Privacy Policy

Effective date: September 9, 2026
Last updated: September 9, 2026

This Privacy Policy explains how Shodan Media Ltd. ("Shodan Media", "we", "us", "our") collects, uses, discloses and protects personal information in connection with the BJJ Mental Models website at bjjmentalmodels.com, the BJJ Mental Models podcast, our email newsletters, the BJJ Mental Models Premium subscription, and our community spaces (together, the "Services").

Shodan Media Ltd. is a company incorporated in British Columbia, Canada, and is the controller of the personal information described in this policy.

Contact: [email protected]

---

1. Information we collect

Information you give us

• Account and contact details — name, email address, and any other details you enter when you subscribe to the newsletter, create an account, or buy a product.
• Purchase and billing information — what you bought, when, the amount, your subscription status, and the billing country and postal code your card issuer provides. We never see or store your full payment card number. Card details go directly to our payment processors.
• Content you send us — emails, support requests, survey responses, form submissions, competition or giveaway entries, mailing addresses you give us for merchandise or patch shipments, and any video, audio or written material you submit for review as part of a Premium service.
• Community activity — if you join our Discord server or another community space, the profile information and messages you post there.

Information we collect automatically

• Device and usage data — IP address, browser and device type, operating system, referring page, pages viewed, and the dates and times of your visits.
• Email engagement — whether an email we sent was opened and which links in it were clicked.
• Cookies and similar technologies — see section 4.

Information from third parties

• Confirmation of payment and subscription status from our payment processors.
• Aggregate listening statistics from podcast hosting and podcast apps. These are reported to us in aggregate and do not identify individual listeners.
• Publicly available profile information where you interact with us on a social platform.

2. How we use your information

• To provide the Services — deliver purchased content, run your subscription, and give you access to Premium material and community spaces.
• To process payments, issue receipts and refunds, and manage renewals, pauses and cancellations.
• To send you the newsletter and other content you asked for, and to send service messages about your account, your subscription or your purchases.
• To answer your questions and provide customer support.
• To ship physical items you have requested, such as patches and decals.
• To understand how the Services are used so we can improve them and decide what to make next.
• To keep the Services secure, prevent fraud and abuse, and enforce our terms.
• To meet our legal, tax and accounting obligations.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

3. Legal bases for processing (EEA and UK)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases under the GDPR and UK GDPR:

• Performance of a contract — to give you the products, subscription and account you have paid for or signed up to.
• Consent — to send marketing emails, and to set non-essential cookies. You can withdraw consent at any time; withdrawing it does not affect processing carried out before you withdrew it.
• Legitimate interests — to secure the Services, prevent fraud, understand how our content is used, and communicate with existing customers about the products they use. We balance these interests against your rights and do not rely on this basis where your interests override ours.
• Legal obligation — to keep records required by tax, accounting and consumer-protection law.

4. Cookies and similar technologies

Our website uses cookies and similar technologies to:

• Keep the site working — sign you in, remember your session, keep your cart, and protect against fraud. These are strictly necessary and cannot be turned off.
• Remember your preferences — such as settings you have chosen.
• Measure usage — count visits and understand which pages and content people use, so we can improve them.

You can block or delete cookies through your browser settings. If you block strictly necessary cookies, parts of the Services will not work — you will not be able to sign in or access purchased content.

We honour Global Privacy Control (GPC) signals where our systems receive them. Because there is still no common standard for "Do Not Track" browser signals, we do not respond to DNT headers.

5. Who we share information with

We share personal information only with service providers who need it to run the Services on our behalf, and only for that purpose. They are bound by contract to protect it and may not use it for their own purposes.

