resume where you left off” link. This never leaves your browser. It is not sent to the server, it is not attached to your account, and I cannot see it. The trade-off is that it is per-browser: clearing your site data, or moving from a Mac to an iPad, starts the ticks again.

Clearing your browser's storage for this site removes the last two at any time, and costs you nothing but the progress ticks.

6Who else is involved

Four other parties are involved in running this site, and no others.

• Paddle — takes every payment as Merchant of Record, and holds your billing details and invoice history. See Paddle's privacy policy.
• YouTube (Google) — hosts the course videos. They are embedded through youtube-nocookie.com, YouTube's privacy-enhanced mode, which does not set its usual tracking cookies unless you press play. Once you do, Google's privacy policy applies to that playback.
• The web host — stores the site's files and its database, and keeps the server logs described above.
• Substack — runs the newsletter, and only if you subscribe to it. Subscribing is entirely separate from having an account here; unsubscribing is one click in any issue.

Because the site and its providers are in different countries, your data may be processed outside your own. Where that involves personal data from the EU or UK, the providers above operate under the standard safeguards for such transfers.

7Legal basis for using your data

For anyone the GDPR or a similar law covers, the legal bases are straightforward. Your account details and purchase records are processed to perform the contract — without them the thing you paid for cannot be delivered. Server logs and basic security measures rest on legitimate interests, namely keeping the site working and unbroken into. Newsletter emails rest on your consent, which you can withdraw at any time. Tax and accounting records are kept to meet a legal obligation.

8How long it is kept

Your account is kept for as long as you have one, since deleting it would delete the access you paid for. Ask for it to be deleted and it goes. Purchase and tax records are kept for as long as tax law requires, which is generally several years and is not something either of us can waive. Support email is kept while it is useful and cleared out periodically. Server logs are short-lived and rotated by the host.

9Your rights

You can ask for a copy of what is held about you, ask for it to be corrected, ask for your account and data to be deleted, object to a particular use, or ask for your data in a portable form. You can also complain to your local data protection authority if you think something has been handled badly.

The quickest route for most of these is doing it yourself: your name, email address and password are editable on your account page. For anything else, email [email protected] from the address on your account and I will deal with it, normally within a few days and always within a month. There is no charge, and no form to fill in.

One thing to be clear about: deleting your account also ends access to everything bought with it, and no refund is due, so download anything you want to keep first.

10Security

The site is served over HTTPS, passwords are hashed rather than stored, payment details never reach the site at all, and administrative access is limited to me. No system is perfect, and anyone who claims otherwise is selling something — but the surface here is deliberately small, mainly because so little is collected in the first place.

11Children

This site is aimed at adults learning a professional skill and is not directed at children. Accounts are not knowingly created for under-16s. If you believe a child has registered, tell me and I will remove the account.

12Changes to this policy

This policy changes only when the site does. If a new service is ever added that touches your data, this page is updated first and the date at the top changes with it. Anything significant is announced to members by email.

---

See also the Terms of Use. Questions about either are welcome — just ask.