Provider	What it does for us
Kajabi, LLC (United States)	Hosts the website, member accounts, courses and email delivery, and processes purchases
Stripe, Inc. and PayPal, Inc.	Process payments and store card details on our behalf
Discord, Inc.	Hosts our community server, where you join under your own Discord account
Podcast hosting and distribution providers	Deliver podcast episodes and report aggregate listening statistics
Airtable, Inc.	Stores customer records and request queues we use to run the business
Analytics providers	Report aggregate site and email usage

We may also disclose personal information where we are required to by law, to a court or regulator, or where it is necessary to establish, exercise or defend legal claims, or to protect the rights and safety of any person. If our business is sold or reorganized, customer information may be transferred as part of that transaction; you will be told if that happens and if it changes how your information is handled.

6. International transfers

We are based in Canada, and our service providers are largely based in the United States. Your personal information will therefore be stored and processed outside your country, including in Canada and the United States, where it may be accessible to law enforcement and national security authorities under the laws of those countries.

Where we transfer personal information out of the EEA or the UK, we rely on the European Commission's adequacy decision for Canada (for commercial organizations subject to PIPEDA) and, where an onward transfer is not covered by an adequacy decision, on Standard Contractual Clauses or the UK International Data Transfer Addendum in our agreements with the relevant provider.

7. How long we keep it

• Account and subscription records — for as long as your account is open, and afterwards for as long as we need them to handle disputes and meet tax and accounting requirements (generally seven years in Canada).
• Newsletter subscriptions — until you unsubscribe, plus a suppression record so we do not email you again by mistake.
• Support correspondence — up to three years after the matter is closed.
• Analytics and usage data — in aggregated or de-identified form, which is no longer linked to you.

8. Security

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls, and vendors who maintain their own recognized security programmes. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the relevant regulators as the law requires.

9. Your rights

Wherever you live, you can ask us to:

• Tell you what personal information we hold about you and how we use it
• Give you a copy of it
• Correct it if it is wrong or incomplete
• Delete it
• Stop sending you marketing email — every marketing email also has an unsubscribe link

To make a request, email [email protected]. We may need to verify your identity, usually by confirming you control the email address on the account. We respond within 30 days, or within 45 days in California where the law allows an extension, and we will tell you if we need longer. Exercising any of these rights costs nothing and we will not treat you differently for doing so.

If you are in the EEA, the UK or Switzerland

In addition to the above, you have the right to restrict or object to processing, the right to data portability (to receive your information in a structured, commonly used, machine-readable format), and the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects — we do not make such decisions. You also have the right to lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office at ico.org.uk.

If you are in California

Under the California Consumer Privacy Act as amended by the CPRA, you have the right to know, delete, correct, and opt out of sale or sharing, and the right not to be discriminated against for exercising those rights. You may use an authorized agent to make a request on your behalf; we will ask for proof of their authority.

In the past 12 months we have collected these categories of personal information, from the sources and for the purposes described in sections 1 and 2, and disclosed them for business purposes to the categories of service providers listed in section 5:

• Identifiers — name, email address, IP address, account identifiers, and mailing address where you have given us one
• Customer records — purchase and billing information under Cal. Civ. Code § 1798.80
• Commercial information — products purchased, subscription history
• Internet or network activity — browsing and interaction with our site and emails
• Audio, electronic or visual information — where you submit material to us, such as a video for review
• Inferences — preferences drawn from what you have bought or read, used to decide what content to offer

We do not collect sensitive personal information as that term is defined by the CPRA, we do not sell or share personal information, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16.

If you are in Canada

Our privacy officer can be reached at [email protected]. If you are not satisfied with how we have handled your personal information or your request, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca.

10. Children

The Services are intended for adults. We do not knowingly collect personal information from children under 16, or under 13 in the United States. If you believe a child has given us personal information, email [email protected] and we will delete it.

11. Third-party sites

Our content links to other websites, podcast apps, social platforms and our partners' products. We do not control them and this policy does not cover them. Read their privacy policies before giving them your information.

12. Changes to this policy

We may update this policy from time to time. The effective date at the top shows when it last changed. If we make a material change to how we use your personal information, we will tell you by email or by a notice on the website before the change takes effect.

13. How to contact us

Shodan Media Ltd.
British Columbia, Canada
[email protected]